provider-ephemeral-resources — Claude Code skill
Walks a provider author through ephemeral resources on the Terraform Plugin Framework, where secrets reach the config and never land in state or plan.
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a claude-codeWhat provider-ephemeral-resources does
The skill covers Terraform 1.10+ ephemeral resources. Their whole point is keeping a value out of state and out of plan — issued tokens, generated passwords, short-lived certificates, decrypted secrets.
Three methods make up the lifecycle. Open is required and produces the value. Renew is optional and fires once the clock passes RenewAt. Close is optional and is the place to revoke leases. Lease identifiers travel between calls in resp.Private, so Renew and Close know what to extend or drop. Registration goes through provider.ProviderWithEphemeralResources and its EphemeralResources() method.
Worked Go code is included: struct tags, schema, a sample token resource. One limit matters. Renew cannot hand back a fresh value, it only extends the existing one. If an API rotates the token itself, build Open around a longer-lived value instead. The same guidance covers picking between an ephemeral resource and a data source — sensitive, apply-time-only values go ephemeral; plain read-only lookups stay a data source.
What it helps with
- add an ephemeral resource to a provider without breaking the build
- hand a token to a provider block or write-only attribute without persisting it
- renew an expiring credential during a running Terraform operation
- revoke a lease on close and leave nothing dangling
- choose between an ephemeral resource and a data source
Example prompts for the agent
- Add an ephemeral resource that issues a token for a role, with Open, Renew and Close
- Register the new ephemeral resource through EphemeralResources in the provider
- Show how to pass lease_id from Open into Renew via resp.Private
How to install provider-ephemeral-resources
1Skills CLI (Vercel)
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a claude-code2Manually: put the files in place
~/.claude/skills/provider-ephemeral-resources/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/provider-ephemeral-resources/
1Skills CLI (Vercel)
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a codex2Manually: put the files in place
.agents/skills/provider-ephemeral-resources/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a cursor2Manually: put the files in place
.cursor/skills/provider-ephemeral-resources/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install hashicorp/agent-skills provider-ephemeral-resources2Manually: put the files in place
.github/skills/provider-ephemeral-resources/SKILL.md1Skills CLI (Vercel)
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a gemini-cli2Platform CLI
gemini skills install https://github.com/hashicorp/agent-skills --path plugins/terraform/skills/provider-ephemeral-resourcesManually: put the files in place
.devin/skills/provider-ephemeral-resources/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about provider-ephemeral-resources
How do I install provider-ephemeral-resources in Claude Code?
Run npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a claude-code. The skill lands at ~/.claude/skills/provider-ephemeral-resources/SKILL.md.
What does provider-ephemeral-resources do?
It guides implementation of ephemeral resources in a Terraform provider on the Plugin Framework: schema, registration, the Open/Renew/Close cycle, and value passing through resp.Private.
What is the difference between an ephemeral resource and a data source?
A data source suits read-only lookups of non-sensitive data. Pick an ephemeral resource when the value is secret and only needed at apply time, so it stays out of state and plan.
