# provider-ephemeral-resources

Walks a provider author through ephemeral resources on the Terraform Plugin Framework, where secrets reach the config and never land in state or plan.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 917 installs · ★ 909
- Author: hashicorp
- License: MPL-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/hashicorp/agent-skills/tree/HEAD/plugins/terraform/skills/provider-ephemeral-resources/SKILL.md
- Updated: 2026-10-05
- HTML: https://affpapa.org/en/nevibecode/skills/provider-ephemeral-resources

## What it does

The skill covers Terraform 1.10+ ephemeral resources. Their whole point is keeping a value out of state and out of plan — issued tokens, generated passwords, short-lived certificates, decrypted secrets.

Three methods make up the lifecycle. `Open` is required and produces the value. `Renew` is optional and fires once the clock passes `RenewAt`. `Close` is optional and is the place to revoke leases. Lease identifiers travel between calls in `resp.Private`, so `Renew` and `Close` know what to extend or drop. Registration goes through `provider.ProviderWithEphemeralResources` and its `EphemeralResources()` method.

Worked Go code is included: struct tags, schema, a sample token resource. One limit matters. `Renew` cannot hand back a fresh value, it only extends the existing one. If an API rotates the token itself, build `Open` around a longer-lived value instead. The same guidance covers picking between an ephemeral resource and a data source — sensitive, apply-time-only values go ephemeral; plain read-only lookups stay a data source.

## Requirements
- Works with: Terraform

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/provider-ephemeral-resources/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/provider-ephemeral-resources/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/provider-ephemeral-resources/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/provider-ephemeral-resources/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install hashicorp/agent-skills provider-ephemeral-resources
```

2. **Manually: put the files in place**
- File: `.github/skills/provider-ephemeral-resources/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/hashicorp/agent-skills --path plugins/terraform/skills/provider-ephemeral-resources
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/provider-ephemeral-resources/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add hashicorp/agent-skills --skill provider-ephemeral-resources -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/hashicorp/agent-skills/tree/HEAD/plugins/terraform/skills/provider-ephemeral-resources/SKILL.md

## When to use it
- add an ephemeral resource to a provider without breaking the build
- hand a token to a provider block or write-only attribute without persisting it
- renew an expiring credential during a running Terraform operation
- revoke a lease on close and leave nothing dangling
- choose between an ephemeral resource and a data source

## Example prompts
- Add an ephemeral resource that issues a token for a role, with Open, Renew and Close
- Register the new ephemeral resource through EphemeralResources in the provider
- Show how to pass lease_id from Open into Renew via resp.Private

## Similar
- [wizard](https://affpapa.org/en/nevibecode/skills/wizard.md) — skill · 553369 installs
- [hyperframes-cli](https://affpapa.org/en/nevibecode/skills/heygen-com-hyperframes-cli.md) — skill · 1300000 installs
- [setup-pre-commit](https://affpapa.org/en/nevibecode/skills/setup-pre-commit.md) — skill · 489289 installs
- [using-git-worktrees](https://affpapa.org/en/nevibecode/skills/using-git-worktrees.md) — skill · 217153 installs
- [finishing-a-development-branch](https://affpapa.org/en/nevibecode/skills/finishing-a-development-branch.md) — skill · 214439 installs
- [orca-cli](https://affpapa.org/en/nevibecode/skills/orca-cli.md) — skill · 353600 installs

From the same set: [hashicorp/agent-skills](https://affpapa.org/en/nevibecode/by/hashicorp/agent-skills.md) — 20 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md