feat: tf ephemeral value and encrypted state examples

terraform-encrypted-state/kms.tf

@@ -0,0 +1,8 @@
+resource "aws_kms_key" "tf_state" {
+  description             = "KMS key for Terraform/OpenTofu state encryption"
+}
+
+output "kms_key_id" {
+  value       = aws_kms_key.tf_state.key_id
+  description = "KMS key id"
+}

terraform-encrypted-state/main.tf

@@ -0,0 +1,20 @@
+# Generate a random password
+resource "random_password" "main_password" {
+  length  = 128
+  special = false
+  upper   = true
+  lower   = true
+  numeric = true
+}
+
+# Create AWS Secrets Manager secret
+resource "aws_secretsmanager_secret" "main_password" {
+  name                    = "main-application-password"
+  description             = "Main application password"
+}
+
+# Store the password in the secret
+resource "aws_secretsmanager_secret_version" "main_password" {
+  secret_id     = aws_secretsmanager_secret.main_password.id
+  secret_string = random_password.main_password.result
+}

terraform-encrypted-state/providers.tofu

@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "us-east-1"
+}

terraform-encrypted-state/versions.tofu

@@ -0,0 +1,36 @@
+terraform {
+  required_version = ">= 1.7" # Encrypted state available in OpenTofu 1.7 and later
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.0.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0.0"
+    }
+  }
+
+  encryption {
+    method "unencrypted" "migrate" {} # to support the current unencrypted state
+
+    key_provider "aws_kms" "kms_key" {
+      kms_key_id = "INSERT_KMS_KEY_ID_HERE"
+      region     = "us-east-1"
+      key_spec   = "AES_256"
+    }
+
+    method "aes_gcm" "kms" {
+      keys = key_provider.aws_kms.kms_key
+    }
+
+    state {
+      method   = method.aes_gcm.kms
+      fallback {
+        method = method.unencrypted.migrate
+      }
+    }
+  }
+
+}

tf-ephemeral/ephemeral-resources.tf

@@ -0,0 +1,15 @@
+ephemeral "random_password" "random_password_ephemeral" {
+  length           = 16
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+resource "aws_secretsmanager_secret" "random_password_ephemeral_secret" {
+  name = "random_password_ephemeral_secret"
+}
+
+resource "aws_secretsmanager_secret_version" "random_password_ephemeral_secret_version" {
+  secret_id                = aws_secretsmanager_secret.random_password_ephemeral_secret.id
+  secret_string_wo         = ephemeral.random_password.random_password_ephemeral.result
+  secret_string_wo_version = 1
+}

tf-ephemeral/ephemeral-variables.tf

@@ -0,0 +1,28 @@
+variable "api_key" {
+  sensitive = true # Still stored in state!
+  default   = "xK9#mP2$vL@4qR7!nT6&wZ8*bY3^fH5j-EXAMPLE_SECRET_IN_PLAINTEXT"
+}
+
+# Before - using sensitive (stored in state)
+resource "aws_secretsmanager_secret_version" "sensitive_secret" {
+  secret_id     = aws_secretsmanager_secret.sensitive_secret.id
+  secret_string = var.api_key # ❌ Regular attribute - stored in state!
+}
+
+output "sensitive_secret" {
+  value = aws_secretsmanager_secret_version.sensitive_secret.secret_string
+  sensitive = true
+}
+
+
+variable "api_key_ephemeral" {
+  ephemeral = true # Never stored!
+  default   = "wJalrXUtnFEMI/K7MDENG/bPxRfiCY-EXAMPLE_SECRET_WONT_BE_STORED"
+}
+
+# After - using ephemeral (✅ never stored)
+resource "aws_secretsmanager_secret_version" "ephemeral_secret" {
+  secret_id                = aws_secretsmanager_secret.ephemeral_secret.id
+  secret_string_wo         = var.api_key_ephemeral # ✅ Write only attribute - NOT stored!
+  secret_string_wo_version = 1
+}

tf-ephemeral/main.tf

@@ -0,0 +1,11 @@
+########################################################################################
+# Create the secrets in AWS Secrets Manager
+# There is no secret stored in these resources. The actual secret is managed by the `aws_secretsmanager_secret_version` resource.
+########################################################################################
+resource "aws_secretsmanager_secret" "sensitive_secret" {
+  name = "demo-sensitive-secret"
+}
+
+resource "aws_secretsmanager_secret" "ephemeral_secret" {
+  name = "demo-ephemeral-secret"
+}

tf-ephemeral/providers.tf

@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "us-east-1"
+}

tf-ephemeral/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.11.0" # Ephemeral resources and variables are only available in Terraform 1.11 and later
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.0.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0.0"
+    }
+  }
+}