Platform or tool
terraform and opentofu
Relevant links
Goal or desired behavior
By default, terraform login or tofu login stores tokens on disk in plain text. Terraform/opentofu provides an interface for credential helpers to store these tokens in other secure systems, but there are no good implementations.
I want a credential helper that implements this interface to save tofu's tokens in a 1Password item.
It's not quite the same as other credentials I save in 1Password, since this token never has to be read or written by a human or copied to any other systems. It's just a secure way for tofu to write and read its own tokens. (When you do tofu login website.example it opens a web browser to the website's normal human login process, and that process generates a token which is given to tofu.) But I think 1Password is the right place for this because it's an existing secure system, and I'm already hooked into it for other tofu authentication I do (e.g. via the aws 1password plugin).
Contribution
Additional information
I believe this is an entirely different system than what the existing Terraform plugin covers.
Also related: The existing terraform plugin doesn't support opentofu #483
Open question: Should this be added to the existing terraform plugin, or should it be its own plugin?
Platform or tool
terraform and opentofu
Relevant links
Goal or desired behavior
By default,
terraform loginortofu loginstores tokens on disk in plain text. Terraform/opentofu provides an interface for credential helpers to store these tokens in other secure systems, but there are no good implementations.I want a credential helper that implements this interface to save tofu's tokens in a 1Password item.
It's not quite the same as other credentials I save in 1Password, since this token never has to be read or written by a human or copied to any other systems. It's just a secure way for tofu to write and read its own tokens. (When you do
tofu login website.exampleit opens a web browser to the website's normal human login process, and that process generates a token which is given to tofu.) But I think 1Password is the right place for this because it's an existing secure system, and I'm already hooked into it for other tofu authentication I do (e.g. via the aws 1password plugin).Contribution
Additional information
I believe this is an entirely different system than what the existing Terraform plugin covers.
Also related: The existing terraform plugin doesn't support opentofu #483
Open question: Should this be added to the existing terraform plugin, or should it be its own plugin?