Create a credentials variable set

HCP Terraform lets you define input and environment variables using either workspace-specific variables, or sets of variables that you can reuse in multiple workspaces. Variable sets allow you to avoid redefining the same variables across workspaces, so you can standardize common configurations throughout your organization. One common use case for variable sets is for provider credentials. By defining a variable set for your credentials, you can easily reuse the same variables across multiple workspaces and efficiently and securely rotate your credentials.

In this tutorial, you will create a variable set for your AWS credentials.

Prerequisites

This tutorial requires:

• an HCP Terraform account and organization
• an AWS account

Create a variable set

You can define both input variables and environment variables in variable sets. Input variables define the values for variables you reference in your configuration, while environment variables typically store provider credentials or modify Terraform's behavior, such as logging verbosity.

To create a variable set, navigate to your organization's Settings, then to Variable sets.

Next, click Create variable set.

Name the variable set "AWS Credentials".

You can apply a variable set to all workspaces in your organization, or scope it to specific workspaces or projects. When using variable sets with credentials, reuse the variable set with care and avoid the global scope, since it does not follow least privilege best practices.

If you created an organization just for HashiCorp tutorials, select Apply globally as the variable set scope.

Next, define your AWS credentials as environment variables. Use an existing Access key ID and Secret access key or create a new pair in the IAM console.

Click +Add Variable. Select the Environment variable option. Set the key to AWS_ACCESS_KEY_ID and the value to your AWS Access Key ID. Mark it as Sensitive and click Add variable.

Marking a variable as sensitive prevents Terraform from displaying it in the HCP Terraform UI and makes the variable write-only.

Now, click + Add Variable again. Define another environment variable named AWS_SECRET_ACCESS_KEY and set it to your AWS Secret access key. Mark it as Sensitive and click Add variable.

Now click Create variable set.

HCP Terraform now lists your new variable set on the Variable Sets page. It also shows the number of variables it contains and indicates that the set applies to all workspaces, since you selected the global scope.

Next Steps

In this tutorial, you created a global variable set. To learn more about variable sets, review the variable sets documentation.

Next, you will create and configure an HCP Terraform workspace.