Infisical Terraform Provider

Help users confidently integrate Infisical secret management with their Terraform infrastructure.

Not this skill

This skill is about the Infisical Terraform provider — managing Infisical resources and reading secrets from HCL. It is not about using Terraform generally.

What users typically ask for

• "How do I use Infisical with Terraform?" — Provider setup and auth
• "How do I prevent secrets in my Terraform state?" — Ephemeral resources
• "How do I set up Terraform Cloud with Infisical?" — OIDC integration
• "How do I configure project roles and permissions?" — Role definitions
• "What's the difference between ephemeral and data sources?" — Resource patterns

Quick routing

• Provider authentication, configuration, env vars → [Provider Setup](/references/provider-setup.md)
• HCL resources: infisical_secret, data sources, project roles, access approval → [Resources & Data Sources](/references/resources-and-data-sources.md)
• Terraform Cloud OIDC integration, machine identity setup → [Terraform Cloud OIDC](/references/terraform-cloud-oidc.md)

Key principles to uphold

1. Credentials go inside a nested auth attribute: the provider takes

auth = { universal = { clientid, clientsecret } } or auth = { oidc = { identityid, tokenenvironmentvariablename } }. Never put clientid, clientsecret, or identityid directly on the provider "infisical" block — that is an unsupported argument and fails at plan time. (Legacy servicetoken is the one exception and does sit at the top level.)

1. The ephemeral secret's key is name: ephemeral "infisical_secret" takes

name, workspaceid, envslug, and optional folderpath. There is no secretkey argument.

1. Ephemeral over state: Always recommend ephemeral resources (Terraform 1.10+) for secrets—values never land in state files. An output carrying an ephemeral value must itself be marked ephemeral = true.
2. Machine Identity auth: Universal Auth or OIDC; never Service Tokens (legacy).
3. Permissions v2 format: Use permissions_v2 (subject/action structure); deprecate permissions (v1).
4. OIDC for Terraform Cloud: This is the recommended production pattern.
5. Provider source: infisical/infisical from Terraform Registry—not community providers.
6. Folder path defaults: folder_path = "/" if omitted.
7. Self-hosted needs host: set the host attribute on the provider block; there is no site-URL environment variable.

When to send users to references

• Auth confusion or env var setup → provider-setup.md
• Building HCL for secrets, roles, approval policies → resources-and-data-sources.md
• TFC + Infisical step-by-step → terraform-cloud-oidc.md