While setting up a Terraform Stack in HCP Terraform, I needed to integrate an Auth0 provider in a secure and modular way. My goal was to configure the Auth0 provider using a client ID, client secret, and domain — all managed through a Variable Set. This approach would let me reuse the configuration across environments without hardcoding sensitive values in code. This article outlines how I got that working, including a key lesson about handling ephemeral variables in HCP Terraform.

Defining the Variable Set in deployments.tfdeploy.hcl

I began by creating a varset block in my deployments.tfdeploy.hcl file, referencing a previously created Variable Set in HCP Terraform. This Variable Set contains the auth0_client_id, auth0_client_secret, and auth0_domain.

store "varset" "auth0-dev" {
  name     = "auth0-dev"
  category = "terraform"
}

Declaring Terraform Variables

Next, I defined the corresponding Terraform variables in my configuration. Initially, I didn’t mark them as ephemeral.

variable "auth0_domain" {
  type        = string
  description = "Auth0 domain"
}

variable "auth0_client_id" {
  type        = string
  description = "Auth0 client ID"
  # could be sensitive too, but usually not necessary
}

variable "auth0_client_secret" {
  type        = string
  description = "Auth0 client secret"
  sensitive   = true
  ephemeral   = true
}

At this point, only auth0_client_secret was marked as ephemeral, assuming that sensitivity was the only concern. I later learned that was incomplete.

Wiring Up the Variable Set Inputs

In the deployment "dev" block, I connected the values from the Variable Set to my Terraform variables:

deployment "dev" {
  inputs = {

    auth0_client_id     = store.varset.auth0-dev.client_id
    auth0_client_secret = store.varset.auth0-dev.client_secret
    auth0_domain        = store.varset.auth0-dev.domain

  }
}

Configuring the Auth0 Provider

I passed these variables into the Auth0 provider configuration block:

provider "auth0" "this" {
  config {
    domain        = var.auth0_domain
    client_id     = var.auth0_client_id
    client_secret = var.auth0_client_secret
  }
}

Creating the Authentication Component

Then, I created a Terraform component for authentication logic. I specified the Auth0 provider and passed in environment-specific inputs:

component "authentication" {
  source = "./src/terraform/authentication"

  inputs = {
    application_name = var.application_name
    environment_name = var.environment_name
  }

  providers = {
    auth0 = provider.auth0.this
  }
}

The Error and Its Root Cause

Upon running the deployment, I encountered an error that clarified an important rule in HCP Terraform: Any stack input variable that receives a value from store.varset... must be declared ephemeral = true, because store.varset outputs are ephemeral. If you pass the same value further into a component input, that component input variable must also be declared ephemeral = true.

So while the provider could handle ephemeral variables without issue, my non-ephemeral variables in the stack caused the deployment to fail.

The Fix: Marking Variables as Ephemeral

The solution was simple once I understood the cause. I updated all Terraform variables receiving values from the Variable Set to be marked as ephemeral = true:

variable "auth0_domain" {
  type        = string
  description = "Auth0 domain"
  ephemeral   = true
}

variable "auth0_client_id" {
  type        = string
  description = "Auth0 client ID"
  ephemeral   = true
}

variable "auth0_client_secret" {
  type        = string
  description = "Auth0 client secret"
  sensitive   = true
  ephemeral   = true
}

With this change, the configuration worked as expected.

Conclusion

When integrating secrets from a Variable Set in HCP Terraform, it’s crucial to understand the concept of ephemeral values. Any variable that receives a value from store.varset must be declared ephemeral, and any component that consumes such a variable must do the same. This ensures secure and compliant handling of secrets across your stack. This was a subtle but important lesson in how HCP Terraform treats data from Variable Sets — and how to properly pass that data through your infrastructure code without running into unexpected errors.