terraform Use OpenID Connect and Vault to get short term credentials for the Azure Terraform providers in page title Vault Backed Dynamic Credentials with the Azure Providers HCP Terraform your HCP Terraform runs Vault Backed Dynamic Credentials with the Azure Provider Important If you are self hosting HCP Terraform agents terraform cloud docs agents ensure your agents use v1 8 0 terraform cloud docs agents changelog 1 8 0 04 18 2023 or above To use the latest dynamic credentials features upgrade your agents to the latest version terraform cloud docs agents changelog

Answer:
---
page_title: Vault-Backed Dynamic Credentials with the Azure Providers - HCP Terraform
description: >-
  Use OpenID Connect and Vault to get short-term credentials for the Azure Terraform providers in
  your HCP Terraform runs.
---

# Vault-Backed Dynamic Credentials with the Azure Provider

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.8.0](/terraform/cloud-docs/agents/changelog#1-8-0-04-18-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can use HCP Terraform’s native OpenID Connect integration with Vault to use [Vault-backed dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/vault-backed) with the Azure provider in your HCP Terraform runs. Configuring the integration requires the following steps:

1. **[Configure Vault Dynamic Provider Credentials](#configure-vault-dynamic-provider-credentials)**: Set up a trust configuration between Vault and HCP Terraform, create Vault roles and policies for your HCP Terraform workspaces, and add environment variables to those workspaces.
2. **[Configure the Vault Azure Secrets Engine](#configure-vault-azure-secrets-engine)**: Set up the Azure secrets engine in your Vault instance.
3. **[Configure HCP Terraform](#configure-hcp-terraform)**: Add additional environment variables to the HCP Terraform workspaces where you want to use Vault-Backed Dynamic Credentials.
4. **[Configure Terraform Providers](#configure-terraform-providers)**: Configure your Terraform providers to work with Vault-backed Dynamic Credentials.

Once you complete this setup, HCP Terraform automatically authenticates with Azure via Vault-generated credentials during the plan and apply phase of each run. The Azure provider's authentication is only valid for the length of the plan or apply phase.

## Configure Vault Dynamic Provider Credentials
You must first set up Vault dynamic provider credentials before you can use Vault-backed dynamic credentials. This includes setting up the JWT auth backend in Vault, configuring trust between HCP Terraform and Vault, and populating the required environment variables in your HCP Terraform workspace.

[See the setup instructions for Vault dynamic provider credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/vault-configuration).

# Configure Vault Azure Secrets Engine
Follow the instructions in the Vault documentation for [setting up the Azure secrets engine in your Vault instance](/vault/docs/secrets/azure). You can also do this configuration through Terraform. Refer to our [example Terraform configuration](https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/vault-backed/azure).

## Configure HCP Terraform
Next, you need to set certain environment variables in your HCP Terraform workspace to authenticate HCP Terraform with Azure using Vault-backed dynamic credentials. These variables are in addition to those you previously set while configuring [Vault dynamic provider credentials](#configure-vault-dynamic-provider-credentials). You can add these as workspace variables or as a [variable set](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets). When you configure dynamic provider credentials with multiple provider configurations of the same type, use either a default variable or a tagged alias variable name for each provider configuration. Refer to [Specifying Multiple Configurations](#specifying-multiple-configurations) for more details.

### Required Environment Variables
| Variable                                                                                | Value                     | Notes                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_AZURE_AUTH`
`TFC_VAULT_BACKED_AZURE_AUTH[_TAG]`
_(Default variable not supported)_                                  | `true`                    | Requires **v1.8.0** or later if self-managing agents. Must be present and set to `true`, or HCP Terraform will not attempt to authenticate with Azure.                                                                                |
| `TFC_VAULT_BACKED_AZURE_RUN_VAULT_ROLE`
`TFC_VAULT_BACKED_AZURE_RUN_VAULT_ROLE[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_RUN_VAULT_ROLE` | The role to use in Vault. | Requires **v1.8.0** or later if self-managing agents. Optional if `TFC_VAULT_BACKED_AZURE_PLAN_VAULT_ROLE` and `TFC_VAULT_BACKED_AZURE_APPLY_VAULT_ROLE` are both provided. These variables are described [below](#optional-environment-variables). |

### Optional Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_AZURE_MOUNT_PATH`
`TFC_VAULT_BACKED_AZURE_MOUNT_PATH[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_MOUNT_PATH`                   | The mount path of the Azure secrets engine in Vault.                                                                                | Requires **v1.8.0** or later if self-managing agents. Defaults to `azure`.                                                                    |
| `TFC_VAULT_BACKED_AZURE_PLAN_VAULT_ROLE`
`TFC_VAULT_BACKED_AZURE_PLAN_VAULT_ROLE[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_PLAN_VAULT_ROLE`    | The Vault role to use the plan phase of a run.                                                                                | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_AZURE_RUN_VAULT_ROLE` if not provided. |
| `TFC_VAULT_BACKED_AZURE_APPLY_VAULT_ROLE`
`TFC_VAULT_BACKED_AZURE_APPLY_VAULT_ROLE[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_APPLY_VAULT_ROLE` | The Vault role to use for the apply phase of a run.                                                                                | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_AZURE_RUN_VAULT_ROLE` if not provided. |
| `TFC_VAULT_BACKED_AZURE_SLEEP_SECONDS`
`TFC_VAULT_BACKED_AZURE_SLEEP_SECONDS[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_SLEEP_SECONDS`          | The amount of time to wait, in seconds, after obtaining temporary credentials from Vault. e.g., `30` for 30 seconds. Must be 1500 seconds (25 minutes) or less.                                         | Requires **v1.12.0** or later if self-managing agents. Can be used to mitigate eventual consistency issues in Azure.                          |
| `TFC_VAULT_BACKED_AZURE_VAULT_CONFIG`
`TFC_VAULT_BACKED_AZURE_VAULT_CONFIG[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_AZURE_VAULT_CONFIG`             | The name of the non-default Vault configuration for workspaces using [multiple Vault configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations). | Requires **v1.12.0** or later if self-managing agents. Will fall back to using the default Vault configuration if not provided.               |

## Configure Terraform Providers
The final step is to directly configure your Azure and Vault providers.

### Configure the AzureRM or Microsoft Entra ID
Ensure you pass a value for the `subscription_id` and `tenant_id` arguments in your provider configuration block or set the `ARM_SUBSCRIPTION_ID` and `ARM_TENANT_ID` variables in your workspace.

Do not set values for `client_id`, `use_oidc`, or `oidc_token` in your provider configuration block. Additionally, do not set variable values for `ARM_CLIENT_ID`, `ARM_USE_OIDC`, or `ARM_OIDC_TOKEN`.

### Configure the Vault Provider
If you were previously using the Vault provider to authenticate the Azure provider, remove any existing usage of the Azure secrets engine from your Terraform Code.
This includes the [`vault_azure_access_credentials`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/azure_access_credentials) data source and any instances of [`vault_generic_secret`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/generic_secret) you previously used to generate Azure credentials.

### Specifying Multiple Configurations

~> **Important:** Ensure you are using version **3.60.0** or later of the **AzureRM provider** and version **2.43.0** or later of the **Microsoft Entra ID provider** (previously Azure Active Directory) as required functionality was introduced in these provider versions.

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.12.0](/terraform/cloud-docs/agents/changelog#1-12-0-07-26-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can add additional variables to handle multiple distinct Vault-backed Azure setups, enabling you to use multiple [provider aliases](/terraform/language/providers/configuration#alias-multiple-provider-configurations) within the same workspace. You can configure each set of credentials independently, or use default values by configuring the variables prefixed with `TFC_DEFAULT_`.

For more details, see [Specifying Multiple Configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations).

#### Required Terraform Variable

To use additional configurations, add the following code to your Terraform configuration. This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks.

```hcl
variable "tfc_vault_backed_azure_dynamic_credentials" {
  description = "Object containing Vault-backed Azure dynamic credentials configuration"
  type = object({
    default = object({
      client_id_file_path = string
      client_secret_file_path = string
    })
    aliases = map(object({
      client_id_file_path = string
      client_secret_file_path = string
    }))
  })
}
```

#### Example Usage

##### AzureRM Provider

```hcl
provider "azurerm" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli                 = false
  client_id_file_path     = var.tfc_vault_backed_azure_dynamic_credentials.default.client_id_file_path
  client_secret_file_path = var.tfc_vault_backed_azure_dynamic_credentials.default.client_secret_file_path
  subscription_id         = "00000000-0000-0000-0000-000000000000"
  tenant_id               = "10000000-0000-0000-0000-000000000000"
}

provider "azurerm" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli                 = false
  alias                   = "ALIAS1"
  client_id_file_path     = var.tfc_vault_backed_azure_dynamic_credentials.aliases["ALIAS1"].client_id_file_path
  client_secret_file_path = var.tfc_vault_backed_azure_dynamic_credentials.aliases["ALIAS1"].client_secret_file_path
  subscription_id         = "00000000-0000-0000-0000-000000000000"
  tenant_id               = "20000000-0000-0000-0000-000000000000"
}
```

##### Microsoft Entra ID Provider (previously AzureAD)

```hcl
provider "azuread" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli                 = false
  client_id_file_path     = var.tfc_vault_backed_azure_dynamic_credentials.default.client_id_file_path
  client_secret_file_path = var.tfc_vault_backed_azure_dynamic_credentials.default.client_secret_file_path
  subscription_id         = "00000000-0000-0000-0000-000000000000"
  tenant_id               = "10000000-0000-0000-0000-000000000000"
}

provider "azuread" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli                 = false
  alias                   = "ALIAS1"
  client_id_file_path     = var.tfc_vault_backed_azure_dynamic_credentials.aliases["ALIAS1"].client_id_file_path
  client_secret_file_path = var.tfc_vault_backed_azure_dynamic_credentials.aliases["ALIAS1"].client_secret_file_path
  subscription_id         = "00000000-0000-0000-0000-000000000000"
  tenant_id               = "20000000-0000-0000-0000-000000000000"
}
```

page title  Vault Backed Dynamic Credentials with the Azure Providers   HCP Terraform description       Use OpenID Connect and Vault to get short term credentials for the Azure Terraform providers in   your HCP Terraform runs         Vault Backed Dynamic Credentials with the Azure Provider       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 8 0   terraform cloud docs agents changelog 1 8 0 04 18 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can use HCP Terraform s native OpenID Connect integration with Vault to use  Vault backed dynamic credentials   terraform cloud docs workspaces dynamic provider credentials vault backed  with the Azure provider in your HCP Terraform runs  Configuring the integration requires the following steps   1     Configure Vault Dynamic Provider Credentials   configure vault dynamic provider credentials     Set up a trust configuration between Vault and HCP Terraform  create Vault roles and policies for your HCP Terraform workspaces  and add environment variables to those workspaces  2     Configure the Vault Azure Secrets Engine   configure vault azure secrets engine     Set up the Azure secrets engine in your Vault instance  3     Configure HCP Terraform   configure hcp terraform     Add additional environment variables to the HCP Terraform workspaces where you want to use Vault Backed Dynamic Credentials  4     Configure Terraform Providers   configure terraform providers     Configure your Terraform providers to work with Vault backed Dynamic Credentials   Once you complete this setup  HCP Terraform automatically authenticates with Azure via Vault generated credentials during the plan and apply phase of each run  The Azure provider s authentication is only valid for the length of the plan or apply phase      Configure Vault Dynamic Provider Credentials You must first set up Vault dynamic provider credentials before you can use Vault backed dynamic credentials  This includes setting up the JWT auth backend in Vault  configuring trust between HCP Terraform and Vault  and populating the required environment variables in your HCP Terraform workspace    See the setup instructions for Vault dynamic provider credentials   terraform cloud docs workspaces dynamic provider credentials vault configuration      Configure Vault Azure Secrets Engine Follow the instructions in the Vault documentation for  setting up the Azure secrets engine in your Vault instance   vault docs secrets azure   You can also do this configuration through Terraform  Refer to our  example Terraform configuration  https   github com hashicorp terraform dynamic credentials setup examples tree main vault backed azure       Configure HCP Terraform Next  you need to set certain environment variables in your HCP Terraform workspace to authenticate HCP Terraform with Azure using Vault backed dynamic credentials  These variables are in addition to those you previously set while configuring  Vault dynamic provider credentials   configure vault dynamic provider credentials   You can add these as workspace variables or as a  variable set   terraform cloud docs workspaces variables managing variables variable sets   When you configure dynamic provider credentials with multiple provider configurations of the same type  use either a default variable or a tagged alias variable name for each provider configuration  Refer to  Specifying Multiple Configurations   specifying multiple configurations  for more details       Required Environment Variables   Variable                                                                                Value                       Notes                                                                                TFC VAULT BACKED AZURE AUTH  br    TFC VAULT BACKED AZURE AUTH  TAG   br     Default variable not supported                                       true                       Requires   v1 8 0   or later if self managing agents  Must be present and set to  true   or HCP Terraform will not attempt to authenticate with Azure                                                                                TFC VAULT BACKED AZURE RUN VAULT ROLE  br    TFC VAULT BACKED AZURE RUN VAULT ROLE  TAG   br    TFC DEFAULT VAULT BACKED AZURE RUN VAULT ROLE    The role to use in Vault    Requires   v1 8 0   or later if self managing agents  Optional if  TFC VAULT BACKED AZURE PLAN VAULT ROLE  and  TFC VAULT BACKED AZURE APPLY VAULT ROLE  are both provided  These variables are described  below   optional environment variables          Optional Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                                                Notes                                                                                TFC VAULT BACKED AZURE MOUNT PATH  br    TFC VAULT BACKED AZURE MOUNT PATH  TAG   br    TFC DEFAULT VAULT BACKED AZURE MOUNT PATH                      The mount path of the Azure secrets engine in Vault                                                                                Requires   v1 8 0   or later if self managing agents  Defaults to  azure                                                                           TFC VAULT BACKED AZURE PLAN VAULT ROLE  br    TFC VAULT BACKED AZURE PLAN VAULT ROLE  TAG   br    TFC DEFAULT VAULT BACKED AZURE PLAN VAULT ROLE       The Vault role to use the plan phase of a run                                                                                Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED AZURE RUN VAULT ROLE  if not provided       TFC VAULT BACKED AZURE APPLY VAULT ROLE  br    TFC VAULT BACKED AZURE APPLY VAULT ROLE  TAG   br    TFC DEFAULT VAULT BACKED AZURE APPLY VAULT ROLE    The Vault role to use for the apply phase of a run                                                                                Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED AZURE RUN VAULT ROLE  if not provided       TFC VAULT BACKED AZURE SLEEP SECONDS  br    TFC VAULT BACKED AZURE SLEEP SECONDS  TAG   br    TFC DEFAULT VAULT BACKED AZURE SLEEP SECONDS             The amount of time to wait  in seconds  after obtaining temporary credentials from Vault  e g    30  for 30 seconds  Must be 1500 seconds  25 minutes  or less                                            Requires   v1 12 0   or later if self managing agents  Can be used to mitigate eventual consistency issues in Azure                                TFC VAULT BACKED AZURE VAULT CONFIG  br    TFC VAULT BACKED AZURE VAULT CONFIG  TAG   br    TFC DEFAULT VAULT BACKED AZURE VAULT CONFIG                The name of the non default Vault configuration for workspaces using  multiple Vault configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations     Requires   v1 12 0   or later if self managing agents  Will fall back to using the default Vault configuration if not provided                      Configure Terraform Providers The final step is to directly configure your Azure and Vault providers       Configure the AzureRM or Microsoft Entra ID Ensure you pass a value for the  subscription id  and  tenant id  arguments in your provider configuration block or set the  ARM SUBSCRIPTION ID  and  ARM TENANT ID  variables in your workspace   Do not set values for  client id    use oidc   or  oidc token  in your provider configuration block  Additionally  do not set variable values for  ARM CLIENT ID    ARM USE OIDC   or  ARM OIDC TOKEN        Configure the Vault Provider If you were previously using the Vault provider to authenticate the Azure provider  remove any existing usage of the Azure secrets engine from your Terraform Code  This includes the   vault azure access credentials   https   registry terraform io providers hashicorp vault latest docs data sources azure access credentials  data source and any instances of   vault generic secret   https   registry terraform io providers hashicorp vault latest docs data sources generic secret  you previously used to generate Azure credentials       Specifying Multiple Configurations       Important    Ensure you are using version   3 60 0   or later of the   AzureRM provider   and version   2 43 0   or later of the   Microsoft Entra ID provider    previously Azure Active Directory  as required functionality was introduced in these provider versions        Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 12 0   terraform cloud docs agents changelog 1 12 0 07 26 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can add additional variables to handle multiple distinct Vault backed Azure setups  enabling you to use multiple  provider aliases   terraform language providers configuration alias multiple provider configurations  within the same workspace  You can configure each set of credentials independently  or use default values by configuring the variables prefixed with  TFC DEFAULT     For more details  see  Specifying Multiple Configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations         Required Terraform Variable  To use additional configurations  add the following code to your Terraform configuration  This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks      hcl variable  tfc vault backed azure dynamic credentials      description    Object containing Vault backed Azure dynamic credentials configuration    type   object       default   object         client id file path   string       client secret file path   string            aliases   map object         client id file path   string       client secret file path   string                          Example Usage        AzureRM Provider     hcl provider  azurerm      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                   false   client id file path       var tfc vault backed azure dynamic credentials default client id file path   client secret file path   var tfc vault backed azure dynamic credentials default client secret file path   subscription id            00000000 0000 0000 0000 000000000000    tenant id                  10000000 0000 0000 0000 000000000000     provider  azurerm      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                   false   alias                      ALIAS1    client id file path       var tfc vault backed azure dynamic credentials aliases  ALIAS1   client id file path   client secret file path   var tfc vault backed azure dynamic credentials aliases  ALIAS1   client secret file path   subscription id            00000000 0000 0000 0000 000000000000    tenant id                  20000000 0000 0000 0000 000000000000               Microsoft Entra ID Provider  previously AzureAD      hcl provider  azuread      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                   false   client id file path       var tfc vault backed azure dynamic credentials default client id file path   client secret file path   var tfc vault backed azure dynamic credentials default client secret file path   subscription id            00000000 0000 0000 0000 000000000000    tenant id                  10000000 0000 0000 0000 000000000000     provider  azuread      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                   false   alias                      ALIAS1    client id file path       var tfc vault backed azure dynamic credentials aliases  ALIAS1   client id file path   client secret file path   var tfc vault backed azure dynamic credentials aliases  ALIAS1   client secret file path   subscription id            00000000 0000 0000 0000 000000000000    tenant id                  20000000 0000 0000 0000 000000000000


terraform your HCP Terraform runs Use OpenID Connect and Vault to get short term credentials for the GCP Terraform provider in Vault Backed Dynamic Credentials with the GCP Provider page title Vault Backed Dynamic Credentials with the GCP Provider Workspaces HCP Terraform Important If you are self hosting HCP Terraform agents terraform cloud docs agents ensure your agents use v1 8 0 terraform cloud docs agents changelog 1 8 0 04 18 2023 or above To use the latest dynamic credentials features upgrade your agents to the latest version terraform cloud docs agents changelog

Answer:
---
page_title: Vault-Backed Dynamic Credentials with the GCP Provider - Workspaces - HCP Terraform
description: >-
  Use OpenID Connect and Vault to get short-term credentials for the GCP Terraform provider in
  your HCP Terraform runs.
---

# Vault-Backed Dynamic Credentials with the GCP Provider

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.8.0](/terraform/cloud-docs/agents/changelog#1-8-0-04-18-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can use HCP Terraform’s native OpenID Connect integration with Vault to use [Vault-backed dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/vault-backed) with the GCP provider in your HCP Terraform runs. Configuring the integration requires the following steps:

1. **[Configure Vault Dynamic Provider Credentials](#configure-vault-dynamic-provider-credentials)**: Set up a trust configuration between Vault and HCP Terraform, create Vault roles and policies for your HCP Terraform workspaces, and add environment variables to those workspaces.
2. **[Configure the Vault GCP Secrets Engine](#configure-vault-gcp-secrets-engine)**: Set up the GCP secrets engine in your Vault instance.
3. **[Configure HCP Terraform](#configure-hcp-terraform)**: Add additional environment variables to the HCP Terraform workspaces where you want to use Vault-Backed Dynamic Credentials.
4. **[Configure Terraform Providers](#configure-terraform-providers)**: Configure your Terraform providers to work with Vault-backed dynamic credentials.

Once you complete this setup, HCP Terraform automatically authenticates with GCP via Vault-generated credentials during the plan and apply phase of each run. The GCP provider's authentication is only valid for the length of the plan or apply phase.

## Configure Vault Dynamic Provider Credentials
You must first set up Vault dynamic provider credentials before you can use Vault-backed dynamic credentials. This includes setting up the JWT auth backend in Vault, configuring trust between HCP Terraform and Vault, and populating the required environment variables in your HCP Terraform workspace.

[See the setup instructions for Vault dynamic provider credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/vault-configuration).

# Configure Vault GCP Secrets Engine
Follow the instructions in the Vault documentation for [setting up the GCP secrets engine in your Vault instance](/vault/docs/secrets/gcp). You can also do this configuration through Terraform. Refer to our [example Terraform configuration](https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/vault-backed/gcp).

~> **Important**: carefully consider the limitations and differences between each supported credential type in the GCP secrets engine. These limitations carry over to HCP Terraform’s usage of these credentials for authenticating the GCP provider.

## Configure HCP Terraform
Next, you need to set certain environment variables in your HCP Terraform workspace to authenticate HCP Terraform with GCP using Vault-backed dynamic credentials. These variables are in addition to those you previously set while configuring [Vault dynamic provider credentials](#configure-vault-dynamic-provider-credentials). You can add these as workspace variables or as a [variable set](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets). When you configure dynamic provider credentials with multiple provider configurations of the same type, use either a default variable or a tagged alias variable name for each provider configuration. Refer to [Specifying Multiple Configurations](#specifying-multiple-configurations) for more details.

### Common Environment Variables
The below variables apply to all GCP auth types.

#### Required Common Environment Variables
| Variable                                                                                | Value                                                                                | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_AUTH`
`TFC_VAULT_BACKED_GCP_AUTH[_TAG]`
_(Default variable not supported)_                 | `true`                                                                                | Requires **v1.8.0** or later if self-managing agents. Must be present and set to `true`, or HCP Terraform will not attempt to authenticate with GCP. |
| `TFC_VAULT_BACKED_GCP_AUTH_TYPE`
`TFC_VAULT_BACKED_GCP_AUTH_TYPE[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_AUTH_TYPE` | Specifies the type of authentication to perform with GCP. Must be one of the following: `roleset/access_token`, `roleset/service_account_key`, `static_account/access_token`, or `static_account/service_account_key`. | Requires **v1.8.0** or later if self-managing agents.                                                                                |

#### Optional Common Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_MOUNT_PATH`
`TFC_VAULT_BACKED_GCP_MOUNT_PATH[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_MOUNT_PATH`       | The mount path of the GCP secrets engine in Vault.                                                                                | Requires **v1.8.0** or later if self-managing agents. Defaults to `gcp`.                                                        |
| `TFC_VAULT_BACKED_GCP_VAULT_CONFIG`
`TFC_VAULT_BACKED_GCP_VAULT_CONFIG[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_VAULT_CONFIG` | The name of the non-default Vault configuration for workspaces using [multiple Vault configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations). | Requires **v1.12.0** or later if self-managing agents. Will fall back to using the default Vault configuration if not provided. |

### Roleset Specific Environment Variables
These environment variables are only valid if the `TFC_VAULT_BACKED_GCP_AUTH_TYPE` is `roleset/access_token` or `roleset/service_account_key`.

#### Required Roleset Specific Environment Variables
| Variable                                                                                | Value                        | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_RUN_VAULT_ROLESET`
`TFC_VAULT_BACKED_GCP_RUN_VAULT_ROLESET[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_RUN_VAULT_ROLESET` | The roleset to use in Vault. | Requires **v1.8.0** or later if self-managing agents. Optional if `TFC_VAULT_BACKED_GCP_PLAN_VAULT_ROLESET` and `TFC_VAULT_BACKED_GCP_APPLY_VAULT_ROLESET` are both provided. These variables are described [below](#optional-roleset-specific-environment-variables). |

#### Optional Roleset Specific Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                            | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_PLAN_VAULT_ROLESET`
`TFC_VAULT_BACKED_GCP_PLAN_VAULT_ROLESET[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_PLAN_VAULT_ROLESET`    | The roleset to use for the plan phase of a run.  | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_GCP_RUN_VAULT_ROLESET` if not provided. |
| `TFC_VAULT_BACKED_GCP_APPLY_VAULT_ROLESET`
`TFC_VAULT_BACKED_GCP_APPLY_VAULT_ROLESET[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_APPLY_VAULT_ROLESET` | The roleset to use for the apply phase of a run. | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_GCP_RUN_VAULT_ROLESET` if not provided. |

### Static Account Specific Environment Variables
These environment variables are only valid if the `TFC_VAULT_BACKED_GCP_AUTH_TYPE` is `static_account/access_token` or `static_account/service_account_key`.

#### Required Static Account Specific Environment Variables
| Variable                                                                                | Value                               | Notes                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_RUN_VAULT_STATIC_ACCOUNT`
`TFC_VAULT_BACKED_GCP_RUN_VAULT_STATIC_ACCOUNT[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_RUN_VAULT_STATIC_ACCOUNT` | The static account to use in Vault. | Requires **v1.8.0** or later if self-managing agents. Optional if `TFC_VAULT_BACKED_GCP_PLAN_VAULT_STATIC_ACCOUNT` and `TFC_VAULT_BACKED_GCP_APPLY_VAULT_STATIC_ACCOUNT` are both provided. These variables are described [below](#optional-static-account-specific-environment-variables). |

#### Optional Static Account Specific Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                   | Notes                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_VAULT_BACKED_GCP_PLAN_VAULT_STATIC_ACCOUNT`
`TFC_VAULT_BACKED_GCP_PLAN_VAULT_STATIC_ACCOUNT[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_PLAN_VAULT_STATIC_ACCOUNT`    | The static account to use for the plan phase of a run.  | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_GCP_RUN_VAULT_STATIC_ACCOUNT` if not provided. |
| `TFC_VAULT_BACKED_GCP_APPLY_VAULT_STATIC_ACCOUNT`
`TFC_VAULT_BACKED_GCP_APPLY_VAULT_STATIC_ACCOUNT[_TAG]`
`TFC_DEFAULT_VAULT_BACKED_GCP_APPLY_VAULT_STATIC_ACCOUNT` | The static account to use for the apply phase of a run. | Requires **v1.8.0** or later if self-managing agents. Will fall back to the value of `TFC_VAULT_BACKED_GCP_RUN_VAULT_STATIC_ACCOUNT` if not provided. |

## Configure Terraform Providers
The final step is to directly configure your GCP and Vault providers.

### Configure the GCP Provider
Ensure you pass values for the `project` and `region` arguments into the provider configuration block.

Ensure you are not setting values or environment variables for `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS`. Otherwise, these values may interfere with dynamic provider credentials.

### Configure the Vault Provider
If you were previously using the Vault provider to authenticate the GCP provider, remove any existing usage of the GCP secrets engine from your Terraform Code.
This includes instances of [`vault_generic_secret`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/generic_secret) that you previously used to generate GCP credentials.

### Specifying Multiple Configurations

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.12.0](/terraform/cloud-docs/agents/changelog#1-12-0-07-26-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can add additional variables to handle multiple distinct Vault-backed GCP setups, enabling you to use multiple [provider aliases](/terraform/language/providers/configuration#alias-multiple-provider-configurations) within the same workspace. You can configure each set of credentials independently, or use default values by configuring the variables prefixed with `TFC_DEFAULT_`.

For more details, see [Specifying Multiple Configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations).

#### Required Terraform Variable

To use additional configurations, add the following code to your Terraform configuration. This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks.

```hcl
variable "tfc_vault_backed_gcp_dynamic_credentials" {
  description = "Object containing Vault-backed GCP dynamic credentials configuration"
  type = object({
    default = object({
      credentials = string
      access_token = string
    })
    aliases = map(object({
      credentials = string
      access_token = string
    }))
  })
}
```

#### Example Usage

##### Access Token

```hcl
provider "google" {
  access_token = var.tfc_vault_backed_gcp_dynamic_credentials.default.access_token
}

provider "google" {
  alias = "ALIAS1"
  access_token = var.tfc_vault_backed_gcp_dynamic_credentials.aliases["ALIAS1"].access_token
}
```

##### Credentials

```hcl
provider "google" {
  credentials = var.tfc_vault_backed_gcp_dynamic_credentials.default.credentials
}

provider "google" {
  alias = "ALIAS1"
  credentials = var.tfc_vault_backed_gcp_dynamic_credentials.aliases["ALIAS1"].credentials
}
```

page title  Vault Backed Dynamic Credentials with the GCP Provider   Workspaces   HCP Terraform description       Use OpenID Connect and Vault to get short term credentials for the GCP Terraform provider in   your HCP Terraform runs         Vault Backed Dynamic Credentials with the GCP Provider       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 8 0   terraform cloud docs agents changelog 1 8 0 04 18 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can use HCP Terraform s native OpenID Connect integration with Vault to use  Vault backed dynamic credentials   terraform cloud docs workspaces dynamic provider credentials vault backed  with the GCP provider in your HCP Terraform runs  Configuring the integration requires the following steps   1     Configure Vault Dynamic Provider Credentials   configure vault dynamic provider credentials     Set up a trust configuration between Vault and HCP Terraform  create Vault roles and policies for your HCP Terraform workspaces  and add environment variables to those workspaces  2     Configure the Vault GCP Secrets Engine   configure vault gcp secrets engine     Set up the GCP secrets engine in your Vault instance  3     Configure HCP Terraform   configure hcp terraform     Add additional environment variables to the HCP Terraform workspaces where you want to use Vault Backed Dynamic Credentials  4     Configure Terraform Providers   configure terraform providers     Configure your Terraform providers to work with Vault backed dynamic credentials   Once you complete this setup  HCP Terraform automatically authenticates with GCP via Vault generated credentials during the plan and apply phase of each run  The GCP provider s authentication is only valid for the length of the plan or apply phase      Configure Vault Dynamic Provider Credentials You must first set up Vault dynamic provider credentials before you can use Vault backed dynamic credentials  This includes setting up the JWT auth backend in Vault  configuring trust between HCP Terraform and Vault  and populating the required environment variables in your HCP Terraform workspace    See the setup instructions for Vault dynamic provider credentials   terraform cloud docs workspaces dynamic provider credentials vault configuration      Configure Vault GCP Secrets Engine Follow the instructions in the Vault documentation for  setting up the GCP secrets engine in your Vault instance   vault docs secrets gcp   You can also do this configuration through Terraform  Refer to our  example Terraform configuration  https   github com hashicorp terraform dynamic credentials setup examples tree main vault backed gcp         Important    carefully consider the limitations and differences between each supported credential type in the GCP secrets engine  These limitations carry over to HCP Terraform s usage of these credentials for authenticating the GCP provider      Configure HCP Terraform Next  you need to set certain environment variables in your HCP Terraform workspace to authenticate HCP Terraform with GCP using Vault backed dynamic credentials  These variables are in addition to those you previously set while configuring  Vault dynamic provider credentials   configure vault dynamic provider credentials   You can add these as workspace variables or as a  variable set   terraform cloud docs workspaces variables managing variables variable sets   When you configure dynamic provider credentials with multiple provider configurations of the same type  use either a default variable or a tagged alias variable name for each provider configuration  Refer to  Specifying Multiple Configurations   specifying multiple configurations  for more details       Common Environment Variables The below variables apply to all GCP auth types        Required Common Environment Variables   Variable                                                                                Value                                                                                Notes                                                                                TFC VAULT BACKED GCP AUTH  br    TFC VAULT BACKED GCP AUTH  TAG   br     Default variable not supported                      true                                                                                Requires   v1 8 0   or later if self managing agents  Must be present and set to  true   or HCP Terraform will not attempt to authenticate with GCP       TFC VAULT BACKED GCP AUTH TYPE  br    TFC VAULT BACKED GCP AUTH TYPE  TAG   br    TFC DEFAULT VAULT BACKED GCP AUTH TYPE    Specifies the type of authentication to perform with GCP  Must be one of the following   roleset access token    roleset service account key    static account access token   or  static account service account key     Requires   v1 8 0   or later if self managing agents                                                                                Optional Common Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                                                Notes                                                                                TFC VAULT BACKED GCP MOUNT PATH  br    TFC VAULT BACKED GCP MOUNT PATH  TAG   br    TFC DEFAULT VAULT BACKED GCP MOUNT PATH          The mount path of the GCP secrets engine in Vault                                                                                Requires   v1 8 0   or later if self managing agents  Defaults to  gcp                                                               TFC VAULT BACKED GCP VAULT CONFIG  br    TFC VAULT BACKED GCP VAULT CONFIG  TAG   br    TFC DEFAULT VAULT BACKED GCP VAULT CONFIG    The name of the non default Vault configuration for workspaces using  multiple Vault configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations     Requires   v1 12 0   or later if self managing agents  Will fall back to using the default Vault configuration if not provided         Roleset Specific Environment Variables These environment variables are only valid if the  TFC VAULT BACKED GCP AUTH TYPE  is  roleset access token  or  roleset service account key         Required Roleset Specific Environment Variables   Variable                                                                                Value                          Notes                                                                                TFC VAULT BACKED GCP RUN VAULT ROLESET  br    TFC VAULT BACKED GCP RUN VAULT ROLESET  TAG   br    TFC DEFAULT VAULT BACKED GCP RUN VAULT ROLESET    The roleset to use in Vault    Requires   v1 8 0   or later if self managing agents  Optional if  TFC VAULT BACKED GCP PLAN VAULT ROLESET  and  TFC VAULT BACKED GCP APPLY VAULT ROLESET  are both provided  These variables are described  below   optional roleset specific environment variables           Optional Roleset Specific Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                              Notes                                                                                TFC VAULT BACKED GCP PLAN VAULT ROLESET  br    TFC VAULT BACKED GCP PLAN VAULT ROLESET  TAG   br    TFC DEFAULT VAULT BACKED GCP PLAN VAULT ROLESET       The roleset to use for the plan phase of a run     Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED GCP RUN VAULT ROLESET  if not provided       TFC VAULT BACKED GCP APPLY VAULT ROLESET  br    TFC VAULT BACKED GCP APPLY VAULT ROLESET  TAG   br    TFC DEFAULT VAULT BACKED GCP APPLY VAULT ROLESET    The roleset to use for the apply phase of a run    Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED GCP RUN VAULT ROLESET  if not provided         Static Account Specific Environment Variables These environment variables are only valid if the  TFC VAULT BACKED GCP AUTH TYPE  is  static account access token  or  static account service account key         Required Static Account Specific Environment Variables   Variable                                                                                Value                                 Notes                                                                                TFC VAULT BACKED GCP RUN VAULT STATIC ACCOUNT  br    TFC VAULT BACKED GCP RUN VAULT STATIC ACCOUNT  TAG   br    TFC DEFAULT VAULT BACKED GCP RUN VAULT STATIC ACCOUNT    The static account to use in Vault    Requires   v1 8 0   or later if self managing agents  Optional if  TFC VAULT BACKED GCP PLAN VAULT STATIC ACCOUNT  and  TFC VAULT BACKED GCP APPLY VAULT STATIC ACCOUNT  are both provided  These variables are described  below   optional static account specific environment variables           Optional Static Account Specific Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                     Notes                                                                                TFC VAULT BACKED GCP PLAN VAULT STATIC ACCOUNT  br    TFC VAULT BACKED GCP PLAN VAULT STATIC ACCOUNT  TAG   br    TFC DEFAULT VAULT BACKED GCP PLAN VAULT STATIC ACCOUNT       The static account to use for the plan phase of a run     Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED GCP RUN VAULT STATIC ACCOUNT  if not provided       TFC VAULT BACKED GCP APPLY VAULT STATIC ACCOUNT  br    TFC VAULT BACKED GCP APPLY VAULT STATIC ACCOUNT  TAG   br    TFC DEFAULT VAULT BACKED GCP APPLY VAULT STATIC ACCOUNT    The static account to use for the apply phase of a run    Requires   v1 8 0   or later if self managing agents  Will fall back to the value of  TFC VAULT BACKED GCP RUN VAULT STATIC ACCOUNT  if not provided        Configure Terraform Providers The final step is to directly configure your GCP and Vault providers       Configure the GCP Provider Ensure you pass values for the  project  and  region  arguments into the provider configuration block   Ensure you are not setting values or environment variables for  GOOGLE CREDENTIALS  or  GOOGLE APPLICATION CREDENTIALS   Otherwise  these values may interfere with dynamic provider credentials       Configure the Vault Provider If you were previously using the Vault provider to authenticate the GCP provider  remove any existing usage of the GCP secrets engine from your Terraform Code  This includes instances of   vault generic secret   https   registry terraform io providers hashicorp vault latest docs data sources generic secret  that you previously used to generate GCP credentials       Specifying Multiple Configurations       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 12 0   terraform cloud docs agents changelog 1 12 0 07 26 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can add additional variables to handle multiple distinct Vault backed GCP setups  enabling you to use multiple  provider aliases   terraform language providers configuration alias multiple provider configurations  within the same workspace  You can configure each set of credentials independently  or use default values by configuring the variables prefixed with  TFC DEFAULT     For more details  see  Specifying Multiple Configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations         Required Terraform Variable  To use additional configurations  add the following code to your Terraform configuration  This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks      hcl variable  tfc vault backed gcp dynamic credentials      description    Object containing Vault backed GCP dynamic credentials configuration    type   object       default   object         credentials   string       access token   string            aliases   map object         credentials   string       access token   string                          Example Usage        Access Token     hcl provider  google      access token   var tfc vault backed gcp dynamic credentials default access token    provider  google      alias    ALIAS1    access token   var tfc vault backed gcp dynamic credentials aliases  ALIAS1   access token              Credentials     hcl provider  google      credentials   var tfc vault backed gcp dynamic credentials default credentials    provider  google      alias    ALIAS1    credentials   var tfc vault backed gcp dynamic credentials aliases  ALIAS1   credentials


terraform HCP Terraform workspace variables let you customize configurations modify Variables HCP Terraform workspace variables let you customize configurations modify Terraform s behavior setup dynamic provider credentials terraform cloud docs workspaces dynamic provider credentials and store information like static provider credentials page title Workspace Variables HCP Terraform Terraform s behavior and store information like provider credentials

Answer:
---
page_title: Workspace Variables - HCP Terraform
description: >-
  HCP Terraform workspace variables let you customize configurations, modify
  Terraform's behavior, and store information like provider credentials.
---

# Variables

HCP Terraform workspace variables let you customize configurations, modify Terraform's behavior, setup [dynamic provider credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials), and store information like static provider credentials.

You can set variables specifically for each workspace or you can create variable sets to reuse the same variables across multiple workspaces. For example, you could define a variable set of provider credentials and automatically apply it to all of the workspaces using that provider. You can use the command line to specify variable values for each plan or apply. Otherwise, HCP Terraform applies workspace variables to all runs within that workspace.

[permissions-citation]: #intentionally-unused---keep-for-maintainers

## Types

You can create both environment variables and Terraform variables in HCP Terraform.

> **Hands-on:** Try the [Create and Use a Variable Sets](/terraform/tutorials/cloud-get-started/cloud-create-variable-set) and [Create Infrastructure](/terraform/tutorials/cloud-get-started/cloud-workspace-configure) tutorials to set environment and Terraform variables in HCP Terraform.

### Environment Variables

HCP Terraform performs Terraform runs on disposable Linux worker VMs using a POSIX-compatible shell. Before running Terraform operations, HCP Terraform uses the `export` command to populate the shell with environment variables.

Environment variables can store provider credentials and other data. Refer to your provider's Terraform Registry documentation for a full list of supported shell environment variables (e.g., authentication variables for [AWS](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#environment-variables), [Google Cloud Platform](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials), and [Azure](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs#argument-reference)). Environment variables can also [modify Terraform's behavior](/terraform/cli/config/environment-variables). For example, `TF_LOG` enables detailed logs for debugging.

#### Parallelism

You can use the `TFE_PARALLELISM` environment variable when your infrastructure providers produce errors on concurrent operations or use non-standard rate limiting. The `TFE_PARALLELISM` variable sets the  `-parallelism=<N>` flag for  `terraform plan` and `terraform apply`  ([more about `parallelism`](/terraform/internals/graph#walking-the-graph)). Valid values are between 1 and 256, inclusive, and the default is `10`. HCP Terraform agents do not support `TFE_PARALLELISM`, but you can specify flags as environment variables directly via [`TF_CLI_ARGS_name`](/terraform/cli/config/environment-variables#tf-cli-args). In these cases, use `TF_CLI_ARGS_plan="-parallelism=<N>"` or `TF_CLI_ARGS_apply="-parallelism=<N>"` instead.

!> **Warning:** We recommend reading and understanding [Terraform parallelism](https://support.hashicorp.com/hc/en-us/articles/10348130482451) prior to setting `TFE_PARALLELISM`. You can also contact HashiCorp support for direct advice.

#### Dynamic Credentials

You can configure [dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials) for certain providers using environment variables [at the workspace level](/terraform/cloud-docs/workspaces/variables/managing-variables#workspace-specific-variables) or using [variable sets](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets).

Dynamic credentials allows for using temporary per-run credentials and eliminates the need to manually rotate secrets.

### Terraform Variables

Terraform variables refer to [input variables](/terraform/language/values/variables) that define parameters without hardcoding them into the configuration. For example, you could create variables that let users specify the number and type of Amazon Web Services EC2 instances they want to provision with a Terraform module.

```hcl
variable "instance_count" {
  description = "Number of instances to provision."
  type        = number
  default     = 2
}
```

You can then reference this variable in your configuration.

```hcl
module "ec2_instances" {
  source = "./modules/aws-instance"

 instance_count = var.instance_count
 ## ...
}
```

If a required input variable is missing, Terraform plans in the workspace will fail and print an explanation in the log.

## Scope

Each environment and Terraform variable can have one of the following scopes:

| Scope                         | Description                                                                        | Resources                                                                                |
| ----------------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Run-Specific                  | Apply to a specific run within a single workspace.                                 | [Specify Run-Specific Variables](/terraform/cloud-docs/workspaces/variables/managing-variables#run-specific-variables)                                                                                |
| Workspace-Specific            | Apply to a single workspace.                                                       | [Create Workspace-Specific Variables](/terraform/cloud-docs/workspaces/variables/managing-variables#workspace-specific-variables), [Loading Variables from Files](/terraform/cloud-docs/workspaces/variables/managing-variables#loading-variables-from-files), [Workspace-Specific Variables API](/terraform/cloud-docs/api-docs/workspace-variables). |
| Workspace-Scoped Variable Set | Apply to multiple workspaces within the same organization.                         | [Create Variable Sets](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets) and [Variable Sets API](/terraform/cloud-docs/api-docs/variable-sets)                                                                                |
| Project-Scoped Variable Set   | Automatically applied to all current and future workspaces within a project.       | [Create Variable Sets](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets) and [Variable Sets API](/terraform/cloud-docs/api-docs/variable-sets)                                                                                |
| Global Variable Set           | Automatically applied to all current and future workspaces within an organization. | [Create Variable Sets](/terraform/cloud-docs/workspaces/variables/managing-variables#variable-sets) and [Variable Sets API](/terraform/cloud-docs/api-docs/variable-sets)                                                                                |

## Precedence

> **Hands On:** The [Manage Multiple Variable Sets in HCP Terraform](/terraform/tutorials/cloud/cloud-multiple-variable-sets) tutorial shows how to manage multiple variable sets and demonstrates variable precedence.

There may be cases when a workspace contains conflicting variables of the same type with the same key. HCP Terraform marks overwritten variables in the UI.

HCP Terraform prioritizes and overwrites conflicting variables according to the following precedence:

### 1. Priority global variable sets

If [prioritized](/terraform/cloud-docs/workspaces/variables#precedence-with-priority-variable-sets), variables in a global variable set have precedence over all other variables with the same key.

### 2. Priority project-scoped variable sets

If [prioritized](/terraform/cloud-docs/workspaces/variables#precedence-with-priority-variable-sets), variables in a priority project-scoped variable set have precedence over variables with the same key set at a more specific scope.

### 3. Priority workspace-scoped variable sets

If [prioritized](/terraform/cloud-docs/workspaces/variables#precedence-with-priority-variable-sets), variables in a priority workspace-scoped variable set have precedence over variables with the same key set at a more specific scope.

### 4. Command line argument variables

When using a CLI workflow, variables applied to a run with either `-var` or `-var-file` overwrite workspace-specific and variable set variables that have the same key.

### 5. Local environment variables prefixed with `TF_VAR_`

When using a CLI workflow, local environment variables prefixed with `TF_VAR_` (e.g., `TF_VAR_replicas`) overwrite workspace-specific, variable set, and `.auto.tfvars` file variables that have the same key.

### 6. Workspace-specific variables

Workspace-specific variables always overwrite variables from variable sets that have the same key. Refer to [overwrite variables from variable sets](/terraform/cloud-docs/workspaces/variables/managing-variables#overwrite-variable-sets) for details.

### 7. Workspace-scoped variable sets

Variables in workspace-scoped variable sets are only applied to a subset of workspaces in an organization.

When workspace-scoped variable sets have conflicting variables, HCP Terraform compares the variable set names and uses values from the variable set with lexical precedence. Terraform and HCP Terraform operate on UTF-8 strings, and HCP Terraform sorts variable set names based on the lexical order of Unicode code points.

For example, if you apply `A_Variable_Set` and `B_Variable_Set` to the same workspace, HCP Terraform will use any conflicting variables from `A_Variable_Set`. This is the case regardless of which variable set has been edited most recently. HCP Terraform only considers the lexical ordering of variable set names when determining precedence.

### 8. Project-scoped variable sets

Workspace-specific variables and workspace-scoped variable sets always take precedence over project-scoped variable sets that are applied to workspaces within a project.

Variables in project-scoped variable sets are only applied to the workspaces within the specified projects.

When project-scoped variable sets have conflicting variables, HCP Terraform compares the variable set names and uses values from the variable set with lexical precedence. Terraform and HCP Terraform operate on UTF-8 strings, and HCP Terraform sorts variable set names based the on lexical order of Unicode code points.

For example, if you apply `A_Variable_Set` and `B_Variable_Set` to the same project, HCP Terraform uses any conflicting variables from `A_Variable_Set`. This is the case regardless of which variable set has been edited most recently. HCP Terraform only considers the lexical ordering of variable set names when determining precedence.

### 9. Global variable sets

Workspace and project-scoped variable sets always take precedence over global variable sets that are applied to all workspaces within an organization. Terraform does not allow global variable sets to contain variables with the same key, so they cannot conflict.

### 10. `*.auto.tfvars` variable files

Variables in the HCP Terraform workspace and variables provided through the command line always overwrite variables with the same key from files ending in `.auto.tfvars`.

### 11. `terraform.tfvars` variable file

Variables in the `.auto.tfvars` files take precedence over variables in the `terraform.tfvars` file.

<Note>

Although Terraform Cloud uses variables from `terraform.tfvars`, Terraform Enterprise currently ignores this file.

</Note>

## Precedence with priority variable sets

You can select to prioritize all values of the variables in a variable set.
When a variable set is priority, the values take precedence over any variables with the same key set at a more specific scope.

For example, variables in a priority global variable set would take precedence over all variables with the same key.

If two priority variable sets with the same scope include the same variable key, HCP Terraform will determine precedence by the alphabetical order of the variable sets' names.

While a priority variable set can enforce that Terraform variables use designated values, it does not guarantee that the configuration uses the variable. A user can still directly modify the Terraform configuration to remove usage of a variable and replace it with a hard-coded value. For stricter enforcement, we recommend using policy checks or run tasks.

## Precedence example

Consider an example workspace that has the following variables applied:

| (**Scope**) Source                         | Region      | Var1 | Replicas  |
| ------------------------------------------ | ----------- | ---- | --------- |
| Priority **global** variable set           | `us-east-1` |      |           |
| Priority **project-scoped** variable set   | `us-east-2` |      |           |
| Priority **workspace-scoped** variable set | `us-west-1` |      |           |
| Command line argument                      | `us-west-2` |      |   `9`     |
| Local environment variable                 |             |      |   `8`     |
| **Workspace-specific** variable            |             | `h`  |   `1`     |
| **Workspace-scoped** variable set          |             | `y`  |   `2`     |
| **Project-scoped** variable set            |             |      |   `3`     |
| **Global** variable set                    |             |      |   `4`     |

When you trigger a run through the command line, these are the final values Terraform Cloud assigns to each variable:

| Variable | Value        |
| -------- | ------------ |
| Region   | ` us-east-1` |
| Var1     | `h`          |
| Replicas | `9`

page title  Workspace Variables   HCP Terraform description       HCP Terraform workspace variables let you customize configurations  modify   Terraform s behavior  and store information like provider credentials         Variables  HCP Terraform workspace variables let you customize configurations  modify Terraform s behavior  setup  dynamic provider credentials   terraform cloud docs workspaces dynamic provider credentials   and store information like static provider credentials   You can set variables specifically for each workspace or you can create variable sets to reuse the same variables across multiple workspaces  For example  you could define a variable set of provider credentials and automatically apply it to all of the workspaces using that provider  You can use the command line to specify variable values for each plan or apply  Otherwise  HCP Terraform applies workspace variables to all runs within that workspace    permissions citation    intentionally unused   keep for maintainers     Types  You can create both environment variables and Terraform variables in HCP Terraform       Hands on    Try the  Create and Use a Variable Sets   terraform tutorials cloud get started cloud create variable set  and  Create Infrastructure   terraform tutorials cloud get started cloud workspace configure  tutorials to set environment and Terraform variables in HCP Terraform       Environment Variables  HCP Terraform performs Terraform runs on disposable Linux worker VMs using a POSIX compatible shell  Before running Terraform operations  HCP Terraform uses the  export  command to populate the shell with environment variables   Environment variables can store provider credentials and other data  Refer to your provider s Terraform Registry documentation for a full list of supported shell environment variables  e g   authentication variables for  AWS  https   registry terraform io providers hashicorp aws latest docs environment variables    Google Cloud Platform  https   registry terraform io providers hashicorp google latest docs guides getting started adding credentials   and  Azure  https   registry terraform io providers hashicorp azurerm latest docs argument reference    Environment variables can also  modify Terraform s behavior   terraform cli config environment variables   For example   TF LOG  enables detailed logs for debugging        Parallelism  You can use the  TFE PARALLELISM  environment variable when your infrastructure providers produce errors on concurrent operations or use non standard rate limiting  The  TFE PARALLELISM  variable sets the    parallelism  N   flag for   terraform plan  and  terraform apply     more about  parallelism    terraform internals graph walking the graph    Valid values are between 1 and 256  inclusive  and the default is  10   HCP Terraform agents do not support  TFE PARALLELISM   but you can specify flags as environment variables directly via   TF CLI ARGS name    terraform cli config environment variables tf cli args   In these cases  use  TF CLI ARGS plan   parallelism  N    or  TF CLI ARGS apply   parallelism  N    instead        Warning    We recommend reading and understanding  Terraform parallelism  https   support hashicorp com hc en us articles 10348130482451  prior to setting  TFE PARALLELISM   You can also contact HashiCorp support for direct advice         Dynamic Credentials  You can configure  dynamic credentials   terraform cloud docs workspaces dynamic provider credentials  for certain providers using environment variables  at the workspace level   terraform cloud docs workspaces variables managing variables workspace specific variables  or using  variable sets   terraform cloud docs workspaces variables managing variables variable sets    Dynamic credentials allows for using temporary per run credentials and eliminates the need to manually rotate secrets       Terraform Variables  Terraform variables refer to  input variables   terraform language values variables  that define parameters without hardcoding them into the configuration  For example  you could create variables that let users specify the number and type of Amazon Web Services EC2 instances they want to provision with a Terraform module      hcl variable  instance count      description    Number of instances to provision     type          number   default       2        You can then reference this variable in your configuration      hcl module  ec2 instances      source      modules aws instance    instance count   var instance count                If a required input variable is missing  Terraform plans in the workspace will fail and print an explanation in the log      Scope  Each environment and Terraform variable can have one of the following scopes     Scope                           Description                                                                          Resources                                                                                Run Specific                    Apply to a specific run within a single workspace                                     Specify Run Specific Variables   terraform cloud docs workspaces variables managing variables run specific variables                                                                                Workspace Specific              Apply to a single workspace                                                           Create Workspace Specific Variables   terraform cloud docs workspaces variables managing variables workspace specific variables    Loading Variables from Files   terraform cloud docs workspaces variables managing variables loading variables from files    Workspace Specific Variables API   terraform cloud docs api docs workspace variables       Workspace Scoped Variable Set   Apply to multiple workspaces within the same organization                             Create Variable Sets   terraform cloud docs workspaces variables managing variables variable sets  and  Variable Sets API   terraform cloud docs api docs variable sets                                                                                Project Scoped Variable Set     Automatically applied to all current and future workspaces within a project           Create Variable Sets   terraform cloud docs workspaces variables managing variables variable sets  and  Variable Sets API   terraform cloud docs api docs variable sets                                                                                Global Variable Set             Automatically applied to all current and future workspaces within an organization     Create Variable Sets   terraform cloud docs workspaces variables managing variables variable sets  and  Variable Sets API   terraform cloud docs api docs variable sets                                                                                Precedence      Hands On    The  Manage Multiple Variable Sets in HCP Terraform   terraform tutorials cloud cloud multiple variable sets  tutorial shows how to manage multiple variable sets and demonstrates variable precedence   There may be cases when a workspace contains conflicting variables of the same type with the same key  HCP Terraform marks overwritten variables in the UI   HCP Terraform prioritizes and overwrites conflicting variables according to the following precedence       1  Priority global variable sets  If  prioritized   terraform cloud docs workspaces variables precedence with priority variable sets   variables in a global variable set have precedence over all other variables with the same key       2  Priority project scoped variable sets  If  prioritized   terraform cloud docs workspaces variables precedence with priority variable sets   variables in a priority project scoped variable set have precedence over variables with the same key set at a more specific scope       3  Priority workspace scoped variable sets  If  prioritized   terraform cloud docs workspaces variables precedence with priority variable sets   variables in a priority workspace scoped variable set have precedence over variables with the same key set at a more specific scope       4  Command line argument variables  When using a CLI workflow  variables applied to a run with either   var  or   var file  overwrite workspace specific and variable set variables that have the same key       5  Local environment variables prefixed with  TF VAR    When using a CLI workflow  local environment variables prefixed with  TF VAR    e g    TF VAR replicas   overwrite workspace specific  variable set  and   auto tfvars  file variables that have the same key       6  Workspace specific variables  Workspace specific variables always overwrite variables from variable sets that have the same key  Refer to  overwrite variables from variable sets   terraform cloud docs workspaces variables managing variables overwrite variable sets  for details       7  Workspace scoped variable sets  Variables in workspace scoped variable sets are only applied to a subset of workspaces in an organization   When workspace scoped variable sets have conflicting variables  HCP Terraform compares the variable set names and uses values from the variable set with lexical precedence  Terraform and HCP Terraform operate on UTF 8 strings  and HCP Terraform sorts variable set names based on the lexical order of Unicode code points   For example  if you apply  A Variable Set  and  B Variable Set  to the same workspace  HCP Terraform will use any conflicting variables from  A Variable Set   This is the case regardless of which variable set has been edited most recently  HCP Terraform only considers the lexical ordering of variable set names when determining precedence       8  Project scoped variable sets  Workspace specific variables and workspace scoped variable sets always take precedence over project scoped variable sets that are applied to workspaces within a project    Variables in project scoped variable sets are only applied to the workspaces within the specified projects   When project scoped variable sets have conflicting variables  HCP Terraform compares the variable set names and uses values from the variable set with lexical precedence  Terraform and HCP Terraform operate on UTF 8 strings  and HCP Terraform sorts variable set names based the on lexical order of Unicode code points   For example  if you apply  A Variable Set  and  B Variable Set  to the same project  HCP Terraform uses any conflicting variables from  A Variable Set   This is the case regardless of which variable set has been edited most recently  HCP Terraform only considers the lexical ordering of variable set names when determining precedence       9  Global variable sets  Workspace and project scoped variable sets always take precedence over global variable sets that are applied to all workspaces within an organization  Terraform does not allow global variable sets to contain variables with the same key  so they cannot conflict       10     auto tfvars  variable files  Variables in the HCP Terraform workspace and variables provided through the command line always overwrite variables with the same key from files ending in   auto tfvars        11   terraform tfvars  variable file  Variables in the   auto tfvars  files take precedence over variables in the  terraform tfvars  file    Note     Although Terraform Cloud uses variables from  terraform tfvars   Terraform Enterprise currently ignores this file     Note      Precedence with priority variable sets  You can select to prioritize all values of the variables in a variable set  When a variable set is priority  the values take precedence over any variables with the same key set at a more specific scope   For example  variables in a priority global variable set would take precedence over all variables with the same key   If two priority variable sets with the same scope include the same variable key  HCP Terraform will determine precedence by the alphabetical order of the variable sets  names   While a priority variable set can enforce that Terraform variables use designated values  it does not guarantee that the configuration uses the variable  A user can still directly modify the Terraform configuration to remove usage of a variable and replace it with a hard coded value  For stricter enforcement  we recommend using policy checks or run tasks      Precedence example  Consider an example workspace that has the following variables applied        Scope    Source                           Region        Var1   Replicas                                                                                Priority   global   variable set              us east 1                         Priority   project scoped   variable set      us east 2                         Priority   workspace scoped   variable set    us west 1                         Command line argument                         us west 2              9          Local environment variable                                           8            Workspace specific   variable                             h        1            Workspace scoped   variable set                           y        2            Project scoped   variable set                                      3            Global   variable set                                              4         When you trigger a run through the command line  these are the final values Terraform Cloud assigns to each variable     Variable   Value                                         Region       us east 1       Var1        h               Replicas    9