terraform your HCP Terraform runs Use OpenID Connect to get short term credentials for the HCP provider in Important If you are self hosting HCP Terraform agents terraform cloud docs agents ensure your agents use v1 15 1 terraform cloud docs agents changelog 1 15 1 05 01 2024 or above To use the latest dynamic credentials features upgrade your agents to the latest version terraform cloud docs agents changelog Dynamic Credentials with the HCP Provider page title Dynamic Credentials with the HCP Provider Workspaces HCP Terraform

Answer:
---
page_title: Dynamic Credentials with the HCP Provider - Workspaces - HCP Terraform
description: >-
  Use OpenID Connect to get short-term credentials for the HCP provider in
  your HCP Terraform runs.
---

# Dynamic Credentials with the HCP Provider

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.15.1](/terraform/cloud-docs/agents/changelog#1-15-1-05-01-2024) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can use HCP Terraform’s native OpenID Connect integration with HCP to authenticate with the HCP provider using [dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials) in your HCP Terraform runs. Configuring dynamic credentials for the HCP provider requires the following steps:

1. **[Configure HCP](#configure-hcp):** Set up a trust configuration between HCP and HCP Terraform. Then, you must create a [service principal in HPC](https://developer.hashicorp.com/hcp/docs/hcp/admin/iam/service-principals) for your HCP Terraform workspaces.
2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.

Once you complete the setup, HCP Terraform automatically authenticates to HCP during each run.

## Configure HCP
You must enable and configure a workload identity pool and provider on HCP. These instructions use the HCP CLI, but you can also use Terraform to configure HCP. Refer to our [example Terraform configuration](https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/hcp).

#### Create a Service Principal
Create a service principal for HCP Terraform to assume during runs by running the following HCP command. Note the ID of the service principal you create because you will need it in the following steps. For all remaining steps, replace `HCP_PROJECT_ID` with the ID of the project that contains all the resources and workspaces that you want to manage with this service principal. If you wish to manage more than one project with dynamic credentials, it is recommended that you create multiple service principals, one for each project.

```shell
hcp iam service-principals create hcp-terraform --project=HCP_PROJECT_ID
```

Grant your service principal the necessary permissions to manage your infrastructure during runs.

```shell
hcp projects add-binding \
  --project=HCP_PROJECT_ID \
  --member=HCP_PRINCIPAL_ID \
  --role=roles/contributor
```

#### Add a Workload Identity Provider

Next, create a workload identity provider that HCP uses to authenticate the HCP Terraform run. Make sure to replace `HCP_PROJECT_ID`, `ORG_NAME`, `PROJECT_NAME`, and `WORKSPACE_NAME` with their respective values before running the command.

```shell
hcp iam workload-identity-providers create-oidc hcp-terraform-dynamic-credentials \
  --service-principal=iam/project/HCP_PROJECT_ID/service-principal/hcp-terraform \
  --issuer=https://app.terraform.io \
  --allowed-audience=hcp.workload.identity
  --conditional-access='jwt_claims.sub matches `^organization:ORG_NAME:project:PROJECT_NAME:workspace:WORKSPACE_NAME:run_phase:.*`' \
  --description="Allow HCP Terraform agents to act as the hcp-terraform service principal"
```

## Configure HCP Terraform
Next, you need to set environment variables in your HCP Terraform workspace to configure HCP Terraform to authenticate with HCP using dynamic credentials. You can set these as workspace variables or use a variable set to share one HCP service principal across multiple workspaces. When you configure dynamic provider credentials with multiple provider configurations of the same type, use either a default variable or a tagged alias variable name for each provider configuration. Refer to [Specifying Multiple Configurations](#specifying-multiple-configurations) for more details.

### Required Environment Variables
| Variable                                                                                | Value                                                                                | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_HCP_PROVIDER_AUTH`
`TFC_HCP_PROVIDER_AUTH[_TAG]`
_(Default variable not supported)_                                     | `true`                                                                                | Requires **v1.15.1** or later if you use self-managing agents. Must be present and set to `true`, or HCP Terraform will not attempt to use dynamic credentials to authenticate to HCP.                  |
| `TFC_HCP_RUN_PROVIDER_RESOURCE_NAME`
`TFC_HCP_RUN_PROVIDER_RESOURCE_NAME[_TAG]`
`TFC_DEFAULT_HCP_RUN_PROVIDER_RESOURCE_NAME` | The resource name of the workload identity provider that will be used to assume the service principal | Requires **v1.15.1** or later if you use self-managing agents. Optional if you provide `PLAN_PROVIDER_RESOURCE_NAME` and `APPLY_PROVIDER_RESOURCE_NAME`. [Learn more](#optional-environment-variables). |

### Optional Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_HCP_WORKLOAD_IDENTITY_AUDIENCE`
`TFC_HCP_WORKLOAD_IDENTITY_AUDIENCE[_TAG]`
`TFC_DEFAULT_HCP_WORKLOAD_IDENTITY_AUDIENCE`       | HCP Terraform uses this as the `aud` claim for the identity token. Defaults to the provider resource name for the current run phase, which HCP Terraform derives from the values you provide for `RUN_PROVIDER_RESOURCE_NAME`, `PLAN_PROVIDER_RESOURCE_NAME`, and `APPLY_PROVIDER_RESOURCE_NAME`. | Requires **v1.15.1** or later if you use self-managing agents. This is one of the default `aud` formats that HCP accepts.           |
| `TFC_HCP_PLAN_PROVIDER_RESOURCE_NAME`
`TFC_HCP_PLAN_PROVIDER_RESOURCE_NAME[_TAG]`
`TFC_DEFAULT_HCP_PLAN_PROVIDER_RESOURCE_NAME`    | The resource name of the workload identity provider that will HCP Terraform will use to authenticate the agent during the plan phase of a run.                                                                                | Requires **v1.15.1** or later if self-managing agents. Will fall back to the value of `RUN_PROVIDER_RESOURCE_NAME` if not provided. |
| `TFC_HCP_APPLY_PROVIDER_RESOURCE_NAME`
`TFC_HCP_APPLY_PROVIDER_RESOURCE_NAME[_TAG]`
`TFC_DEFAULT_HCP_APPLY_PROVIDER_RESOURCE_NAME` | The resource name of the workload identity provider that will HCP Terraform will use to authenticate the agent during the apply phase of a run.                                                                                | Requires **v1.15.1** or later if self-managing agents. Will fall back to the value of `RUN_PROVIDER_RESOURCE_NAME` if not provided. |

## Configure the HCP Provider

Do not set the `HCP_CRED_FILE` environment variable when configuring the HCP provider, or `HCP_CRED_FILE` will conflict with the dynamic credentials authentication process.

### Specifying Multiple Configurations

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.15.1](/terraform/cloud-docs/agents/changelog#1-15-1-05-01-2024) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can add additional variables to handle multiple distinct HCP setups, enabling you to use multiple [provider aliases](/terraform/language/providers/configuration#alias-multiple-provider-configurations) within the same workspace. You can configure each set of credentials independently, or use default values by configuring the variables prefixed with `TFC_DEFAULT_`.

For more details, refer to [Specifying Multiple Configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations).

#### Required Terraform Variable

Add the following variable to your Terraform configuration to set up additional dynamic credential configurations with the HCP provider. This variable lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks.

```hcl
variable "tfc_hcp_dynamic_credentials" {
  description = "Object containing HCP dynamic credentials configuration"
  type = object({
    default = object({
      credential_file = string
    })
    aliases = map(object({
      credential_file = string
    }))
  })
}
```

#### Example Usage

```hcl
provider "hcp" {
  credential_file = var.tfc_hcp_dynamic_credentials.default.credential_file
}

provider "hcp" {
  alias = "ALIAS1"
  credential_file = var.tfc_hcp_dynamic_credentials.aliases["ALIAS1"].credential_file
}
```

page title  Dynamic Credentials with the HCP Provider   Workspaces   HCP Terraform description       Use OpenID Connect to get short term credentials for the HCP provider in   your HCP Terraform runs         Dynamic Credentials with the HCP Provider       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 15 1   terraform cloud docs agents changelog 1 15 1 05 01 2024  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can use HCP Terraform s native OpenID Connect integration with HCP to authenticate with the HCP provider using  dynamic credentials   terraform cloud docs workspaces dynamic provider credentials  in your HCP Terraform runs  Configuring dynamic credentials for the HCP provider requires the following steps   1     Configure HCP   configure hcp     Set up a trust configuration between HCP and HCP Terraform  Then  you must create a  service principal in HPC  https   developer hashicorp com hcp docs hcp admin iam service principals  for your HCP Terraform workspaces  2     Configure HCP Terraform   configure hcp terraform     Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials   Once you complete the setup  HCP Terraform automatically authenticates to HCP during each run      Configure HCP You must enable and configure a workload identity pool and provider on HCP  These instructions use the HCP CLI  but you can also use Terraform to configure HCP  Refer to our  example Terraform configuration  https   github com hashicorp terraform dynamic credentials setup examples tree main hcp         Create a Service Principal Create a service principal for HCP Terraform to assume during runs by running the following HCP command  Note the ID of the service principal you create because you will need it in the following steps  For all remaining steps  replace  HCP PROJECT ID  with the ID of the project that contains all the resources and workspaces that you want to manage with this service principal  If you wish to manage more than one project with dynamic credentials  it is recommended that you create multiple service principals  one for each project      shell hcp iam service principals create hcp terraform   project HCP PROJECT ID      Grant your service principal the necessary permissions to manage your infrastructure during runs      shell hcp projects add binding       project HCP PROJECT ID       member HCP PRINCIPAL ID       role roles contributor           Add a Workload Identity Provider  Next  create a workload identity provider that HCP uses to authenticate the HCP Terraform run  Make sure to replace  HCP PROJECT ID    ORG NAME    PROJECT NAME   and  WORKSPACE NAME  with their respective values before running the command      shell hcp iam workload identity providers create oidc hcp terraform dynamic credentials       service principal iam project HCP PROJECT ID service principal hcp terraform       issuer https   app terraform io       allowed audience hcp workload identity     conditional access  jwt claims sub matches   organization ORG NAME project PROJECT NAME workspace WORKSPACE NAME run phase            description  Allow HCP Terraform agents to act as the hcp terraform service principal          Configure HCP Terraform Next  you need to set environment variables in your HCP Terraform workspace to configure HCP Terraform to authenticate with HCP using dynamic credentials  You can set these as workspace variables or use a variable set to share one HCP service principal across multiple workspaces  When you configure dynamic provider credentials with multiple provider configurations of the same type  use either a default variable or a tagged alias variable name for each provider configuration  Refer to  Specifying Multiple Configurations   specifying multiple configurations  for more details       Required Environment Variables   Variable                                                                                Value                                                                                Notes                                                                                TFC HCP PROVIDER AUTH  br    TFC HCP PROVIDER AUTH  TAG   br     Default variable not supported                                          true                                                                                Requires   v1 15 1   or later if you use self managing agents  Must be present and set to  true   or HCP Terraform will not attempt to use dynamic credentials to authenticate to HCP                        TFC HCP RUN PROVIDER RESOURCE NAME  br    TFC HCP RUN PROVIDER RESOURCE NAME  TAG   br    TFC DEFAULT HCP RUN PROVIDER RESOURCE NAME    The resource name of the workload identity provider that will be used to assume the service principal   Requires   v1 15 1   or later if you use self managing agents  Optional if you provide  PLAN PROVIDER RESOURCE NAME  and  APPLY PROVIDER RESOURCE NAME    Learn more   optional environment variables          Optional Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                                                Notes                                                                                TFC HCP WORKLOAD IDENTITY AUDIENCE  br    TFC HCP WORKLOAD IDENTITY AUDIENCE  TAG   br    TFC DEFAULT HCP WORKLOAD IDENTITY AUDIENCE          HCP Terraform uses this as the  aud  claim for the identity token  Defaults to the provider resource name for the current run phase  which HCP Terraform derives from the values you provide for  RUN PROVIDER RESOURCE NAME    PLAN PROVIDER RESOURCE NAME   and  APPLY PROVIDER RESOURCE NAME     Requires   v1 15 1   or later if you use self managing agents  This is one of the default  aud  formats that HCP accepts                 TFC HCP PLAN PROVIDER RESOURCE NAME  br    TFC HCP PLAN PROVIDER RESOURCE NAME  TAG   br    TFC DEFAULT HCP PLAN PROVIDER RESOURCE NAME       The resource name of the workload identity provider that will HCP Terraform will use to authenticate the agent during the plan phase of a run                                                                                Requires   v1 15 1   or later if self managing agents  Will fall back to the value of  RUN PROVIDER RESOURCE NAME  if not provided       TFC HCP APPLY PROVIDER RESOURCE NAME  br    TFC HCP APPLY PROVIDER RESOURCE NAME  TAG   br    TFC DEFAULT HCP APPLY PROVIDER RESOURCE NAME    The resource name of the workload identity provider that will HCP Terraform will use to authenticate the agent during the apply phase of a run                                                                                Requires   v1 15 1   or later if self managing agents  Will fall back to the value of  RUN PROVIDER RESOURCE NAME  if not provided        Configure the HCP Provider  Do not set the  HCP CRED FILE  environment variable when configuring the HCP provider  or  HCP CRED FILE  will conflict with the dynamic credentials authentication process       Specifying Multiple Configurations       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 15 1   terraform cloud docs agents changelog 1 15 1 05 01 2024  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can add additional variables to handle multiple distinct HCP setups  enabling you to use multiple  provider aliases   terraform language providers configuration alias multiple provider configurations  within the same workspace  You can configure each set of credentials independently  or use default values by configuring the variables prefixed with  TFC DEFAULT     For more details  refer to  Specifying Multiple Configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations         Required Terraform Variable  Add the following variable to your Terraform configuration to set up additional dynamic credential configurations with the HCP provider  This variable lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks      hcl variable  tfc hcp dynamic credentials      description    Object containing HCP dynamic credentials configuration    type   object       default   object         credential file   string            aliases   map object         credential file   string                          Example Usage     hcl provider  hcp      credential file   var tfc hcp dynamic credentials default credential file    provider  hcp      alias    ALIAS1    credential file   var tfc hcp dynamic credentials aliases  ALIAS1   credential file


terraform Dynamic Credentials with the AWS Provider your HCP Terraform runs Use OpenID Connect to get short term credentials for the AWS Terraform provider in Important If you are self hosting HCP Terraform agents terraform cloud docs agents ensure your agents use v1 7 0 terraform cloud docs agents changelog 1 7 0 03 02 2023 or above To use the latest dynamic credentials features upgrade your agents to the latest version terraform cloud docs agents changelog page title Dynamic Credentials with the AWS Provider Workspaces HCP Terraform

Answer:
---
page_title: Dynamic Credentials with the AWS Provider - Workspaces - HCP Terraform
description: >-
  Use OpenID Connect to get short-term credentials for the AWS Terraform provider in
  your HCP Terraform runs.
---

# Dynamic Credentials with the AWS Provider

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.7.0](/terraform/cloud-docs/agents/changelog#1-7-0-03-02-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can use HCP Terraform’s native OpenID Connect integration with AWS to get [dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials) for the AWS provider in your HCP Terraform runs. Configuring the integration requires the following steps:

1. **[Configure AWS](#configure-aws):** Set up a trust configuration between AWS and HCP Terraform. Then, you must create AWS roles and policies for your HCP Terraform workspaces.
2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.

Once you complete the setup, HCP Terraform automatically authenticates to AWS during each run. The AWS provider authentication is valid for the length of the plan or apply.

## Configure AWS
You must enable and configure an OIDC identity provider and accompanying role and trust policy on AWS. These instructions use the AWS console, but you can also use Terraform to configure AWS. Refer to our [example Terraform configuration](https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/aws).
### Create an OIDC Identity Provider
AWS documentation for setting this up through the AWS console or API can be found here: [Creating OpenID Connect (OIDC) identity providers - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html).

The `provider URL` should be set to the address of HCP Terraform (e.g., https://app.terraform.io **without** a trailing slash), and the `audience` should be set to `aws.workload.identity` or the value of `TFC_AWS_WORKLOAD_IDENTITY_AUDIENCE`, if configured.
### Configure a Role and Trust Policy
You must configure a role and corresponding trust policy. Amazon documentation on setting this up can be found here: [Creating a role for web identity or OpenID Connect Federation (console) - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html).
The trust policy will be of the form:
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "OIDC_PROVIDER_ARN"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "SITE_ADDRESS:aud": "AUDIENCE_VALUE",
                    "SITE_ADDRESS:sub": "organization:ORG_NAME:project:PROJECT_NAME:workspace:WORKSPACE_NAME:run_phase:RUN_PHASE"
                }
            }
        }
    ]
}
```
with the capitalized values replaced with the following:
* **OIDC_PROVIDER_ARN**: The ARN from the OIDC provider resource created in the previous step
* **SITE_ADDRESS**: The address of HCP Terraform with `https://` stripped, (e.g., `app.terraform.io`)
* **AUDIENCE_VALUE**: This should be set to `aws.workload.identity` unless a non-default audience has been specified in TFC
* **ORG_NAME**: The organization name this policy will apply to, such as `my-org-name`
* **PROJECT_NAME**: The project name that this policy will apply to, such as `my-project-name`
* **WORKSPACE_NAME**: The workspace name this policy will apply to, such as `my-workspace-name`
* **RUN_PHASE**: The run phase this policy will apply to, currently one of `plan` or `apply`.

-> **Note:** if different permissions are desired for plan and apply, then two separate roles and trust policies must be created for each of these run phases to properly match them to the correct access level.
If the same permissions will be used regardless of run phase, then the condition can be modified like the below to use `StringLike` instead of `StringEquals` for the sub and include a `*` after `run_phase:` to perform a wildcard match:

```json
{
    "Condition": {
        "StringEquals": {
            "SITE_ADDRESS:aud": "AUDIENCE_VALUE"
        },
        "StringLike": {
            "SITE_ADDRESS:sub": "organization:ORG_NAME:project:PROJECT_NAME:workspace:WORKSPACE_NAME:run_phase:*"
        }
    }
}
```

!> **Warning**: you should always check, at minimum, the audience and the name of the organization in order to prevent unauthorized access from other HCP Terraform organizations!

A permissions policy needs to be added to the role which defines what operations within AWS the role is allowed to perform. As an example, the below policy allows for fetching a list of S3 buckets:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "*"
        }
    ]
}
```

## Configure HCP Terraform
You’ll need to set some environment variables in your HCP Terraform workspace in order to configure HCP Terraform to authenticate with AWS using dynamic credentials. You can set these as workspace variables, or if you’d like to share one AWS role across multiple workspaces, you can use a variable set. When you configure dynamic provider credentials with multiple provider configurations of the same type, use either a default variable or a tagged alias variable name for each provider configuration. Refer to [Specifying Multiple Configurations](#specifying-multiple-configurations) for more details.

### Required Environment Variables
| Variable                                                                                | Value                                 | Notes                                                                                |
|----------------------------------------------------------------------------------------------|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_AWS_PROVIDER_AUTH`
`TFC_AWS_PROVIDER_AUTH[_TAG]`
_(Default variable not supported)_                                   | `true`                                | Requires **v1.7.0** or later if self-managing agents. Must be present and set to `true`, or HCP Terraform will not attempt to authenticate to AWS.                                                                                |
| `TFC_AWS_RUN_ROLE_ARN`
`TFC_AWS_RUN_ROLE_ARN[_TAG]`
`TFC_DEFAULT_AWS_RUN_ROLE_ARN` | The ARN of the role to assume in AWS. | Requires **v1.7.0** or later if self-managing agents. Optional if `TFC_AWS_PLAN_ROLE_ARN` and `TFC_AWS_APPLY_ROLE_ARN` are both provided. These variables are described [below](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/aws-configuration#optional-environment-variables) |

### Optional Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| `TFC_AWS_WORKLOAD_IDENTITY_AUDIENCE`
`TFC_AWS_WORKLOAD_IDENTITY_AUDIENCE[_TAG]`
`TFC_DEFAULT_AWS_WORKLOAD_IDENTITY_AUDIENCE` | Will be used as the `aud` claim for the identity token. Defaults to `aws.workload.identity`. | Requires **v1.7.0** or later if self-managing agents.                                                                        |
| `TFC_AWS_PLAN_ROLE_ARN`
`TFC_AWS_PLAN_ROLE_ARN[_TAG]`
`TFC_DEFAULT_AWS_PLAN_ROLE_ARN`                                        | The ARN of the role to use for the plan phase of a run.                                      | Requires **v1.7.0** or later if self-managing agents. Will fall back to the value of `TFC_AWS_RUN_ROLE_ARN` if not provided. |
| `TFC_AWS_APPLY_ROLE_ARN`
`TFC_AWS_APPLY_ROLE_ARN[_TAG]`
`TFC_DEFAULT_AWS_APPLY_ROLE_ARN`                                     | The ARN of the role to use for the apply phase of a run.                                     | Requires **v1.7.0** or later if self-managing agents. Will fall back to the value of `TFC_AWS_RUN_ROLE_ARN` if not provided. |

## Configure the AWS Provider
Make sure that you’re passing a value for the `region` argument into the provider configuration block or setting the `AWS_REGION` variable in your workspace.

Make sure that you’re not using any of the other arguments or methods mentioned in the [authentication and configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration) section of the provider documentation as these settings may interfere with dynamic provider credentials.

### Specifying Multiple Configurations

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.12.0](/terraform/cloud-docs/agents/changelog#1-12-0-07-26-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can add additional variables to handle multiple distinct AWS setups, enabling you to use multiple [provider aliases](/terraform/language/providers/configuration#alias-multiple-provider-configurations) within the same workspace. You can configure each set of credentials independently, or use default values by configuring the variables prefixed with `TFC_DEFAULT_`.

For more details, see [Specifying Multiple Configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations).

#### Required Terraform Variable

To use additional configurations, add the following code to your Terraform configuration. This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks.

```hcl
variable "tfc_aws_dynamic_credentials" {
  description = "Object containing AWS dynamic credentials configuration"
  type = object({
    default = object({
      shared_config_file = string
    })
    aliases = map(object({
      shared_config_file = string
    }))
  })
}
```

#### Example Usage

```hcl
provider "aws" {
  shared_config_files = [var.tfc_aws_dynamic_credentials.default.shared_config_file]
}

provider "aws" {
  alias = "ALIAS1"
  shared_config_files = [var.tfc_aws_dynamic_credentials.aliases["ALIAS1"].shared_config_file]
}
```

page title  Dynamic Credentials with the AWS Provider   Workspaces   HCP Terraform description       Use OpenID Connect to get short term credentials for the AWS Terraform provider in   your HCP Terraform runs         Dynamic Credentials with the AWS Provider       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 7 0   terraform cloud docs agents changelog 1 7 0 03 02 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can use HCP Terraform s native OpenID Connect integration with AWS to get  dynamic credentials   terraform cloud docs workspaces dynamic provider credentials  for the AWS provider in your HCP Terraform runs  Configuring the integration requires the following steps   1     Configure AWS   configure aws     Set up a trust configuration between AWS and HCP Terraform  Then  you must create AWS roles and policies for your HCP Terraform workspaces  2     Configure HCP Terraform   configure hcp terraform     Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials   Once you complete the setup  HCP Terraform automatically authenticates to AWS during each run  The AWS provider authentication is valid for the length of the plan or apply      Configure AWS You must enable and configure an OIDC identity provider and accompanying role and trust policy on AWS  These instructions use the AWS console  but you can also use Terraform to configure AWS  Refer to our  example Terraform configuration  https   github com hashicorp terraform dynamic credentials setup examples tree main aws       Create an OIDC Identity Provider AWS documentation for setting this up through the AWS console or API can be found here   Creating OpenID Connect  OIDC  identity providers   AWS Identity and Access Management  https   docs aws amazon com IAM latest UserGuide id roles providers create oidc html    The  provider URL  should be set to the address of HCP Terraform  e g   https   app terraform io   without   a trailing slash   and the  audience  should be set to  aws workload identity  or the value of  TFC AWS WORKLOAD IDENTITY AUDIENCE   if configured      Configure a Role and Trust Policy You must configure a role and corresponding trust policy  Amazon documentation on setting this up can be found here   Creating a role for web identity or OpenID Connect Federation  console    AWS Identity and Access Management  https   docs aws amazon com IAM latest UserGuide id roles create for idp oidc html   The trust policy will be of the form     json        Version    2012 10 17        Statement                            Effect    Allow                Principal                      Federated    OIDC PROVIDER ARN                              Action    sts AssumeRoleWithWebIdentity                Condition                      StringEquals                          SITE ADDRESS aud    AUDIENCE VALUE                        SITE ADDRESS sub    organization ORG NAME project PROJECT NAME workspace WORKSPACE NAME run phase RUN PHASE                                                        with the capitalized values replaced with the following      OIDC PROVIDER ARN    The ARN from the OIDC provider resource created in the previous step     SITE ADDRESS    The address of HCP Terraform with  https     stripped   e g    app terraform io       AUDIENCE VALUE    This should be set to  aws workload identity  unless a non default audience has been specified in TFC     ORG NAME    The organization name this policy will apply to  such as  my org name      PROJECT NAME    The project name that this policy will apply to  such as  my project name      WORKSPACE NAME    The workspace name this policy will apply to  such as  my workspace name      RUN PHASE    The run phase this policy will apply to  currently one of  plan  or  apply         Note    if different permissions are desired for plan and apply  then two separate roles and trust policies must be created for each of these run phases to properly match them to the correct access level  If the same permissions will be used regardless of run phase  then the condition can be modified like the below to use  StringLike  instead of  StringEquals  for the sub and include a     after  run phase   to perform a wildcard match      json        Condition              StringEquals                  SITE ADDRESS aud    AUDIENCE VALUE                      StringLike                  SITE ADDRESS sub    organization ORG NAME project PROJECT NAME workspace WORKSPACE NAME run phase                                Warning    you should always check  at minimum  the audience and the name of the organization in order to prevent unauthorized access from other HCP Terraform organizations   A permissions policy needs to be added to the role which defines what operations within AWS the role is allowed to perform  As an example  the below policy allows for fetching a list of S3 buckets      json        Version    2012 10 17        Statement                            Effect    Allow                Action                      s3 ListBucket                              Resource                                 Configure HCP Terraform You ll need to set some environment variables in your HCP Terraform workspace in order to configure HCP Terraform to authenticate with AWS using dynamic credentials  You can set these as workspace variables  or if you d like to share one AWS role across multiple workspaces  you can use a variable set  When you configure dynamic provider credentials with multiple provider configurations of the same type  use either a default variable or a tagged alias variable name for each provider configuration  Refer to  Specifying Multiple Configurations   specifying multiple configurations  for more details       Required Environment Variables   Variable                                                                                Value                                   Notes                                                                                TFC AWS PROVIDER AUTH  br    TFC AWS PROVIDER AUTH  TAG   br     Default variable not supported                                        true                                   Requires   v1 7 0   or later if self managing agents  Must be present and set to  true   or HCP Terraform will not attempt to authenticate to AWS                                                                                TFC AWS RUN ROLE ARN  br    TFC AWS RUN ROLE ARN  TAG   br    TFC DEFAULT AWS RUN ROLE ARN    The ARN of the role to assume in AWS    Requires   v1 7 0   or later if self managing agents  Optional if  TFC AWS PLAN ROLE ARN  and  TFC AWS APPLY ROLE ARN  are both provided  These variables are described  below   terraform cloud docs workspaces dynamic provider credentials aws configuration optional environment variables         Optional Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                                                Notes                                                                                TFC AWS WORKLOAD IDENTITY AUDIENCE  br    TFC AWS WORKLOAD IDENTITY AUDIENCE  TAG   br    TFC DEFAULT AWS WORKLOAD IDENTITY AUDIENCE    Will be used as the  aud  claim for the identity token  Defaults to  aws workload identity     Requires   v1 7 0   or later if self managing agents                                                                              TFC AWS PLAN ROLE ARN  br    TFC AWS PLAN ROLE ARN  TAG   br    TFC DEFAULT AWS PLAN ROLE ARN                                           The ARN of the role to use for the plan phase of a run                                         Requires   v1 7 0   or later if self managing agents  Will fall back to the value of  TFC AWS RUN ROLE ARN  if not provided       TFC AWS APPLY ROLE ARN  br    TFC AWS APPLY ROLE ARN  TAG   br    TFC DEFAULT AWS APPLY ROLE ARN                                        The ARN of the role to use for the apply phase of a run                                        Requires   v1 7 0   or later if self managing agents  Will fall back to the value of  TFC AWS RUN ROLE ARN  if not provided         Configure the AWS Provider Make sure that you re passing a value for the  region  argument into the provider configuration block or setting the  AWS REGION  variable in your workspace   Make sure that you re not using any of the other arguments or methods mentioned in the  authentication and configuration  https   registry terraform io providers hashicorp aws latest docs authentication and configuration  section of the provider documentation as these settings may interfere with dynamic provider credentials       Specifying Multiple Configurations       Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 12 0   terraform cloud docs agents changelog 1 12 0 07 26 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can add additional variables to handle multiple distinct AWS setups  enabling you to use multiple  provider aliases   terraform language providers configuration alias multiple provider configurations  within the same workspace  You can configure each set of credentials independently  or use default values by configuring the variables prefixed with  TFC DEFAULT     For more details  see  Specifying Multiple Configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations         Required Terraform Variable  To use additional configurations  add the following code to your Terraform configuration  This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks      hcl variable  tfc aws dynamic credentials      description    Object containing AWS dynamic credentials configuration    type   object       default   object         shared config file   string            aliases   map object         shared config file   string                          Example Usage     hcl provider  aws      shared config files    var tfc aws dynamic credentials default shared config file     provider  aws      alias    ALIAS1    shared config files    var tfc aws dynamic credentials aliases  ALIAS1   shared config file


terraform your HCP Terraform runs page title Dynamic Credentials with the Azure Providers HCP Terraform Dynamic Credentials with the Azure Provider Important Ensure you are using version 3 25 0 or later of the AzureRM provider and version 2 29 0 or later of the Microsoft Entra ID provider previously Azure Active Directory as required OIDC functionality was introduced in these provider versions Use OpenID Connect to get short term credentials for the Azure Terraform providers in

Answer:
---
page_title: Dynamic Credentials with the Azure Providers - HCP Terraform
description: >-
  Use OpenID Connect to get short-term credentials for the Azure Terraform providers in
  your HCP Terraform runs.
---

# Dynamic Credentials with the Azure Provider

~> **Important:** Ensure you are using version **3.25.0** or later of the **AzureRM provider** and version **2.29.0** or later of the **Microsoft Entra ID provider** (previously Azure Active Directory) as required OIDC functionality was introduced in these provider versions.

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.7.0](/terraform/cloud-docs/agents/changelog#1-7-0-03-02-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can use HCP Terraform’s native OpenID Connect integration with Azure to get [dynamic credentials](/terraform/cloud-docs/workspaces/dynamic-provider-credentials) for the AzureRM or Microsoft Entra ID providers in your HCP Terraform runs. Configuring the integration requires the following steps:

1. **[Configure Azure](#configure-azure):** Set up a trust configuration between Azure and HCP Terraform. Then, you must create Azure roles and policies for your HCP Terraform workspaces.
2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.

Once you complete the setup, HCP Terraform automatically authenticates to Azure during each run. The Azure provider authentication is valid for the length of the plan or apply.

!> **Warning:** Dynamic credentials with the Azure providers do not  work when your Terraform Enterprise instance uses a custom or self-signed certificate. This limitation is due to restrictions in Azure.

## Configure Azure
You must enable and configure an application and service principal with accompanying federated credentials and permissions on Azure. These instructions use the Azure portal, but you can also use Terraform to configure Azure. Refer to our [example Terraform configuration](https://github.com/hashicorp/terraform-dynamic-credentials-setup-examples/tree/main/azure).
### Create an Application and Service Principal
Follow the steps mentioned in the AzureRM provider docs here: [Creating the Application and Service Principal](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_oidc#creating-the-application-and-service-principal).

As mentioned in the documentation it will be important to make note of the `client_id` for the application as you will use this later for authentication.

-> **Note:** you will want to skip the `“Configure Microsoft Entra ID Application to Trust a GitHub Repository”` section as this does not apply here.

### Grant the Application Access to Manage Resources in Your Azure Subscription
You must now give the created Application permission to modify resources within your Subscription.

Follow the steps mentioned in the AzureRM provider docs here: [Granting the Application access to manage resources in your Azure Subscription](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_oidc#granting-the-application-access-to-manage-resources-in-your-azure-subscription).

### Configure Microsoft Entra ID Application to Trust a Generic Issuer
Finally, you must create federated identity credentials which validate the contents of the token sent to Azure from HCP Terraform.

Follow the steps mentioned in the AzureRM provider docs here: [Configure Azure Microsoft Entra ID Application to Trust a Generic Issuer](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_oidc#configure-azure-active-directory-application-to-trust-a-generic-issuer).

The following information should be specified:
* **Federated credential scenario**: Must be set to `Other issuer`.
* **Issuer**: The address of HCP Terraform (e.g., https://app.terraform.io).
    * **Important**: make sure this value starts with **https://** and does _not_ have a trailing slash.
* **Subject identifier**: The subject identifier from HCP Terraform that this credential will match. This will be in the form `organization:my-org-name:project:my-project-name:workspace:my-workspace-name:run_phase:plan` where the `run_phase` can be one of `plan` or `apply`.
* **Name**: A name for the federated credential, such as `tfc-plan-credential`. Note that this cannot be changed later.

The following is optional, but may be desired:
* **Audience**: Enter the audience value that will be set when requesting the identity token. This will be `api://AzureADTokenExchange` by default. This should be set to the value of `TFC_AZURE_WORKLOAD_IDENTITY_AUDIENCE` if this has been configured.

-> **Note:** because the `Subject identifier` for federated credentials is a direct string match, two federated identity credentials need to be created for each workspace using dynamic credentials: one that matches `run_phase:plan` and one that matches `run_phase:apply`.

## Configure HCP Terraform
You’ll need to set some environment variables in your HCP Terraform workspace in order to configure HCP Terraform to authenticate with Azure using dynamic credentials. You can set these as workspace variables. When you configure dynamic provider credentials with multiple provider configurations of the same type, use either a default variable or a tagged alias variable name for each provider configuration. Refer to [Specifying Multiple Configurations](#specifying-multiple-configurations) for more details.
### Required Environment Variables

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `TFC_AZURE_PROVIDER_AUTH`
`TFC_AZURE_PROVIDER_AUTH[_TAG]`
_(Default variable not supported)_ | `true`                                                                                | Requires **v1.7.0** or later if self-managing agents. Must be present and set to `true`, or HCP Terraform will not attempt to authenticate to Azure.                                                                                |
| `TFC_AZURE_RUN_CLIENT_ID`
`TFC_AZURE_RUN_CLIENT_ID[_TAG]`
`TFC_DEFAULT_AZURE_RUN_CLIENT_ID`  | The client ID for the Service Principal / Application used when authenticating to Azure. | Requires **v1.7.0** or later if self-managing agents. Optional if `TFC_AZURE_PLAN_CLIENT_ID` and `TFC_AZURE_APPLY_CLIENT_ID` are both provided. These variables are described [below](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/azure-configuration#optional-environment-variables) |

### Optional Environment Variables
You may need to set these variables, depending on your use case.

| Variable                                                                                | Value                                                                                | Notes                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|
| `TFC_AZURE_WORKLOAD_IDENTITY_AUDIENCE`
`TFC_AZURE_WORKLOAD_IDENTITY_AUDIENCE[_TAG]`
`TFC_DEFAULT_AZURE_WORKLOAD_IDENTITY_AUDIENCE` | Will be used as the `aud` claim for the identity token. Defaults to `api://AzureADTokenExchange`. | Requires **v1.7.0** or later if self-managing agents.                                                                           |
| `TFC_AZURE_PLAN_CLIENT_ID`
`TFC_AZURE_PLAN_CLIENT_ID[_TAG]`
`TFC_DEFAULT_AZURE_PLAN_CLIENT_ID`                                     | The client ID for the Service Principal / Application to use for the plan phase of a run.         | Requires **v1.7.0** or later if self-managing agents. Will fall back to the value of `TFC_AZURE_RUN_CLIENT_ID` if not provided. |
| `TFC_AZURE_APPLY_CLIENT_ID`
`TFC_AZURE_APPLY_CLIENT_ID[_TAG]`
`TFC_DEFAULT_AZURE_APPLY_CLIENT_ID`                                  | The client ID for the Service Principal / Application to use for the apply phase of a run.        | Requires **v1.7.0** or later if self-managing agents. Will fall back to the value of `TFC_AZURE_RUN_CLIENT_ID` if not provided. |

## Configure the AzureRM or Microsoft Entra ID Provider
Make sure that you’re passing values for the `subscription_id` and `tenant_id` arguments into the provider configuration block or setting the `ARM_SUBSCRIPTION_ID` and `ARM_TENANT_ID` variables in your workspace.

Make sure that you’re _not_ setting values for `client_id`, `use_oidc`, or `oidc_token` in the provider or setting any of `ARM_CLIENT_ID`, `ARM_USE_OIDC`, `ARM_OIDC_TOKEN`.

### Specifying Multiple Configurations

~> **Important:** Ensure you are using version **3.60.0** or later of the **AzureRM provider** and version **2.43.0** or later of the **Microsoft Entra ID provider** as required functionality was introduced in these provider versions.

~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.12.0](/terraform/cloud-docs/agents/changelog#1-12-0-07-26-2023) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).

You can add additional variables to handle multiple distinct Azure setups, enabling you to use multiple [provider aliases](/terraform/language/providers/configuration#alias-multiple-provider-configurations) within the same workspace. You can configure each set of credentials independently, or use default values by configuring the variables prefixed with `TFC_DEFAULT_`.

For more details, see [Specifying Multiple Configurations](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/specifying-multiple-configurations).

#### Required Terraform Variable

To use additional configurations, add the following code to your Terraform configuration. This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks.

```hcl
variable "tfc_azure_dynamic_credentials" {
  description = "Object containing Azure dynamic credentials configuration"
  type = object({
    default = object({
      client_id_file_path = string
      oidc_token_file_path = string
    })
    aliases = map(object({
      client_id_file_path = string
      oidc_token_file_path = string
    }))
  })
}
```

#### Example Usage

##### AzureRM Provider

```hcl
provider "azurerm" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli              = false
  // use_oidc must be explicitly set to true when using multiple configurations.
  use_oidc             = true
  client_id_file_path  = var.tfc_azure_dynamic_credentials.default.client_id_file_path
  oidc_token_file_path = var.tfc_azure_dynamic_credentials.default.oidc_token_file_path
  subscription_id      = "00000000-0000-0000-0000-000000000000"
  tenant_id            = "10000000-0000-0000-0000-000000000000"
}

provider "azurerm" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli              = false
  // use_oidc must be explicitly set to true when using multiple configurations.
  use_oidc             = true
  alias                = "ALIAS1"
  client_id_file_path  = var.tfc_azure_dynamic_credentials.aliases["ALIAS1"].client_id_file_path
  oidc_token_file_path = var.tfc_azure_dynamic_credentials.aliases["ALIAS1"].oidc_token_file_path
  subscription_id      = "00000000-0000-0000-0000-000000000000"
  tenant_id            = "20000000-0000-0000-0000-000000000000"
}
```

##### Microsoft Entra ID Provider (formerly Azure AD)

```hcl
provider "azuread" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli              = false
  // use_oidc must be explicitly set to true when using multiple configurations.
  use_oidc             = true
  client_id_file_path  = var.tfc_azure_dynamic_credentials.default.client_id_file_path
  oidc_token_file_path = var.tfc_azure_dynamic_credentials.default.oidc_token_file_path
  subscription_id      = "00000000-0000-0000-0000-000000000000"
  tenant_id            = "10000000-0000-0000-0000-000000000000"
}

provider "azuread" {
  features {}
  // use_cli should be set to false to yield more accurate error messages on auth failure.
  use_cli              = false
  // use_oidc must be explicitly set to true when using multiple configurations.
  use_oidc             = true
  alias                = "ALIAS1"
  client_id_file_path  = var.tfc_azure_dynamic_credentials.aliases["ALIAS1"].client_id_file_path
  oidc_token_file_path = var.tfc_azure_dynamic_credentials.aliases["ALIAS1"].oidc_token_file_path
  subscription_id      = "00000000-0000-0000-0000-000000000000"
  tenant_id            = "20000000-0000-0000-0000-000000000000"
}
```

page title  Dynamic Credentials with the Azure Providers   HCP Terraform description       Use OpenID Connect to get short term credentials for the Azure Terraform providers in   your HCP Terraform runs         Dynamic Credentials with the Azure Provider       Important    Ensure you are using version   3 25 0   or later of the   AzureRM provider   and version   2 29 0   or later of the   Microsoft Entra ID provider    previously Azure Active Directory  as required OIDC functionality was introduced in these provider versions        Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 7 0   terraform cloud docs agents changelog 1 7 0 03 02 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can use HCP Terraform s native OpenID Connect integration with Azure to get  dynamic credentials   terraform cloud docs workspaces dynamic provider credentials  for the AzureRM or Microsoft Entra ID providers in your HCP Terraform runs  Configuring the integration requires the following steps   1     Configure Azure   configure azure     Set up a trust configuration between Azure and HCP Terraform  Then  you must create Azure roles and policies for your HCP Terraform workspaces  2     Configure HCP Terraform   configure hcp terraform     Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials   Once you complete the setup  HCP Terraform automatically authenticates to Azure during each run  The Azure provider authentication is valid for the length of the plan or apply        Warning    Dynamic credentials with the Azure providers do not  work when your Terraform Enterprise instance uses a custom or self signed certificate  This limitation is due to restrictions in Azure      Configure Azure You must enable and configure an application and service principal with accompanying federated credentials and permissions on Azure  These instructions use the Azure portal  but you can also use Terraform to configure Azure  Refer to our  example Terraform configuration  https   github com hashicorp terraform dynamic credentials setup examples tree main azure       Create an Application and Service Principal Follow the steps mentioned in the AzureRM provider docs here   Creating the Application and Service Principal  https   registry terraform io providers hashicorp azurerm latest docs guides service principal oidc creating the application and service principal    As mentioned in the documentation it will be important to make note of the  client id  for the application as you will use this later for authentication        Note    you will want to skip the   Configure Microsoft Entra ID Application to Trust a GitHub Repository   section as this does not apply here       Grant the Application Access to Manage Resources in Your Azure Subscription You must now give the created Application permission to modify resources within your Subscription   Follow the steps mentioned in the AzureRM provider docs here   Granting the Application access to manage resources in your Azure Subscription  https   registry terraform io providers hashicorp azurerm latest docs guides service principal oidc granting the application access to manage resources in your azure subscription        Configure Microsoft Entra ID Application to Trust a Generic Issuer Finally  you must create federated identity credentials which validate the contents of the token sent to Azure from HCP Terraform   Follow the steps mentioned in the AzureRM provider docs here   Configure Azure Microsoft Entra ID Application to Trust a Generic Issuer  https   registry terraform io providers hashicorp azurerm latest docs guides service principal oidc configure azure active directory application to trust a generic issuer    The following information should be specified      Federated credential scenario    Must be set to  Other issuer       Issuer    The address of HCP Terraform  e g   https   app terraform io           Important    make sure this value starts with   https      and does  not  have a trailing slash      Subject identifier    The subject identifier from HCP Terraform that this credential will match  This will be in the form  organization my org name project my project name workspace my workspace name run phase plan  where the  run phase  can be one of  plan  or  apply       Name    A name for the federated credential  such as  tfc plan credential   Note that this cannot be changed later   The following is optional  but may be desired      Audience    Enter the audience value that will be set when requesting the identity token  This will be  api   AzureADTokenExchange  by default  This should be set to the value of  TFC AZURE WORKLOAD IDENTITY AUDIENCE  if this has been configured        Note    because the  Subject identifier  for federated credentials is a direct string match  two federated identity credentials need to be created for each workspace using dynamic credentials  one that matches  run phase plan  and one that matches  run phase apply       Configure HCP Terraform You ll need to set some environment variables in your HCP Terraform workspace in order to configure HCP Terraform to authenticate with Azure using dynamic credentials  You can set these as workspace variables  When you configure dynamic provider credentials with multiple provider configurations of the same type  use either a default variable or a tagged alias variable name for each provider configuration  Refer to  Specifying Multiple Configurations   specifying multiple configurations  for more details      Required Environment Variables    Variable                                                                                Value                                                                                Notes                                                                                TFC AZURE PROVIDER AUTH  br    TFC AZURE PROVIDER AUTH  TAG   br     Default variable not supported      true                                                                                Requires   v1 7 0   or later if self managing agents  Must be present and set to  true   or HCP Terraform will not attempt to authenticate to Azure                                                                                TFC AZURE RUN CLIENT ID  br    TFC AZURE RUN CLIENT ID  TAG   br    TFC DEFAULT AZURE RUN CLIENT ID     The client ID for the Service Principal   Application used when authenticating to Azure    Requires   v1 7 0   or later if self managing agents  Optional if  TFC AZURE PLAN CLIENT ID  and  TFC AZURE APPLY CLIENT ID  are both provided  These variables are described  below   terraform cloud docs workspaces dynamic provider credentials azure configuration optional environment variables         Optional Environment Variables You may need to set these variables  depending on your use case     Variable                                                                                Value                                                                                Notes                                                                                TFC AZURE WORKLOAD IDENTITY AUDIENCE  br    TFC AZURE WORKLOAD IDENTITY AUDIENCE  TAG   br    TFC DEFAULT AZURE WORKLOAD IDENTITY AUDIENCE    Will be used as the  aud  claim for the identity token  Defaults to  api   AzureADTokenExchange     Requires   v1 7 0   or later if self managing agents                                                                                TFC AZURE PLAN CLIENT ID  br    TFC AZURE PLAN CLIENT ID  TAG   br    TFC DEFAULT AZURE PLAN CLIENT ID                                        The client ID for the Service Principal   Application to use for the plan phase of a run            Requires   v1 7 0   or later if self managing agents  Will fall back to the value of  TFC AZURE RUN CLIENT ID  if not provided       TFC AZURE APPLY CLIENT ID  br    TFC AZURE APPLY CLIENT ID  TAG   br    TFC DEFAULT AZURE APPLY CLIENT ID                                     The client ID for the Service Principal   Application to use for the apply phase of a run           Requires   v1 7 0   or later if self managing agents  Will fall back to the value of  TFC AZURE RUN CLIENT ID  if not provided        Configure the AzureRM or Microsoft Entra ID Provider Make sure that you re passing values for the  subscription id  and  tenant id  arguments into the provider configuration block or setting the  ARM SUBSCRIPTION ID  and  ARM TENANT ID  variables in your workspace   Make sure that you re  not  setting values for  client id    use oidc   or  oidc token  in the provider or setting any of  ARM CLIENT ID    ARM USE OIDC    ARM OIDC TOKEN        Specifying Multiple Configurations       Important    Ensure you are using version   3 60 0   or later of the   AzureRM provider   and version   2 43 0   or later of the   Microsoft Entra ID provider   as required functionality was introduced in these provider versions        Important    If you are self hosting  HCP Terraform agents   terraform cloud docs agents   ensure your agents use  v1 12 0   terraform cloud docs agents changelog 1 12 0 07 26 2023  or above  To use the latest dynamic credentials features   upgrade your agents to the latest version   terraform cloud docs agents changelog    You can add additional variables to handle multiple distinct Azure setups  enabling you to use multiple  provider aliases   terraform language providers configuration alias multiple provider configurations  within the same workspace  You can configure each set of credentials independently  or use default values by configuring the variables prefixed with  TFC DEFAULT     For more details  see  Specifying Multiple Configurations   terraform cloud docs workspaces dynamic provider credentials specifying multiple configurations         Required Terraform Variable  To use additional configurations  add the following code to your Terraform configuration  This lets HCP Terraform supply variable values that you can then use to map authentication and configuration details to the correct provider blocks      hcl variable  tfc azure dynamic credentials      description    Object containing Azure dynamic credentials configuration    type   object       default   object         client id file path   string       oidc token file path   string            aliases   map object         client id file path   string       oidc token file path   string                          Example Usage        AzureRM Provider     hcl provider  azurerm      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                false      use oidc must be explicitly set to true when using multiple configurations    use oidc               true   client id file path    var tfc azure dynamic credentials default client id file path   oidc token file path   var tfc azure dynamic credentials default oidc token file path   subscription id         00000000 0000 0000 0000 000000000000    tenant id               10000000 0000 0000 0000 000000000000     provider  azurerm      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                false      use oidc must be explicitly set to true when using multiple configurations    use oidc               true   alias                   ALIAS1    client id file path    var tfc azure dynamic credentials aliases  ALIAS1   client id file path   oidc token file path   var tfc azure dynamic credentials aliases  ALIAS1   oidc token file path   subscription id         00000000 0000 0000 0000 000000000000    tenant id               20000000 0000 0000 0000 000000000000               Microsoft Entra ID Provider  formerly Azure AD      hcl provider  azuread      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                false      use oidc must be explicitly set to true when using multiple configurations    use oidc               true   client id file path    var tfc azure dynamic credentials default client id file path   oidc token file path   var tfc azure dynamic credentials default oidc token file path   subscription id         00000000 0000 0000 0000 000000000000    tenant id               10000000 0000 0000 0000 000000000000     provider  azuread      features         use cli should be set to false to yield more accurate error messages on auth failure    use cli                false      use oidc must be explicitly set to true when using multiple configurations    use oidc               true   alias                   ALIAS1    client id file path    var tfc azure dynamic credentials aliases  ALIAS1   client id file path   oidc token file path   var tfc azure dynamic credentials aliases  ALIAS1   oidc token file path   subscription id         00000000 0000 0000 0000 000000000000    tenant id               20000000 0000 0000 0000 000000000000