---
title: "Hashicorp Terraform Integration | Phase Changelog"
description: "Retrieve secrets in Phase directly from your Terraform configurations"
url: https://phase.dev/changelog/hashicorp-terraform/
---

[Changelog](https://phase.dev/changelog/)

2024.09.03

# Hashicorp Terraform Integration

Retrieve secrets in Phase directly from your Terraform configurations

[console](https://phase.dev/changelog/tag/console/)[integrations](https://phase.dev/changelog/tag/integrations/)[terraform](https://phase.dev/changelog/tag/terraform/)

We're excited to announce the release of the official Phase Terraform Provider. This integration allows you to securely retrieve secrets stored in Phase directly within your Terraform configurations, enabling seamless incorporation of secret management into your infrastructure-as-code workflows.

* * *

### Installation

Add the following Terraform block to your configuration:

```hcl
terraform {
  required_providers {
    phase = {
      source  = "phasehq/phase"
      version = "0.1.1"
    }
  }
}
```

### Configuration

Configure the provider using environment variables for sensitive information:

```hcl
provider "phase" {
  phase_token = "pss_service:v1:..." # or use PHASE_TOKEN env var
}
```

For self-hosted instances, specify the API host:

```hcl
provider "phase" {
  host        = "https://phase.example.io"
  phase_token = "pss_service:v1:..."
}
```

### Fetching Secrets

Use the `phase_secrets` data source to retrieve secrets:

```hcl
data "phase_secrets" "all" {
  env    = "development"
  app_id = "your-app-id"
  path   = ""
}

output "database_url" {
  value     = data.phase_secrets.all.secrets["DATABASE_URL"]
  sensitive = true
}
```

## Personal Secret Overrides

To access personal secret overrides, use a Personal Access Token (PAT) instead of a service token. The provider will automatically use overridden values when present.

## Usage Example

Here's how you might use fetched secrets in your Terraform resources:

```hcl
resource "some_resource" "example" {
  database_url = data.phase_secrets.all.secrets["DATABASE_URL"]
  api_key      = data.phase_secrets.all.secrets["API_KEY"]
}
```

The Phase Terraform Provider is now available on the [Terraform Registry](https://registry.terraform.io/providers/phasehq/phase). For detailed documentation and the latest updates, check out our [Docs](https://docs.phase.dev/integrations/platforms/hashicorp-terraform) & [GitHub repository](https://github.com/phasehq/terraform-provider-phase). As always, we welcome your feedback and contributions!

RoadmapCommunity-driven

Request a feature

We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us.

[Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md)

DeploymentSelf-hosted / Cloud

Get started

## Keep your secrets

Self-host or start on fully managed Cloud in under a minute.

Self-hosted

Run Phase on your own infrastructure. Free and open source.

AI agent deployment skill

[![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi)

[Self-hosting guide](https://docs.phase.dev/self-hosting)

Cloud

Fully managed. From signup to your first secret in 60 seconds.

Sign up with

[Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)