terraform-provider-sops

When using sops_file, you can access nested data in two ways:

1. Via the data map: Use dot-separated strings as keys to reach nested values. For example, if your JSON has a db object with a password field, access it using data["db.password"].
2. Via the raw string: Use Terraform's jsondecode() function on the raw attribute to convert the decrypted content into a Terraform object, then use standard object notation (e.g., jsondecode(data.sops_file.name.raw).db.password).

output "mapped_nested_value" {
  value = data.sops_file.demo_secret.data["db.password"]
}

output "nested_json_value" {
  value = jsondecode(data.sops_file.demo_secret.raw).db.password
}

Download the appropriate release for your environment from the GitHub releases page and unpack it into your system's user plugin directory.

Plugin Directory Locations:

• Windows: %APPDATA%\terraform.d\plugins
• All other systems (Linux/macOS): ~/.terraform.d/plugins

The sops_external ephemeral resource allows you to read and decrypt data from a SOPS-encrypted string that is not stored in a local file. This is particularly useful when encrypted data is fetched from a remote source (like an HTTP endpoint) or provided via another resource's output.

To use it, provide the encrypted string to the source argument and specify the format of the underlying unencrypted data using input_type.

data "http" "remote_sops_data" {
  url = "https://sops.example/my-data"
}

ephemeral "sops_external" "demo_secret" {
  source     = data.http.remote_sops_data.body
  input_type = "yaml"
}

output "root_value_hello" {
  value = ephemeral.sops_external.demo_secret.data.hello
}

If you are upgrading from an older version of the SOPS provider that used legacy data source blocks, you must replace the old provider in your state to avoid errors.

Run the following command to transition from the legacy provider to the registry-based provider:

terraform state replace-provider registry.terraform.io/-/sops registry.terraform.io/carlpett/sops

If you are migrating a state from Terraform 0.12 or older, you must update how the provider is referenced in your state file. Use the terraform state replace-provider command to transition from the legacy registry to the current one.

terraform state replace-provider registry.terraform.io/-/sops registry.terraform.io/carlpett/sops

The sops provider allows you to use files encrypted with SOPS within your Terraform configuration.

Security Warning: To prevent plaintext secrets from being written to disk, you must use a secure remote state backend. Refer to the official Terraform documentation on Sensitive Data in State for guidance.

To use the provider, declare the sops provider and use the sops_file data source to load an encrypted file.

provider "sops" {}

data "sops_file" "demo_secret" {
  source_file = "demo-secret.enc.json"
}

The repository contains example Terraform files used for documentation and manual testing. If you are looking for specific implementation patterns, look in the following directory structures:

• Provider examples: Located in provider/provider.tf.
• Data source examples: Located in data-sources/[full-data-source-name]/data-source.tf.
• Resource examples: Located in resources/[full-resource-name]/resource.tf.

For Terraform 0.13 and later, install the provider by specifying the source and version in a required_providers block within your Terraform configuration.

terraform {
  required_providers {
    sops = {
      source = "carlpett/sops"
      version = "~> 0.5"
    }
  }
}

The sops_external data source allows you to decrypt SOPS-encrypted strings that are not stored in local files. This is particularly useful when your encrypted data is fetched from a remote URL or provided via another data source.

To use it, provide the encrypted string to the source argument and specify the format of the unencrypted content using input_type (e.g., yaml, json, dotenv, ini, or raw). The decrypted content is then accessible via the data map.

data "http" "remote_sops_data" {
  url = "https://sops.example/my-data"
}

data "sops_external" "demo_secret" {
  source     = data.http.remote_sops_data.body
  input_type = "yaml"
}

output "root-value-hello" {
  value = data.sops_external.demo_secret.data.hello
}