BeyondTrust Terraform Provider

The BeyondTrust Terraform Provider allows Terraform to manage resources across multiple BeyondTrust products using infrastructure-as-code.

This unified provider consolidates management of BeyondTrust services, enabling seamless integration of security and access management into your Terraform workflows.

Supported Products

Workload Credentials

Manage secrets, dynamic credentials, AWS integrations, and Azure integrations for BeyondTrust Workload Credentials.

Resources

• beyondtrust_workload_credentials_folder - Organize secrets in hierarchical folders.
• beyondtrust_workload_credentials_static_secret - Manage static secrets (write-only).
• beyondtrust_workload_credentials_aws_integration - Configure AWS integrations.
• beyondtrust_workload_credentials_aws_dynamic_secret - Provision dynamic AWS credentials.
• beyondtrust_workload_credentials_azure_integration - Configure Azure integrations.
• beyondtrust_workload_credentials_azure_dynamic_secret - Provision dynamic Azure credentials.

Ephemeral resources

• beyondtrust_workload_credentials_static_secret - Read secrets without persisting values to Terraform state.

Data sources

• beyondtrust_workload_credentials_aws_integration - Query AWS integration details.
• beyondtrust_workload_credentials_azure_integration - Query Azure integration details.

For detailed Workload Credentials documentation, examples, and setup instructions, see workload_credentials/README.md.

Additional Products

Support for additional BeyondTrust products will be added in future releases.

Requirements

• Terraform 1.11 or later
• Go 1.26 or later (development only)
• Access to one or more BeyondTrust products with API access

Note: Some resources use ephemeral resources and write-only attributes for secure secret handling, which require Terraform 1.11 or later. These features ensure sensitive values are never persisted in state or plan files. See Terraform Version Requirements for details.

Quick Start

Install the provider

terraform {
  required_providers {
    beyondtrust = {
      source  = "beyondtrust/beyondtrust"
      version = "~> 1.0"
    }
  }
}

Configure authentication

Configure authentication using environment variables:

export BEYONDTRUST_ACCESS_TOKEN="your-access-token"
export BEYONDTRUST_SITE_ID="your-site-id"

Create resources

Use the provider in your Terraform configuration:

provider "beyondtrust" {
  # Configuration will be read from environment variables:
  # - BEYONDTRUST_ACCESS_TOKEN
  # - BEYONDTRUST_SITE_ID
}

Example Usage

The following example creates a folder, stores a secret, retrieves it through an ephemeral resource, and uses the value in another Terraform resource.

# Create a folder for organizing secrets
resource "beyondtrust_workload_credentials_folder" "production" {
  name = "production"
}

# Store a static secret (write-only)
resource "beyondtrust_workload_credentials_static_secret" "api_key" {
  name   = "api-key"
  folder = beyondtrust_workload_credentials_folder.production.path
  secret_wo = {
    key = "secret-api-key-value"
  }
  tags = {
    environment = "production"
    managed_by  = "terraform"
  }
}

# Read secret value securely (ephemeral - never stored in state)
ephemeral "beyondtrust_workload_credentials_static_secret" "api_key" {
  name   = "api-key"
  folder = "production"
}

# Use the secret in another resource
resource "kubernetes_secret" "api_credentials" {
  metadata {
    name = "api-credentials"
  }
  data = {
    api_key = ephemeral.beyondtrust_workload_credentials_static_secret.api_key.secret["key"]
  }
}

For more examples, see the examples directory.

Documentation

Product Documentation

• Workload Credentials - Secrets management and dynamic credentials
• More products coming soon...

Provider Documentation

• Terraform Registry Docs - Complete resource documentation
• Quick Start Guide - Get started quickly
• Terraform Version Requirements - Version compatibility information

Development Documentation

• Development Guide - Local development setup and workflow
• Architecture Overview - Provider architecture and design
• Testing Guide - Running tests
• Contributing Guidelines - How to contribute

Development

Developer Quick Start

Before committing or pushing code, run local checks:

make pre-commit        # Full checks
make pre-commit-quick  # Fast checks
make ci-local          # CI simulation

Install git hook for automatic checks (optional):

make install-git-hooks

Building the Provider

make build

Testing

Acceptance tests require access to supported BeyondTrust products and appropriate API credentials.

# Run unit tests
make test-unit

# Run acceptance tests (requires access to BeyondTrust products)
make test-acc

For more details, see DEVELOPMENT.md.

Getting Help

For assistance or to report issues:

• Review the Documentation
• Check existing issues
• Contact BeyondTrust Support

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Security

For security vulnerabilities, please see our Security Policy.

Support

See SUPPORT.md for support information.

License

Copyright (c) BeyondTrust. All rights reserved.

See LICENSE for license information.