SOPS Terraform Provider

A Terraform provider for sops providing functions to decrypt SOPS-encrypted files and strings. This provider is heavily inspired by carlpett/terraform-provider-sops but does not rely on data sources and instead uses provider functions.

Warning

Provider functions do not store decrypted data independently. However, Terraform stores function results in state when they are assigned to outputs, resource attributes, or other state-backed values. Marking a value as sensitive only redacts it from normal output; it does not prevent the plaintext from being stored in state. Protect access to Terraform state accordingly.

Requirements

As provider functions are a fairly new feature in Terraform, you will need to be using Terraform v1.8 or later.

Usage

This provider contains two provider functions:

• file - Decrypts a local file using SOPS
• string - Decrypts a string using SOPS, useful if the secret is not stored in a local file

To make use of the provider, you will need to add the provider to your Terraform configuration:

terraform {
  required_providers {
    sops = {
      source = "nobbs/sops"
      version = "~> 0.1.0"
    }
  }
}

# The provider has no configuration options
provider "sops" {}

Examples

See the examples directory for more examples.

Once the provider is configured, you can use the provider functions in your Terraform configuration as follows:

output "basic-json" {
  value = provider::sops::file("./test/fixtures/basic.sops.json")
}

# Output:
# basic-json = {
#   "data" = {
#     "abc" = "xyz"
#     "floats" = 0.000000000314
#     "integers" = 123
#     "truthy" = true
#   }
#   "raw" = <<-EOT
#   {
#   	"abc": "xyz",
#   	"integers": 123,
#   	"truthy": true,
#   	"floats": 3.14e-10
#   }
#   EOT
# }

Or using the string function:

data "http" "raw" {
  url = "https://raw.githubusercontent.com/nobbs/terraform-provider-sops/refs/heads/main/test/fixtures/raw.sops.txt"
}

output "raw" {
  value = provider::sops::string(data.http.raw.response_body)
}

# Output:
# raw = {
#   "data" = null
#   "raw" = <<-EOT
#   Lorem ipsum dolor sit amet, consectetur adipiscing elit.
#
#   EOT
# }