> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use 1Password to securely authenticate Terraform

export const BetaBadge = ({content}) => {
  if (content) {
    return <span className="op-beta-badge-inline not-prose">
        <span className="op-status-badge">Beta</span>
      </span>;
  }
  return <>
      <style>
        {`
        .mdx-content {
          margin-top: 4px !important;
        }
      `}
      </style>
      <span className="op-status-badge not-prose">Beta</span>
    </>;
};

export const Gethelp = ({command, img, name}) => {
  return <>
      <h3>Inspect your configuration</h3>

      <p>To inspect your current {name} configuration:</p>

      <CodeBlock language="shell" children={`op plugin inspect ${command}`} />

      <p>
        1Password CLI will return a list of the credentials you've configured to use with {name} and their default
        scopes, as well as a list of aliases configured for {name}.
      </p>

      <>
        {img && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img} alt="A terminal window showing the results of the command op plugin inspect." width="900" />
            </Frame>
          </div>}
      </>

      <h3>Clear your credentials</h3>

      <p>To reset the credentials used with {name}:</p>

      <CodeBlock language="shell" children={`op plugin clear ${command}`} />

      <p>You can clear one configuration at a time, in this order of precedence:</p>

      <ol>
        <li>Terminal session default</li>
        <li>
          Directory default, from the current directory to <code>$HOME</code>
        </li>
        <li>Global default</li>
      </ol>

      <p>
        For example, if you're in the directory <code>$HOME/projects/awesomeProject</code> and you have a terminal
        session default, directory defaults for <code>$HOME</code> and <code>$HOME/projects/awesomeProject</code>, and a
        global default credential configured, you would need to run <code>op plugin clear {command}</code> four times to
        clear all of your defaults.
      </p>

      <p>
        To clear your global default credentials, terminal session default, and the defaults for your current directory
        at the same time, run <code>op plugin clear {command} --all</code>.
      </p>
    </>;
};

export const Step3 = ({img, name}) => {
  const fixImgSrc = src => {
    if (!src.startsWith("/")) {
      return "/" + src;
    }
    return src;
  };
  return <>
      <p>
        The next time you enter a command with {name}, you'll be prompted to authenticate with biometrics or system
        authentication.
      </p>

      <>
        {img && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img} alt="A CLI being authenticated using 1Password CLI biometric unlock." width="900" />
            </Frame>
          </div>}
      </>
    </>;
};

export const Step1 = ({command, img1, img2, img3, img4, name}) => {
  return <>
      <p>To get started with the {name} shell plugin:</p>

      <ol>
        <li>
          Sign in to the 1Password account you want to use with the {name} plugin:{" "}
          <CodeBlock language="shell" children={`op signin`} />
        </li>
        <li>If you only want to configure the plugin in a specific directory, change to that directory.</li>
        <li>
          Run the command to set up the plugin:
          <CodeBlock language="shell" children={`op plugin init ${command}`} />
        </li>
      </ol>

      <p>
        You'll be prompted to import your {name} credentials into 1Password or select an existing 1Password item where
        your credentials are saved, then configure when the credentials should be used.
      </p>

      <>
        {img1 && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img1} alt="A terminal window displaying the op plugin init command and options to import or select an item." width="900" />
            </Frame>
          </div>}
      </>

      <h3>Step 1.1: Import or select an item</h3>

      <h4>Import a new item</h4>

      <p>
        If you haven't saved your {name} credentials in 1Password yet, select <strong>Import into 1Password</strong>.
        Enter your credentials, choose a name for the new 1Password item, and select the vault where you want to save
        it.
      </p>

      <p>
        If 1Password detects your credentials in your local development environment, you'll be prompted to import them
        automatically.
      </p>

      <>
        {img2 && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img2} alt="A terminal window showing the fields available to import an item, including the token, item name, and vault." width="900" />
            </Frame>
          </div>}
      </>

      <h4>Select an existing item</h4>

      <p>
        If you've already saved your {name} credentials in 1Password, select <strong>Search in 1Password</strong>.
      </p>

      <p>
        You'll see a list of related items and the vaults where they're saved. If you don't see your credentials, select{" "}
        <strong>Expand search</strong> to browse all items in your account.
      </p>

      <>
        {img3 && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img3} alt="A terminal window showing the option to search for an existing item in your 1Password account." width="900" />
            </Frame>
          </div>}
      </>

      <h3>Step 1.2: Set default credential scope</h3>

      <p>
        After you select or import your credentials, you'll be prompted to configure when to use the item to
        authenticate {name}.
      </p>

      <>
        {img4 && <div style={{
    textAlign: "center"
  }}>
            <Frame>
              <img src={img4} alt="A terminal window showing the options for configuring when the credentials should be used." width="900" />
            </Frame>
          </div>}
      </>

      <ul>
        <li>
          <strong>"Prompt me for each new terminal session"</strong> will only configure the credentials for the
          duration of the current terminal session. Once you exit the terminal, the default will be removed.
        </li>
        <li>
          <strong>"Use automatically when in this directory or subdirectories"</strong> will make the credentials the
          default in the current directory and all of its subdirectories, as long as no other directory-specific
          defaults are set in them. A terminal-session default takes precedence over a directory-specific one.
        </li>
        <li>
          <strong>"Use as global default on my system"</strong> will set the credentials as the default in all terminal
          sessions and directories. A directory-specific default takes precedence over a global one.
        </li>
      </ul>
    </>;
};

<BetaBadge />

The Terraform shell plugin allows you to use 1Password to securely authenticate [Terraform CLI <Icon icon="arrow-up-right-from-square" />](https://developer.hashicorp.com/terraform/cli) to supported providers with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext.

You can configure the Terraform plugin to authenticate with biometrics to any provider in the [1Password Shell Plugin ecosystem](/cli/shell-plugins#get-started), like AWS, ngrok, and Databricks.

<Frame>
  <video loop autoPlay muted playsInline>
    <source type="video/mp4" src="https://mintcdn.com/ab-634991b8/yLiqBEtqTkyfVbLw/static/videos/terraform.mp4?fit=max&auto=format&n=yLiqBEtqTkyfVbLw&q=85&s=31b8bcab25564367e21ef8fd51b3b4aa" data-path="static/videos/terraform.mp4" />

    <source type="video/webm" src="https://mintcdn.com/ab-634991b8/yLiqBEtqTkyfVbLw/static/videos/terraform.webm?fit=max&auto=format&n=yLiqBEtqTkyfVbLw&q=85&s=bb2d105621e6bf760fb70b2a43ff11b7" data-path="static/videos/terraform.webm" />
  </video>
</Frame>

<Tip>
  The Terraform shell plugin is currently in beta. It can only be used with the latest [beta build](https://app-updates.agilebits.com/product_history/CLI2#beta) of 1Password CLI, version `2.19.0-beta.01` or later.
</Tip>

## Requirements

1. [Sign up for 1Password.](https://1password.com/pricing/password-manager)
2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux).
3. Install [the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta) (`2.19.0-beta.01` or later).
4. [Integrate 1Password CLI with the 1Password app](/cli/app-integration#step-1-turn-on-the-app-integration).
5. Install [Terraform CLI <Icon icon="arrow-up-right-from-square" />](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli).

The following shells are supported:

* Bash
* Zsh
* fish

## Step 1: Configure your default credentials

<Tip>
  If you have multiple 1Password accounts, run <code>op signin</code> to select the account you want to use before configuring the plugin. When you use the plugin, 1Password CLI will automatically switch to that account.
</Tip>

To get started with the Terraform shell plugin, run:

```shell theme={null}
op plugin init terraform
```

You'll be prompted to select the credential types you want to use with Terraform  — you can choose as many as you want. Select the credential type for [a supported provider](/cli/shell-plugins#get-started), then you can either [import the credential](#import-a-new-item) into your 1Password account or [select an existing 1Password item](#select-an-existing-item) where the credential is saved.

When you've configured all the credentials you want to use with Terraform, select **Stop choosing credentials**.

<Frame>
  <video controls muted playsInline>
    <source type="video/mp4" src="https://mintcdn.com/ab-634991b8/yLiqBEtqTkyfVbLw/static/videos/terraform2.mp4?fit=max&auto=format&n=yLiqBEtqTkyfVbLw&q=85&s=443dccd6e1ff9d0af97eff28f52c6e12" data-path="static/videos/terraform2.mp4" />

    <source type="video/webm" src="https://mintcdn.com/ab-634991b8/yLiqBEtqTkyfVbLw/static/videos/terraform2.webm?fit=max&auto=format&n=yLiqBEtqTkyfVbLw&q=85&s=6230cb3a861b4a831831e848bdd8a37d" data-path="static/videos/terraform2.webm" />
  </video>
</Frame>

<h3>Step 1.1: Import or select an item</h3>

#### Import a new item

If you haven't saved a credential in 1Password yet, select **Import into 1Password**. Enter a name for the new 1Password item and select the vault where you want to save it.

If 1Password detects the credential in your local development environment, you'll be prompted to import it automatically.

#### Select an existing item

If you've already saved a credential in 1Password, select **Search in 1Password**. Select the item from the list of suggested items. If you don't see the item you want, select **Expand search** to browse all items in your account.

<h3>Step 1.2: Set default credential scope</h3>

After you finish selecting your credentials, you'll be prompted to configure when to use them.

* **Prompt me for each new terminal session** will only configure the credentials for the duration of the current terminal session. Once you exit the terminal, the defaults will be removed.
* **Use automatically when in this directory or subdirectories** will make the credentials the default in the current directory and all of its subdirectories, as long as no other directory-specific defaults are set in them. A terminal-session default takes precedence over a directory-specific one.
* **Use as global default on my system** will set the credentials as the defaults in all terminal sessions and directories. A directory-specific default takes precedence over a global one.

## Step 2: Source the plugins.sh file

To make the plugin available, source your <code>plugins.sh</code> file. For example:

```shell theme={null}
source ~/.config/op/plugins.sh
```

The file path for your `op` folder may vary depending on your <a href="/cli/config-directories">configuration directory</a>. `op plugin init` will output a source command with the correct file path.

If this is your first time installing a shell plugin, you'll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

<CodeGroup>
  <CodeBlock filename="Bash" language="shell" children={`echo "source ~/.config/op/plugins.sh" >> ~/.bashrc && source ~/.bashrc`} />

  <CodeBlock filename="Zsh" language="shell" children={`echo "source ~/.config/op/plugins.sh" >> ~/.zshrc && source ~/.zshrc`} />

  <CodeBlock filename="fish" language="shell" children={`echo "source ~/.config/op/plugins.sh" >> ~/.config/fish/config.fish && source ~/.config/fish/config.fish`} />
</CodeGroup>

## Step 3: Use the CLI

The next time you use Terraform CLI with one of the providers you configured credentials for, you'll be prompted to authenticate with biometrics or system authentication.

<Frame>
  <img alt="The terraform plan command being authenticated to AWS with Touch ID." src="https://mintcdn.com/ab-634991b8/DMnym2BeeklqeCzz/static/img/shell-plugins/terraform-5.png?fit=max&auto=format&n=DMnym2BeeklqeCzz&q=85&s=a7dfe6b3215d452c2dd7fd86192933e1" width="900" data-path="static/img/shell-plugins/terraform-5.png" />
</Frame>

## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk, like in your [provider configurations <Icon icon="arrow-up-right-from-square" />](https://developer.hashicorp.com/terraform/language/providers/configuration).

## Next steps

<p>1Password Shell Plugins support <a href="/cli/shell-plugins/#get-started">more than 60 third-party CLIs</a>. To see a list of supported CLIs:</p>

<CodeBlock language="shell" children={`op plugin list`} />

<p>To choose another plugin to get started with:</p>

<CodeBlock language="shell" children={`op plugin init`} />

<p>To use shell plugins for seamless context switching, learn how to configure a plugin in <a href="/cli/shell-plugins/environments/">multiple environments</a> or with <a href="/cli/shell-plugins/multiple-accounts/">multiple accounts.</a></p>

## Get help

<h3>Inspect your configuration</h3>

To inspect your current Terraform configuration:

```shell theme={null}
op plugin inspect terraform
```

1Password CLI will return a list of the credentials you've configured
to use with Terraform and their default scope, as well as a list of
aliases configured for Terraform CLI.

<Frame>
  <img alt="1Password CLI inspecting a Terraform shell plugin with AWS and ngrok credentials configured as global defaults." src="https://mintcdn.com/ab-634991b8/DMnym2BeeklqeCzz/static/img/shell-plugins/terraform-6.png?fit=max&auto=format&n=DMnym2BeeklqeCzz&q=85&s=49dd9014f8aa1f6af7ba73b6786a702c" width="900" data-path="static/img/shell-plugins/terraform-6.png" />
</Frame>

<h3>Clear your credentials</h3>

To reset the credentials used with Terraform CLI:

```shell theme={null}
op plugin clear terraform
```

You can clear one configuration at a time, in this order of precedence:

1. Terminal session default
2. Directory default, from the current directory to <code>\$HOME</code>
3. Global default

For example, if you're in the directory <code>\$HOME/projects/awesomeProject</code> and you have a terminal session default, directory defaults for <code>\$HOME</code> and <code>\$HOME/projects/awesomeProject</code>, and a global default credential configured, you would need to run <code>op plugin clear terraform</code> four times to clear all of your defaults.

To clear your global default credentials, terminal session default, and the defaults for your current directory at the same time, run <code>op plugin clear terraform --all</code>.

## Reference

1Password authenticates to Terraform providers by provisioning the credentials required by the plugin commands directly from your 1Password account.

If you saved your provider credentials manually rather than using `op plugin` to import a new item, you might be prompted to rename your item's fields to match the item structure required by the credential schema.