Nevaberry Nevaberry Plugins Terraform Knowledge Patch

Terraform / OpenTofu Knowledge Patch

Covers Terraform 1.8–1.15 and OpenTofu 1.7–1.12 (April 2024 – March 2026). Baseline knowledge: Terraform 1.7, OpenTofu 1.6.

Index

Quick Reference — What's New

Ephemeral Values (TF 1.10+, OT 1.11) — Most Important Change

New value category never persisted to plan or state. Three constructs:

Reference via ephemeral.<type>.<name>.<attribute>.

Ephemeral resources have an open/renew/close lifecycle — they run during every plan and apply, never persisted between runs. If an input references an unknown value, execution defers to apply.

Critical pattern — secrets in provider config:

ephemeral "aws_secretsmanager_secret_version" "db_master" {
  secret_id = data.aws_db_instance.example.master_user_secret[0].secret_arn
}

locals {
  credentials = jsondecode(ephemeral.aws_secretsmanager_secret_version.db_master.secret_string)
}

provider "postgresql" {
  host     = data.aws_db_instance.example.address
  password = local.credentials["password"]
}

Write-Only Arguments (TF 1.11+, OT 1.11)

Resource attributes that accept ephemeral values and are never stored in state. Paired with a _wo_version argument to control updates.

resource "aws_db_instance" "main" {
  # ...
  password_wo         = ephemeral.random_password.db.result
  password_wo_version = 1  # Increment to trigger password rotation
}

Common write-only attributes:

See references/ephemeral-values.md for full examples.

Cross-Object Variable Validation (TF 1.9)

Validation blocks can now reference other variables, data sources, and locals — not just the variable itself:

variable "cluster_endpoint" {
  type    = string
  default = ""

  validation {
    condition     = var.create_cluster == false ? length(var.cluster_endpoint) > 0 : true
    error_message = "cluster_endpoint required when create_cluster is false."
  }
}

See references/variable-validation.md for details.

templatestring Function (TF 1.9)

Renders a template from a string value (not a file). Useful for templates from data sources:

locals {
  rendered = templatestring(data.http.template.response_body, {
    APP_NAME = var.app_name
    PORT     = var.port
  })
}

Resource Identity for Import (TF 1.12)

Import blocks now support structured identity attributes instead of opaque ID strings:

import {
  to = aws_instance.example
  identity = {
    id = "i-1234567890abcdef0"
  }
}

See references/import-identity.md for details.

Terraform Stacks (HCP Terraform, GA Sep 2025)

Component-based multi-environment deployments using new file types. Requires HCP Terraform.

# main.tfcomponent.hcl
component "networking" {
  source = "./modules/networking"
  inputs = { region = var.region, cidr = var.cidr }
}

component "cluster" {
  source = "./modules/k8s"
  inputs = { vpc_id = component.networking.vpc_id }
}

# deploy.tfdeploy.hcl
deployment "us-east" {
  inputs = { region = "us-east-1", cidr = "10.0.0.0/16" }
}
deployment "eu-west" {
  inputs = { region = "eu-west-1", cidr = "10.1.0.0/16" }
}

Limits: 20 deployments, 100 components, 10k resources per stack. See references/stacks.md.

Terraform Actions (TF 1.14, Preview)

Day 2 operations defined by providers — triggered before/after resource CRUD or ad hoc via CLI. Codifies operational tasks (Lambda invocations, cache invalidations, Ansible playbooks) alongside infrastructure. See references/actions.md.

New Functions Quick Reference

See references/new-functions.md for examples.

OpenTofu Divergences

See references/opentofu.md for examples.

Source: Nevaberry/nevaberry-plugins — distributed by TomeVault.