Terraform

Overview

Use Terraform credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	terraform
Category	Developer Tools
Credential Type	Bearer Token

Step 1: Get Credentials

Log in to HCP Terraform

Log in to HCP Terraform at app.terraform.io.

Go to User Settings → Tokens

Go to User Settings → Tokens at app.terraform.io/app/settings/tokens.

Create an API token

Click ‘Create an API token’.

Copy your token

Copy the generated token.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Terraform

Go to Managed Secrets > Add Provider > Terraform.

Enter credentials

Paste your API Token into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://app.terraform.io/api/v2/organizations",
    grant_id="YOUR_GRANT_ID",
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
account/details	read	GET	/api/v2/account/details
applies/show	read	GET	/api/v2/applies/{apply_id}
organizations/list	read	GET	/api/v2/organizations
organizations/show	read	GET	/api/v2/organizations/{organization_name}
plans/show	read	GET	/api/v2/plans/{plan_id}
projects/create	write	POST	/api/v2/organizations/{organization_name}/projects
projects/list	read	GET	/api/v2/organizations/{organization_name}/projects
runs/create	write	POST	/api/v2/runs
runs/apply	write	POST	/api/v2/runs/{run_id}/actions/apply
runs/cancel	write	POST	/api/v2/runs/{run_id}/actions/cancel
runs/discard	write	POST	/api/v2/runs/{run_id}/actions/discard
runs/list	read	GET	/api/v2/workspaces/{workspace_id}/runs
runs/show	read	GET	/api/v2/runs/{run_id}
state-versions/current	read	GET	/api/v2/workspaces/{workspace_id}/current-state-version
state-versions/show	read	GET	/api/v2/state-versions/{state_version_id}
vars/create	write	POST	/api/v2/workspaces/{workspace_id}/vars
vars/delete	delete	DELETE	/api/v2/workspaces/{workspace_id}/vars/{variable_id}
vars/list	read	GET	/api/v2/workspaces/{workspace_id}/vars
vars/update	write	PATCH	/api/v2/workspaces/{workspace_id}/vars/{variable_id}
workspaces/create	write	POST	/api/v2/organizations/{organization_name}/workspaces
workspaces/delete	delete	DELETE	/api/v2/workspaces/{workspace_id}
workspaces/list	read	GET	/api/v2/organizations/{organization_name}/workspaces
workspaces/lock	write	POST	/api/v2/workspaces/{workspace_id}/actions/lock
workspaces/safe-delete	delete	POST	/api/v2/workspaces/{workspace_id}/actions/safe-delete
workspaces/show	read	GET	/api/v2/workspaces/{workspace_id}
workspaces/unlock	write	POST	/api/v2/workspaces/{workspace_id}/actions/unlock
workspaces/update	write	PATCH	/api/v2/workspaces/{workspace_id}