How do I pass GCP Service Account key.json contents into Terraform Cloud without committing it in VCS?

Question

According to the Google Provider documentation, the service account key should be supplied to Terraform using the environment variable GOOGLE_CLOUD_KEYFILE_JSON. When using Terraform Cloud, this is an issue for me as it means storing the service account key in the repository and using the environment variable to set the path to the key file.

I would like to pass the service account key contents to the provider using either a Terraform variable or an environment variable but I haven't been able to locate the documentation for this. How do I go about this?

Answer 1

It's been a while since it set it up, but you can set the whole content of the file to be an environment variable GOOGLE_CLOUD_KEYFILE_JSON and it works. Make sure you set it as sensitive. You have to take all the new lines out of the file to make it work.

Answer 2

var.ACCOUNT_JSON is path to account json file, which you can leave outside git repository.

variable "ACCOUNT_JSON" {}
variable "PROJECT_ID" {}


provider "google" {
  credentials = file(var.ACCOUNT_JSON)
  project     = var.PROJECT_ID
}

You can perform export TF_VAR_ACCOUNT_JSON=../accoutn.json, in this case this command wouldn't be stored in history, and ACCOUTN_JSON will be available for you to be used in terraform.