HCP Terraform workspace variables

Export secrets into one HCP Terraform workspace's variables.

Connection

What	This provider
Vendor	HashiCorp Terraform
Key	`hcp-terraform-vars`
Availability	`available`. You can connect it today.
Credential we hold	`hcp-terraform-token`
Values read back	no
Activation	`on-next-deploy`

Direction	What it does
`export`	We write names and values from your environment into the store.

HashiCorp Terraform returns no value once it holds one, so we can write here and cannot read back.

on-next-deploy. A new value waits there and arrives with your next deploy.

Direction	Policies you can pick
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

Paste a credential from the vendor. We seal it and never show it again.

Field	Label	Kind	Required	What it is
`token`	API token	secret; we mask it here and seal it	yes	A team token with Read and write variables. Not an organization token: an organization has only one valid token at a time, so another tool minting one silently kills this sync. Every token expires.

You answer these once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`workspaceId`	Workspace ID	text	yes	no	From the workspace's General Settings page. One workspace per sync.
`category`	Variable kind	choice	yes	yes	Environment variables reach the run's shell. A Terraform input your configuration does not declare is stored and then ignored. One of Environment variable, Terraform input variable. Starts at `env`.

We probe for these when we verify the connection.

Permission	Directions	Blocking	Without it
`account:read`	every direction	yes	We cannot confirm this token is live, or which account it acts as.
`workspace:read-variables`	`export`	yes	Export cannot enumerate existing variables, so it cannot update or prune safely.
`workspace:write-variables`	`export`	yes	Export cannot write anything.