runr_environment_secret (Resource)

A secret variable of one environment, over the project's of the same name (environment secrets). The value is write-only and pass-through: RunR writes it straight into the environment's Secret <workload>-secret-env in the region it runs in and keeps only its name, a version and a fingerprint; it reaches the workload with the environment's next deploy. Terraform keeps the value it set (value, sensitive); with value_wo (Terraform 1.11 and later) the state holds no value either — change value_wo_version to write a new one. A value changed (a new version) or removed outside Terraform is written again.

production's secret variables are the project's: use runr_env_var with secret = true. Needs env.edit on the project. Import with <project name or id>/<environment>/<NAME> (the value is not imported).

Example Usage#

# staging reads its own API_KEY; the other environments the project's.
resource "runr_environment_secret" "staging_api_key" {
  project_id  = runr_project.api.id
  environment = runr_environment.staging.name
  name        = "API_KEY"
  value       = var.staging_api_key
}

# Terraform 1.11 and later: value_wo never reaches the state; bump value_wo_version to write a
# new value.
resource "runr_environment_secret" "staging_signing_key" {
  project_id       = runr_project.api.id
  environment      = runr_environment.staging.name
  name             = "SIGNING_KEY"
  value_wo         = var.staging_signing_key
  value_wo_version = "2026-10"
}

variable "staging_api_key" {
  type      = string
  sensitive = true
}

variable "staging_signing_key" {
  type      = string
  sensitive = true
  ephemeral = true
}

Schema#

Required#

• environment (String) Environment name (runr_environment.<name>.name) or id. Changing it creates a new variable.
• name (String) Variable name. Changing it creates a new variable.
• project_id (String) Project id. Changing it creates a new variable.

Optional#

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• value (String, Sensitive) Value (sensitive). One of value and value_wo is required.
• value_wo (String, Sensitive, Write-only) Value that Terraform never stores (write-only attribute, Terraform 1.11 and later). Terraform cannot compare it, so change value_wo_version to write a new value.
• value_wo_version (String) Any string; a change writes value_wo again (for example a rotation date).

Read-Only#

• id (String) <project_id>/<environment>/<name>.
• version (Number) The value's version in RunR (each write adds one).

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <project name or id>/<environment>/<variable name>. The value is not imported (RunR never
# returns it): the next apply writes the value of the configuration.
terraform import runr_environment_secret.staging_api_key orders-api/staging/API_KEY