<p>I have the following terraform configuration in my terraform code</p>
<pre><code>data &quot;external&quot; &quot;region&quot; {
  program = [&quot;sh&quot;, &quot;test.sh&quot;]
  query = {
    aws_region = var.aws_region
    vault_url  = var.vault_url
    vault_role = var.vault_role
  }
}

provider &quot;vault&quot; {
  address = &quot;http://3.218.2.138:8200&quot;
  token   = data.external.region.result[&quot;vault_token&quot;]
}
</code></pre>
<p>The external Program runs a command vault login -method=aws role=test-role and then it returns a vault token.</p>
<p>Is there a way to avoid this external program and make the vault token to be generated whenever I execute  terraform apply and terraform show.</p>
<p>So basically Is there a method to avoild the external script from being executed and get the vault token without executing the external script.</p>

jyothi swarup
<p>A typical approach for this is to run <code>vault login</code> (or some other equivalent process) <em>before</em> running Terraform, and then have Terraform read those ambient credentials the same way that the Vault client itself would.</p>
<p>Although Terraform providers typically accept credentials as part of their configurations to allow for more complex cases, the ideal way to pass credentials to a Terraform provider is indirectly via whatever mechanism is standard for the system in question. For example, the Terraform AWS provider understands how to read credentials the same way as the <code>aws</code> CLI does, and the Vault provider looks for credentials in the same environment variables that the Vault CLI uses.</p>
<p>Teams that use centralized systems like Vault with Terraform will typically <a href="https://learn.hashicorp.com/tutorials/terraform/automate-terraform" rel="nofollow noreferrer">run Terraform in automation</a> so that the configuration for those can be centralized, rather than re-implemented for each user running locally. Your automation script can therefore obtain a temporary token from Vault prior to running Terraform and then explicitly revoke the token after Terraform returns, even if the Terraform operation itself fails.</p>
