How to fix Error: Ephemeral value not allowed in Terraform

TerraformINTERMEDIATEMEDIUMUpdated Dec 31, 2025· 168 views

Terraform restricts where ephemeral resource values can be used to prevent sensitive data from being stored in state files. This error occurs when you reference an ephemeral resource in a context that doesn't support ephemerality.

Quick fix

Fixes Error: Ephemeral value not allowed

output "secret_password" {
  value     = ephemeral.random_password.db.result
  sensitive = true
  ephemeral = true
}
  1. Identify where the ephemeral value is being used
  2. If using ephemeral in outputs, add ephemeral = true
  3. If passing to module variables, declare variable as ephemeral
  4. Use ephemeral values only in allowed contexts
terraform — error
output "secret_password" {
  value     = ephemeral.random_password.db.result
  sensitive = true
  ephemeral = true
}
Error: Ephemeral value not allowed

What this error means

Ephemeral resources (introduced in Terraform v1.10) are temporary resources designed to keep sensitive data out of state files. However, they can only be referenced in specific contexts. This error occurs when you try to use an ephemeral value outside these allowed contexts, such as in a managed resource argument, output without ephemeral declaration, or module input variable not declared as ephemeral. The constraint exists because Terraform's state file and plan file persistence mechanisms would compromise the security benefits of ephemeral resources.

Typical symptoms

  • Terraform plan fails with 'ephemeral value not allowed' error
  • Error occurs when trying to reference an ephemeral resource in an output
  • Error when passing ephemeral values to module input variables
  • Error when using ephemeral values in managed resource arguments
  • Configuration builds locally but fails during apply

Common causes

  1. Referencing an ephemeral resource in a managed resource block argument
  2. Using ephemeral values in an output block without declaring output as ephemeral
  3. Passing ephemeral values to child module variables not declared as ephemeral
  4. Attempting to store ephemeral values in local values that depend on resources
  5. Using ephemeral resources in contexts that require state persistence

How to fix "Error: Ephemeral value not allowed"

1Identify where the ephemeral value is being used

Run terraform plan and note the exact location of the error. Check whether it's in an output, variable assignment, or resource argument. The error message will indicate the invalid context.

2If using ephemeral in outputs, add ephemeral = true

Update your output block to declare it as ephemeral:

hcl
output "secret_password" {
  value     = ephemeral.random_password.db.result
  sensitive = true
  ephemeral = true
}
3If passing to module variables, declare variable as ephemeral

In the child module's variables.tf, add ephemeral = true to accept ephemeral values:

hcl
variable "master_password" {
  type      = string
  ephemeral = true
}
4Use ephemeral values only in allowed contexts

Ephemeral values can only be referenced in:
- Provider blocks
- Local values
- Other ephemeral resources
- Write-only arguments in managed resources
- Provisioner blocks

Remove any references in regular managed resource arguments.

5Use locals to capture ephemeral values temporarily

If you need to use an ephemeral value multiple places, capture it in a local:

hcl
locals {
  password = ephemeral.random_password.db.result
}

This makes the local ephemeral, and you can reference it in provider blocks or provisioners.

6For sensitive data in resources, use write-only arguments

If passing sensitive values to managed resources, use write-only arguments (available in Terraform 1.11+):

hcl
resource "aws_rds_cluster" "example" {
  # ...
  master_password = ephemeral.aws_secretsmanager_secret_version.db.secret_string
}

Advanced notes

Ephemeral resources were introduced in Terraform v1.10 (November 2024) as a security feature to prevent sensitive data from being persisted in state files. The 'ephemeral value not allowed' constraint is fundamental to this feature's design. Write-only arguments (Terraform 1.11+) provide an alternative for passing ephemeral values directly to managed resources. The ephemeral lifecycle includes three phases: opening (reading the value), renewing (if the remote system enforces expiration), and closing (after providers complete their work). Understanding these constraints is essential when working with sensitive data like passwords, API keys, or temporary credentials. Currently supported by AWS, Azure, GCP, Vault, Kubernetes, and Infisical providers.

Frequently asked questions

What does "Error: Ephemeral value not allowed" mean?
10) are temporary resources designed to keep sensitive data out of state files. However, they can only be referenced in specific contexts. This error occurs when you try to use an ephemeral value outside these allowed contexts, such as in a managed resource argument, output without ephemeral declaration, or module input variable not declared as ephemeral.
How do I fix "Error: Ephemeral value not allowed"?
Terraform restricts where ephemeral resource values can be used to prevent sensitive data from being stored in state files. This error occurs when you reference an ephemeral resource in a context that doesn't support ephemerality.
What causes "Error: Ephemeral value not allowed"?
Referencing an ephemeral resource in a managed resource block argument Using ephemeral values in an output block without declaring output as ephemeral Passing ephemeral values to child module variables not declared as ephemeral
Is the "Error: Ephemeral value not allowed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading