How to fix Error: Ephemeral value not allowed in Terraform

Run terraform plan and note the exact location of the error. Check whether it's in an output, variable assignment, or resource argument. The error message will indicate the invalid context.

Update your output block to declare it as ephemeral:

output "secret_password" {
  value     = ephemeral.random_password.db.result
  sensitive = true
  ephemeral = true
}

In the child module's variables.tf, add ephemeral = true to accept ephemeral values:

variable "master_password" {
  type      = string
  ephemeral = true
}

Ephemeral values can only be referenced in:
- Provider blocks
- Local values
- Other ephemeral resources
- Write-only arguments in managed resources
- Provisioner blocks

Remove any references in regular managed resource arguments.

If you need to use an ephemeral value multiple places, capture it in a local:

locals {
  password = ephemeral.random_password.db.result
}

This makes the local ephemeral, and you can reference it in provider blocks or provisioners.

If passing sensitive values to managed resources, use write-only arguments (available in Terraform 1.11+):

resource "aws_rds_cluster" "example" {
  # ...
  master_password = ephemeral.aws_secretsmanager_secret_version.db.secret_string
}