Terraform

Terraform provider generation now supports ephemeral resources and actions

Brian Flad

February 16, 2026 - 4 min read

Terraform

---

We’re excited to announce support for two new Terraform provider concepts in Speakeasy generation: ephemeral resources and actions. These features bring Terraform provider generation further toward parity with the latest Terraform capabilities, enabling providers to handle temporary data securely and offer further automation.

Ephemeral resources

Generate ephemeral resources  for API operations that return temporary or sensitive data that should never be persisted to state.

What they solve

Introduced in Terraform 1.10, ephemeral resources address a long-standing challenge in Terraform: sensitive values being stored in the state file. Unlike standard resources or data sources, ephemeral resources are never persisted to Terraform state, making them ideal for handling secrets, temporary credentials, and short-lived tokens.

Before ephemeral resources, retrieving a temporary API token required workarounds like using a data source, which would persist the token value to state. With ephemeral resources, providers can now expose temporary data through a purpose-built lifecycle that opens, optionally renews, and closes the resource — keeping sensitive values out of state entirely.

How it works

Speakeasy uses the existing x-speakeasy-entity-operation extension with a new open operation to generate ephemeral resources. Annotate the API operation that retrieves temporary data:

paths:
  /token:
    get:
      description: Retrieve a temporary token
      x-speakeasy-entity-operation: token#open

This generates an ephemeral resource that Terraform consumers can use securely:

ephemeral "myapi_token" "example" {
  # Configuration for the token request
}
 
provider "another_provider" {
  # Token value is never stored in state
  api_key = ephemeral.myapi_token.example.value
}

Ephemeral resources follow a dedicated lifecycle — open, renew, close — that ensures temporary values are available only when needed during a Terraform run and are never written to state or plan files.

Actions

Generate actions  for API operations that perform day-2 infrastructure tasks like backups, restarts, or other operational commands.

What they solve

Terraform has traditionally focused on infrastructure provisioning and state management. Day-2 operations — tasks like triggering a backup, restarting a service, or rotating credentials — fell outside what Terraform could express natively. Teams had to rely on external scripts, CI/CD pipelines, or manual API calls for these operational tasks.

Actions, introduced in Terraform 1.14, bring day-2 operations into Terraform itself. They represent operations that can be invoked on demand or tied to resource lifecycle events, without creating or managing persistent state.

How it works

Speakeasy uses the existing x-speakeasy-entity-operation extension with a new invoke operation to generate actions. Annotate the API operation that performs the task:

paths:
  /backup:
    post:
      description: Create a backup
      x-speakeasy-entity-operation: backup#invoke

This generates an action that Terraform consumers can invoke directly:

action "myapi_backup" "nightly" {
  config {
    # Configuration for the backup
  }
}

Actions can be invoked on demand from the CLI using terraform apply -invoke=action.myapi_backup.nightly or tied to resource lifecycle events with action_trigger blocks.

Multiple API operations

Both ephemeral resources and actions support multiple API operations, similar to managed resources and data sources. If an ephemeral resource or action requires calling multiple API endpoints, annotate each operation with the same entity name:

paths:
  /backup:
    post:
      description: Create a backup
      x-speakeasy-entity-operation: backup#invoke#1
  /backup/status:
    get:
      description: Get backup status
      x-speakeasy-entity-operation: backup#invoke#2

Expanding Terraform generation capabilities

Both features use the same x-speakeasy-entity-operation extension as managed resources and data sources, keeping the configuration model consistent and familiar. This represents another step toward full feature parity between SDK and Terraform provider generation.

Key benefits

• Secure temporary data: Ephemeral resources keep sensitive values like tokens and credentials out of Terraform state
• Day-2 operations in Terraform: Actions bring operational tasks like backups and restarts into Terraform configuration
• Consistent configuration: Both features use the existing x-speakeasy-entity-operation extension
• Multiple API operation support: Complex workflows can span multiple API calls, just like managed resources
• No breaking changes: Both features are additive and backward-compatible with existing configurations

Next steps

Ready to generate ephemeral resources and actions for your Terraform provider? Check out the documentation for implementation details:

• Terraform provider generation
• Mapping ephemeral resource operations
• Mapping action operations