Skip to content

Terraform Bitwarden provider to read, create, or update logins, secure notes, folders, org-collections in your Bitwarden Vaults

License

Notifications You must be signed in to change notification settings

maxlaverse/terraform-provider-bitwarden

Repository files navigation

Terraform Provider for Bitwarden

Tests Coverage Status Go Version Releases Downloads

The Terraform Bitwarden provider is a plugin for Terraform that allows to manage different kind of Bitwarden resources from their Password Manager and Secrets Manager products. This project is not associated with the Bitwarden project nor 8bit Solutions LLC.

Explore the docs »


Table of Contents

Supported Versions

The plugin has been tested and built with the following components:

The provider likely works with older versions but those haven't been tested.

Usage

The complete documentation for this provider can be found on the Terraform Registry docs.

terraform {
  required_providers {
    bitwarden = {
      source  = "maxlaverse/bitwarden"
      version = ">= 0.10.0"
    }
  }
}

# Configure the Bitwarden Provider
provider "bitwarden" {
  email = "[email protected]"

  # If you have the opportunity, you can try out the embedded client which removes the need
  # for a locally installed Bitwarden CLI. Please note that this feature is still considered
  # as experimental, might not work as expected, and is not recommended for production use.
  #
  # experimental {
  #   embedded_client = true
  # }
}

# Create a Bitwarden Login item
resource "bitwarden_item_login" "example" {
  name     = "Example"
  username = "service-account"
  password = "<sensitive>"
}

# or use an existing Bitwarden resource
data "bitwarden_item_login" "example" {
  search = "Example"
}

See the examples directory for more examples.

Security Considerations

The Terraform Bitwarden provider entirely relies on the Bitwarden CLI to interact with Vaults. When you ask Terraform to plan or apply changes, the provider downloads the encrypted Vault locally as if you would use the Bitwarden CLI directly. Currently, the Terraform SDK doesn't offer a way to remove the encrypted Vault once changes have been applied. The issue hashicorp/terraform-plugin-sdk#63 tracks discussions for adding such a feature.

If you want find out more about this file, you can read Terraform's documentation on Data Storage. Please note that this file is stored at <your-project>/.bitwarden/ by default, in order to not interfere with your local Vaults.

NOTE: This whole paragraph doesn't apply to the experimental client, as nothing is stored on disk.

Developing the Provider

If you wish to work on the provider, you'll first need Go installed on your machine (see Requirements above).

To compile the provider, run go install. This will build the provider and put the provider binary in the $GOPATH/bin directory.

To generate or update documentation, run go generate.

In order to run the full suite of Acceptance tests, start a Vaultwarden server:

$ make server

Then run make testacc.

$ make testacc

License

Distributed under the Mozilla License. See LICENSE for more information.