Latch / Docs
guides

Terraform

Latches and their policies as declarative configuration in your repos.

Latch ships a Terraform provider that manages secrets, latches, and KV connections over the admin API. Your policies become code in your own repositories: a pipeline change is a pull request, reviewed and approved like any other, and terraform plan tells you exactly what will change before it does.

resource "latch_secret" "stripe" {
  name               = "stripe-prod"
  type               = "api_key"
  credential_wo      = var.stripe_api_key # write-only: never stored in state
  credential_version = 1                  # bump to rotate
}

resource "latch" "payments_agent" {
  name              = "payments-agent"
  secret_id         = latch_secret.stripe.id
  upstream_base_url = "https://api.stripe.com"

  pipeline = jsonencode([
    { type = "endpoint", mode = "allowlist", patterns = ["/v1/charges"] },
    { type = "rate_limit", maxRequests = 100, windowSeconds = 60, keyBy = "latch" },
  ])
}

Setup

The provider authenticates with a personal access token (ltk_...) — mint one from the dashboard's Access Tokens page. It's per-user, revocable, scoped to your own resources, and not admin, so what Terraform creates lands in the same space your dashboard shows. Export it and configure the endpoint:

provider "latch" {
  endpoint = "https://latch.your-company.internal"
  # token read from the LATCH_TOKEN environment variable
}

On a self-hosted deployment you can instead use the shared service admin_key (env LATCH_ADMIN_KEY) — admin-privileged and shared across callers, so prefer the personal token where the deployment offers it.

Terraform 1.11 or newer is required: credentials are write-only arguments, which never appear in the plan or the state file — matching the product invariant that the server never returns them either.

What you can manage

  • latch_secret — create, rename, and rotate credentials in place (rotation re-seals TEE latches in the background).
  • latch — the full policy surface: pipeline, mounts, SLAs, expiry, enabled/disabled. The lat_... access token is exported as a sensitive attribute for wiring into your agents' configuration.
  • latch_kv_connection — Vault / 1Password Connect endpoints for TEE-resolved credentials.
  • Data sources for existing secrets and latches (including TEE latches created in the dashboard), and for your hardware-enrolled agent identities — feed their key ids straight into an identity filter's allowlist.

Deletion is ordered safely: destroying a secret that still has latches bound to it fails with the list of what would be lost, instead of silently taking the latches with it.

Where it lives

The provider source, full schema documentation, and complete worked examples are in its own repository, SubzeroLabs/terraform-provider-latch. The admin-API subset it consumes is frozen here by tests/terraform-contract.test.ts, so the two move together.

PreviousActivityNextProxy API