Infrastructure often needs a generated value that stays the same across Terraform runs: a password, a UUID, or a suffix for a name. The hashicorp/random provider creates these values as resources and persists their results in Terraform state. Unlike a random function evaluated on every plan, a random resource does not produce a new value on every run. section 6.8.1
Choose a resource for the value you need:
- Use random_integer for a number, random_uuid for a UUID, or random_pet for a generated name. The provider can also generate bytes and shuffle lists. section 6.8.1
- Use random_password for credentials. It is the provider’s only resource guaranteed to use a cryptographic random number generator; its length and character options are configurable. section 6.8.1
- Set keepers to values whose changes should trigger a new random result. For example, tying a UUID’s keepers to var.name makes a name change the regeneration trigger. section 6.8.1
Listing 6.24 More random resources
resource "random_integer" "number" { #1
min = 0
max = 10
}
output "number" {
value = random_integer.number.result #2
}
resource "random_uuid" "uuid" { #3
}
output "uuid" {
value = random_uuid.uuid.result #4
}
resource "random_pet" "uniqueish-suffix" { #5
length = 2 #6
}
output "suffix" {
value = random_pet.uniqueish-suffix.id #7
}
Compare the integer, UUID, and pet-name resources and the result or id attributes used to expose their values. section 6.8.1
Persistence has a security consequence: a password marked sensitive is still stored in state. The sensitive marking helps keep its value out of logs and prompts a warning when it is exposed as a root-module output, but it does not replace careful control of state storage and access. A random_password resource is also useful for inspecting Terraform state because it exists only in state and needs no provider authentication. section 6.8.1 section 6.3.1
Avoid name collisions in concurrent tests
If two tests create resources with the same required-unique name, one may fail. Generate an eight-character random_string with special and uppercase characters disabled, then append its result to the name passed into the module. Each test run gets a statistically likely distinct name. Where a name cannot be reused even after deletion, adding randomness inside the module can also help when rebuilding an environment. section 9.2.3
Listing 9.4 Adding randomness to names for testing
resource "random_string" "random" {
length = 8 #1
special = false #2
upper = false #3
}
module "alb_example" {
source = "../"
name = "testing_${random_string.random.result}" #4
... #5
}
Shows a random_string result incorporated into a module name for concurrent testing. section 9.2.3
