Random Password

Defined insandbox.hcl

The random_password resource generates cryptographically secure random passwords with configurable character sets and constraints. It supports customizable requirements for uppercase, lowercase, numeric, and special characters.

Use Cases

As a lab author, you can use random_password resources to:

• Credential Generation: Generate secure, unique credentials for databases, services, and applications to avoid hardcoded passwords

Random password resources provide cryptographically secure credential generation with customizable complexity requirements.

HCL Syntax

Basic Syntax

resource "random_password" "name" {
  length = 16
}

Full Syntax

resource "random_password" "name" {
  length = 32

  # Character set options
  special = true
  numeric = true
  lower = true
  upper = true

  # Minimum requirements
  min_special = 2
  min_numeric = 2
  min_lower = 2
  min_upper = 2

  # Custom special characters
  override_special = "!@#$%^&*"
}

Fields

Field	Type	Required	Description
length	number	✓	Total number of characters in the generated password ConstraintsPassword length must be at least 1
special	bool	—	When enabled, the password can contain special characters like !@#$%^&*(). Defaults to true if not specified. Defaulttrue
numeric	bool	—	When enabled, the password can contain digits 0-9. Defaults to true if not specified. Defaulttrue
lower	bool	—	When enabled, the password can contain lowercase letters. Defaults to true if not specified. Defaulttrue
upper	bool	—	When enabled, the password can contain uppercase letters. Defaults to true if not specified. Defaulttrue
override_special	string	—	Provide your own special characters to use in the password. If not specified, uses the default set of special characters.
min_special	number	—	Ensures the password contains at least this many special characters. Defaults to 0. Default0 ConstraintsMinimum special characters must be non-negative
min_numeric	number	—	Ensures the password contains at least this many digits. Defaults to 0. Default0 ConstraintsMinimum numeric characters must be non-negative
min_lower	number	—	Ensures the password contains at least this many lowercase letters. Defaults to 0. Default0 ConstraintsMinimum lowercase characters must be non-negative
min_upper	number	—	Ensures the password contains at least this many uppercase letters. Defaults to 0. Default0 ConstraintsMinimum uppercase characters must be non-negative

Computed Attributes

These attributes are set by the system and are read-only.

Attribute	Type	Description
value	string	The generated password

Examples

Simple Password

resource "random_password" "admin" {
  length = 12
}

output "admin_password" {
  value = resource.random_password.admin.value
  sensitive = true
}

Database Password with Requirements

resource "random_password" "db_password" {
  length = 24

  min_upper = 2
  min_lower = 2
  min_numeric = 2
  min_special = 2
}

resource "container" "database" {
  image {
    name = "postgres:15"
  }

  environment = {
    POSTGRES_PASSWORD = resource.random_password.db_password.value
  }
}

API Key Generation

resource "random_password" "api_key" {
  length = 32
  special = false  # Only alphanumeric
}

resource "template" "config" {
  source = <<-EOF
    api:
      key: "${resource.random_password.api_key.value}"
      timeout: 30
  EOF

  destination = "./config/api.yaml"
}

Custom Special Characters

resource "random_password" "secure_token" {
  length = 20
  override_special = "!@#$%"  # Only these special chars

  min_special = 3
  min_numeric = 3
  min_upper = 3
  min_lower = 3
}

Multiple Service Passwords

# Database password
resource "random_password" "postgres_password" {
  length = 16
  min_upper = 1
  min_numeric = 2
  min_special = 1
}

# Redis password
resource "random_password" "redis_password" {
  length = 20
  special = false  # Redis doesn't handle some special chars well
}

# Application secret
resource "random_password" "app_secret" {
  length = 32
  min_special = 4
  override_special = "@#$%^&*"
}

resource "template" "env_file" {
  source = <<-EOF
    # Database
    POSTGRES_PASSWORD=${resource.random_password.postgres_password.value}

    # Redis
    REDIS_PASSWORD=${resource.random_password.redis_password.value}

    # Application
    APP_SECRET=${resource.random_password.app_secret.value}
  EOF

  destination = "./.env"
}

Numeric-Only PIN

resource "random_password" "pin" {
  length = 6

  # Only numbers
  special = false
  upper = false
  lower = false
  numeric = true
}

Username and Password Combination

resource "random_id" "username_suffix" {
  byte_length = 4
}

resource "random_password" "user_password" {
  length = 14

  min_upper = 2
  min_lower = 2
  min_numeric = 2
  min_special = 1
}

resource "template" "user_credentials" {
  source = <<-EOF
    username: user_${resource.random_id.username_suffix.hex}
    password: ${resource.random_password.user_password.value}
  EOF

  destination = "./credentials.yaml"
}

Security Considerations

Sensitive Values

Always mark password outputs as sensitive:

output "database_password" {
  value = resource.random_password.db.value
  sensitive = true
}

Storage Security

# Good: Use in environment variables or config files
resource "container" "app" {
  environment = {
    DB_PASSWORD = resource.random_password.db.value
  }
}

# Avoid: Don't log or output passwords directly
resource "exec" "bad_example" {
  script = "echo 'Password: ${resource.random_password.db.value}'"  # DON'T DO THIS
}

Best Practices

1. Length: Use at least 12 characters for production passwords
2. Complexity: Include multiple character types for stronger passwords
3. Minimums: Set minimum requirements for critical applications
4. Special Characters: Consider target system limitations when choosing special chars
5. Sensitive Data: Always mark password outputs as sensitive
6. Rotation: Generate new passwords by changing resource names or recreating resources
7. Documentation: Document password requirements and usage