Terraform Provider for Bitwarden

!Tests !Go Version !Releases !Downloads

A provider for Terraform/OpenTofu to manage Bitwarden [Password Manager] and [Secrets Manager] resource. This project is not associated with the Bitwarden project nor Bitwarden, Inc.

[Explore the docs on Terraform»][Terraform Registry docs]    or    [Explore the docs on OpenTofu»][OpenTofu Registry docs]

Table of Contents

• Supported Versions
• Usage
• Embedded Client
• Security Considerations
• Contributing
• Developing the Provider
• License

Supported Versions

The plugin has been tested with the following components:

• [Terraform] v1.11.4 / [OpenTofu] v1.12.6
• [Bitwarden CLI] v2025.4.0 (when not using the Embedded Client)
• [BWS CLI] v1.0.0 (when not using the Embedded Client)
• [Vaultwarden] v1.33.2
• official [bitwarden.com] servers v2025.6.2

The provider is likely to work with older versions of the Bitwarden backends/CLIs, but those haven't necessarily been tested. If you encounter issues with recent versions of the Bitwarden CLI, consider trying out the Embedded Client.

Usage

The complete documentation for this provider can be found on the [Terraform Registry docs].

Bitwarden Secret

terraform {
  required_providers {
    bitwarden = {
      source  = "maxlaverse/bitwarden"
      version = ">= 0.22.0"
    }
  }
}
Configure the Bitwarden Provider
provider "bitwarden" {
  access_token = "0.client_id.client_secret:dGVzdC1lbmNyeXB0aW9uLWtleQ=="
# By default, the provider uses Bitwarden CLIs to interact with the remote
  # Vaults. You can also use the embedded client instead, which removes
  # the need for locally installed binaries.
  #
  # Learn more about the implications by reading the "Client Implementation"
  # section below.
  #
  # client_implementation = "embedded"
}
Source a project
data "bitwarden_project" "example" {
  id = "37a66d6a-96c1-4f04-9a3c-b1fc0135669e"
}
Create a Secret
resource "bitwarden_secret" "example" {
  project_id = data.bitwarden_project.example.id
key   = "ACCESS_KEY"
  value = "THIS-VALUE"
  note  = "Access key for the example project"
}

See the examples directory for more examples.

Password Manager

terraform {
  required_providers {
    bitwarden = {
      source  = "maxlaverse/bitwarden"
      version = ">= 0.22.0"
    }
  }
}
Configure the Bitwarden Provider
provider "bitwarden" {
  email = "[email protected]"
# Specify a server URL when using a self-hosted version of Bitwarden
  # or similar (e.g., Vaultwarden), or the European instances:
  #
  # server = "https://vault.bitwarden.eu"
# By default, the provider uses Bitwarden CLIs to interact with the remote
  # Vaults. You can also use the embedded client instead, which removes
  # the need for locally installed binaries.
  #
  # Learn more about the implications by reading the "Client Implementation"
  # section below.
  #
  # client_implementation = "embedded"
}
Create a Bitwarden Login item
resource "bitwarden_item_login" "example" {
  name     = "Example"
  username = "service-account"
  password = "<sensitive>"
}
or use an existing Bitwarden resource
data "bitwarden_item_login" "example" {
  search = "Example"
}

See the examples directory for more examples.

Client Implementation

The Bitwarden provider offers two client implementations to interact with your Vault:

Official Bitwarden CLIs (Default)

The trade-off is that you need to pre-install the appropriate CLI tools in your Terraform environment. Additionally, the Password Manager CLI (requiring Node.js) can create performance bottlenecks when managing many resources due to process spawning overhead.

Embedded Client

However, this implementation is developed and maintained by a single person as a community project without company resources. While effort goes into ensuring security and correctness, it lacks the extensive security review, testing infrastructure, and dedicated security team that backs Bitwarden's official tools.

Choosing Your Implementation

The choice depends on your needs: the official CLIs leverage Bitwarden's proven tooling, while the embedded client is a community project offering performance benefits and zero external dependencies. The embedded client aims for security and correctness, and code reviews are always welcome to help improve it.

Security Considerations

When not using the Embedded Client, the provider downloads the encrypted Vault locally during _plan_ or _apply_ operations, as the Bitwarden CLI would if you used it directly. There is currently no plugin hook to remove that encrypted Vault once changes have been applied.

If you want to find out more about this file, you can read [Bitwarden's documentation on data storage]. Please note that this file is stored at /.bitwarden/ by default, in order to not interfere with your local Vaults.

Provider logs at the TRACE level (TF_LOG=TRACE) can contain secrets, such as decrypted CLI output and HTTP request or response bodies. Treat these logs as sensitive: do not share them, and avoid enabling trace logging in CI or other shared environments.

Contributing

Bug reports, documentation fixes, and pull requests are welcome.

This provider is maintained by a single person. For anything more than a small fix, the problem belongs in an issue and the PR should link to it.

Issues

• Search existing issues first.
• For bugs, follow the issue template.
• For new resources, schema changes, or anything with more than one reasonable design, open an issue before a PR. That’s where to agree on the problem and the approach.

Pull requests

Link to an issue that already explains the problem. If there isn’t one, the PR should say:

• what is painful today, and in which situation
• why this approach, including what you considered instead

See Developing the Provider for how to build and test locally.

By participating, you agree to follow the Code of Conduct.

Developing the Provider

If you wish to work on the provider, you need the following software:

• [Go] 1.27.3
• [Mage] 1.15.0
• [Docker Compose] 2.35.0

Building the Provider

To compile the provider, run mage build. You can then instruct Terraform to use your compiled version of the provider by running mage setup:install.

Running Tests

The provider includes several types of tests:

1. Offline Tests: Run tests that don't require a Bitwarden backend (e.g. schema validation, unit tests):

$ mage test:offline

1. Integration Tests: There are three types of integration tests:

$ mage test:integrationPwdOfficialWithEmbeddedClient

b. With the Embedded Client against a local Vaultwarden instance. First start Vaultwarden locally:

$ mage vaultwarden

$ mage test:integrationPwdVaultwardenWithEmbeddedClient

c. With the Bitwarden CLI against a local Vaultwarden instance. First start Vaultwarden locally:

$ mage vaultwarden

$ mage test:integrationPwdVaultwardenWithCLI

1. Run All Tests: To run the complete test suite:

$ mage test:all

To clean up test artifacts and clear the test cache:

$ mage clean

Documentation

To generate or update documentation, run:

$ mage docs

Disclaimer

While we strive to ensure the reliability and security of this application, we cannot be held liable for any data loss, unauthorized access, or breaches that may result from the way data is stored or processed by third-party providers. This includes, but is not limited to, unencrypted storage of passwords, attachments, and other user information.

Users are strongly encouraged to perform regular backups of their files and database to mitigate potential data loss. In the event of a loss or security concern, please contact us as soon as possible so we can assist where feasible.

License

Distributed under the Mozilla License. See LICENSE for more information.

[Bitwarden CLI]: https://bitwarden.com/help/article/cli/#download-and-install [BWS CLI]: https://bitwarden.com/help/secrets-manager-cli/ [Docker]: https://www.docker.com/products/docker-desktop [Docker Compose]: https://docs.docker.com/compose/install/ [Go]: https://golang.org/doc/install [Mage]: https://magefile.org/ [OpenTofu]: https://opentofu.org/ [Password Manager]: https://bitwarden.com/products/personal/ [Secrets Manager]: https://bitwarden.com/products/secrets-manager/ [Terraform]: https://www.terraform.io/downloads.html [Terraform Registry docs]: https://registry.terraform.io/providers/maxlaverse/bitwarden/latest/docs [OpenTofu Registry docs]: https://search.opentofu.org/provider/maxlaverse/bitwarden/latest [Bitwarden's documentation on data storage]: https://bitwarden.com/help/data-storage/#on-your-local-machine [Vaultwarden]: https://www.vaultwarden.net/ [bitwarden.com]: https://bitwarden.com