Hey @dklesev. You can use variables in Terraform as workspace-scoped parameters if you set sensitive = false. Then, you can pass that variable into the provider block.

This allows users to specify unique AWS access keys when creating workspaces. I haven't tested this so there may be typos, but here's the general structure:

variable "aws_access_key_id" {
  sensitive = false
}
variable "aws_secret_key_id" {
  sensitive = false
}

variable "region" {
  sensitive = false
}

provider "aws" {
  region     = var.region
  access_key = var.aws_access_key_id
  secret_key = var.aws_secret_key_id
}

One downside of using sensitive = false is the users' access key may be revealed in the build logs (something you should confirm to be sure). However, we are using sensitive = true to indicate that the variable is scoped for the entire template.

We plan on using a separate resource for parameters for more flexibility (e.g. "workspace-scoped AND sensitive") in #4311, but this is a WIP.

thx, seems to work, just missed the sensitive = false part.
already excited towards the new feature!