I am trying to supply the GCP application credentials to terraform via the HashiCorp vault. I have managed to do it by first executing gcloud auth application-default login, but I would like to automate the process. Details below.

I have stored to the HashiCorp vault an app_credentials.json file, which has the GCP Application Credentials. I have the following provider setup, based on this thread:

terraform {
  backend "gcs" {
    bucket = "my-terraform-bucket "
    prefix = "terraform/state"
  }
}

provider "vault" {
}

data "vault_generic_secret" "credentials" {
  path = "gcp-credentials"
}

provider "google" {
  credentials = data.vault_generic_secret.credentials.data["app_credentials.json"]
}

However, terraform refuses to retrieve the credentials from the vault. I receive the following error:

~$ terraform init

Initializing the backend...
Initializing modules...
╷
│ Error: storage.NewClient() failed: dialing: google: could not find default credentials. See https://cloud.google.com/docs/authentication/external/set-up-adc for more information

I can work around this problem by either:

• Executing gcloud auth application-default login based on this response; or
• copying the app_credentials.json to the local filesystem and setting the GOOGLE_APPLICATION_CREDENTIALS environment variable, per this suggestion.

However, I am looking for an automated way to retrieve the credentials from the vault without needing to run gcloud or keep a local credentials file.