<ahref="./templates#parameters">Template parameters</a> are a dangerous way to accept secrets.

We show parameters in cleartext around the product. Assume anyone with view

access toyour workspace can also see parameters.

access toa workspace can also see its parameters.

Dynamic secrets are attached to the workspace lifecycle and require no setup by

the end user.

They can be implemented innative Terraform like so:

They can be implemented inyour template code like so:

This method is limited to[services with Terraform providers](https://registry.terraform.io/browse/providers).

A catch-all variation of this approach is dynamically provisioning a cloud service account (e.g[GCP](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#private_key))

for each workspace and thenmake the relevant secrets available via the cloud's secret management

for each workspace and thenmaking the relevant secrets available via the cloud's secret management

system.