---
name: key-protect-terraform-setup
title: Setting up Terraform for Key Protect
description: Terraform on IBM Cloud® enables predictable and consistent creation of IBM Cloud services so that you can rapidly build complex, multi-tier cloud environments following Infrastructure as Code (IaC) principles. Similar to using the IBM Cloud CLI or API and SDKs, you can automate the creation, update, and deletion of your Key Protect instances by using HashiCorp Configuration Language (HCL).
last-updated: 2026-07-17
---

# Setting up Terraform for Key Protect
{: #terraform-setup}

Terraform on IBM Cloud® enables predictable and consistent creation of IBM Cloud services so that you can rapidly build complex, multi-tier cloud environments following Infrastructure as Code (IaC) principles. Similar to using the IBM Cloud CLI or API and SDKs, you can automate the creation, update, and deletion of your Key Protect instances by using HashiCorp Configuration Language (HCL).
{: shortdesc}

Looking for a managed Terraform on IBM Cloud® solution? Try out [IBM Cloud® Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started). With Schematics, you can use the Terraform scripting language that you are familiar with, but you don't have to worry about setting up and maintaining the Terraform command line and the IBM Cloud® Provider plug-in. Schematics also provides pre-defined Terraform templates that you can easily install from the IBM Cloud® catalog.
{: tip}

## Installing Terraform and configuring resources for Key Protect
{: #install-terraform}

Before you can create an authorization by using Terraform, make sure that you have completed the following:

* Make sure that you have the [required access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access) to create and work with Key Protect resources.
* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named `main.tf`. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://developer.hashicorp.com/terraform/language){: external}.

1. Create a Key Protect instance by using the `ibm_resource_instance` resource argument in your `main.tf` file.

   The Key Protect instance in the following example is named `my_kp` and is created with the tiered pricing plan in the `us-south` region. The `user@ibm.com` is assigned the Manager role in the IAM access policy. For other supported regions, see [Regions and endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regions).

   ```terraform
   resource "ibm_resource_instance" "kms_instance" {
     name     = "my_kp"
     service  = "kms"
     plan     = "tiered-pricing"
     location = "us-south"
   }

   resource "ibm_iam_user_policy" "policy" {
     ibm_id = "user@ibm.com"
     roles  = ["Manager"]

     resources {
       service              = "kms"
       resource_instance_id = element(split(":", ibm_resource_instance.kms_instance.id), 7)
     }
   }
   ```
   {: codeblock}

2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see [Initializing Working Directories](https://developer.hashicorp.com/terraform/cli/init){: external}.

   ```terraform
   terraform init
   ```
   {: pre}

3. Provision the resources from the `main.tf` file. For more information, see [Provisioning Infrastructure with Terraform](https://developer.hashicorp.com/terraform/cli/run){: external}.

   1. Run `terraform plan` to generate a Terraform execution plan to preview the proposed actions.

      ```terraform
      terraform plan
      ```
      {: pre}

   1. Run `terraform apply` to create the resources that are defined in the plan.

      ```terraform
      terraform apply
      ```
      {: pre}

4. From the [IBM Cloud resource list](https://cloud.ibm.com/resources){: external}, select the Key Protect instance that you created and note the instance ID.
5. Verify that the access policy is successfully assigned. For more information, see [Reviewing assigned access in the console](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&interface=ui#review-your-access-console).


## What's next?
{: #terraform-setup-next}

Now that you successfully created your first Key Protect service instance with Terraform, explore these resources:

### Resources
{: #resources}

* [`ibm_kms_key`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/kms_key) - Create and manage encryption keys
* [`ibm_kms_key_rings`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/kms_key_rings) - Organize keys into key rings

* [`ibm_kms_key_policies`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/kms_key_policies) - Configure key rotation and dual authorization policies
* [`ibm_kms_key_alias`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/kms_key_alias) - Create key aliases
* [`ibm_kms_kmip_adapter`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/kms_kmip_adapters) - Manage KMIP adapters

### Data Sources
{: #data-sources}

* [`ibm_kms_key`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/kms_key) - Retrieve key information
* [`ibm_kms_keys`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/kms_keys) - List keys in an instance
* [`ibm_kms_key_policies`](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/kms_key_policies) - Retrieve key policies