hashicorp · tylerwolf · Feb 18, 2026 · Mar 25, 2026 · May 29, 2026 · May 29, 2026
@@ -495,6 +495,7 @@
         { "title":  "Azure configuration", "href":  "dynamic-provider-credentials/azure-configuration" },
         { "title":  "Kubernetes configuration", "href":  "dynamic-provider-credentials/kubernetes-configuration" },
         { "title":  "HCP configuration", "href":  "dynamic-provider-credentials/hcp-configuration" },
+        { "title":  "Tencent Cloud configuration", "href":  "dynamic-provider-credentials/tencentcloud-configuration" },
         { "title":  "Manually generating workload identity tokens", "href":  "dynamic-provider-credentials/manual-generation" },
         { "title":  "Specifying multiple configurations", "href": "dynamic-provider-credentials/specifying-multiple-configurations"},
             {
@@ -721,6 +722,7 @@
       { "title":  "Azure configuration", "href":  "dynamic-provider-credentials/azure-configuration" },
       { "title":  "Kubernetes configuration", "href":  "dynamic-provider-credentials/kubernetes-configuration" },
       { "title":  "HCP configuration", "href":  "dynamic-provider-credentials/hcp-configuration" },
+      { "title":  "Tencent Cloud configuration", "href":  "dynamic-provider-credentials/tencentcloud-configuration" },
       { "title":  "Manually generating workload identity tokens", "href":  "dynamic-provider-credentials/manual-generation" },
       {
         "title": "Vault-backed dynamic credentials",

@@ -14,7 +14,7 @@ last_modified: 2026-03-16T23:04:08.000Z
 You can use HCP Terraform’s native OpenID Connect integration with AWS to get [dynamic credentials](/terraform/cloud-docs/dynamic-provider-credentials) for the AWS provider in your HCP Terraform runs. Configuring the integration requires the following steps:
 
 1. **[Configure AWS](#configure-aws):** Set up a trust configuration between AWS and HCP Terraform. Then, you must create AWS roles and policies for your HCP Terraform workspaces.
-2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.
+2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use dynamic credentials.
 
 If you are configuring a Stack, refer to [Authenticate a Stack](/terraform/language/stacks/deploy/authenticate) to learn about the workflow of authenticating your Stack deployments with dynamic credentials.
 
@@ -62,7 +62,9 @@ The following example shows the trust policy format:
     ]
 }
 ```
-with the capitalized values replaced with the following:
+
+Replace the capitalized values with the following:
+
 * **OIDC_PROVIDER_ARN**: The ARN from the OIDC provider resource created in the previous step
 * **SITE_ADDRESS**: The address of HCP Terraform with `https://` stripped, (e.g., `app.terraform.io`)
 * **AUDIENCE_VALUE**: This should be set to `aws.workload.identity` unless a non-default audience has been specified in TFC
@@ -72,7 +74,8 @@ with the capitalized values replaced with the following:
 * **RUN_PHASE**: The run phase this policy will apply to, currently one of `plan` or `apply`.
 
 -> **Note:** if different permissions are desired for plan and apply, then two separate roles and trust policies must be created for each of these run phases to properly match them to the correct access level.
-If the same permissions will be used regardless of run phase, then the condition can be modified like the below to use `StringLike` instead of `StringEquals` for the sub and include a `*` after `run_phase:` to perform a wildcard match:
+
+If you wish to use the same permissions regardless of run phase, then you must modify the condition to match the below, using `StringLike` instead of `StringEquals` for the sub and including a `*` after `run_phase:` to perform a wildcard match:
 
 ```json
 {

@@ -14,7 +14,7 @@ last_modified: 2026-03-16T23:04:09.000Z
 You can use HCP Terraform’s native OpenID Connect integration with Azure to get [dynamic credentials](/terraform/cloud-docs/dynamic-provider-credentials) for the AzureRM or Microsoft Entra ID providers in your HCP Terraform runs. Configuring the integration requires the following steps:
 
 1. **[Configure Azure](#configure-azure):** Set up a trust configuration between Azure and HCP Terraform. Then, you must create Azure roles and policies for your HCP Terraform workspaces.
-2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.
+2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use dynamic credentials.
 
 If you are configuring a Stack, refer to [Authenticate a Stack](/terraform/language/stacks/deploy/authenticate) to learn about the workflow of authenticating your Stack deployments with dynamic credentials.
 

@@ -17,7 +17,7 @@ last_modified: 2026-03-16T23:04:09.000Z
 You can use HCP Terraform’s native OpenID Connect integration with GCP to get [dynamic credentials](/terraform/cloud-docs/dynamic-provider-credentials) for the GCP provider in your HCP Terraform runs. Configuring the integration requires the following steps:
 
 1. **[Configure GCP](#configure-gcp):** Set up a trust configuration between GCP and HCP Terraform. Then, you must create GCP roles and policies for your HCP Terraform workspaces.
-2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.
+2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use dynamic credentials.
 
 If you are configuring a Stack, refer to [Authenticate a Stack](/terraform/language/stacks/deploy/authenticate) to learn about the workflow of authenticating your Stack deployments with dynamic credentials.
 

@@ -1,5 +1,5 @@
 ---
-page_title: Dynamic Credentials with the HCP Provider - Workspaces - HCP Terraform
+page_title: Dynamic credentials with the HCP Provider - Workspaces - HCP Terraform
 description: >-
   Use OpenID Connect to get short-term credentials for the HCP provider in
   your HCP Terraform runs.
@@ -9,14 +9,14 @@ last_modified: 2026-03-16T23:04:09.000Z
 # END AUTO GENERATED METADATA
 ---
 
-# Dynamic Credentials with the HCP Provider
+# Dynamic credentials with the HCP Provider
 
 ~> **Important:** If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), ensure your agents use [v1.15.1](/terraform/cloud-docs/agents/changelog#1-15-1-05-01-2024) or above. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).
 
 You can use HCP Terraform’s native OpenID Connect integration with HCP to authenticate with the HCP provider using [dynamic credentials](/terraform/cloud-docs/dynamic-provider-credentials) in your HCP Terraform runs. Configuring dynamic credentials for the HCP provider requires the following steps:
 
 1. **[Configure HCP](#configure-hcp):** Set up a trust configuration between HCP and HCP Terraform. Then, you must create a [service principal in HPC](/hcp/docs/hcp/iam/service-principal) for your HCP Terraform workspaces.
-2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use Dynamic Credentials.
+2. **[Configure HCP Terraform](#configure-hcp-terraform):** Add environment variables to the HCP Terraform workspaces where you want to use dynamic credentials.
 
 If you are configuring a Stack, refer to [Authenticate a Stack](/terraform/language/stacks/deploy/authenticate) to learn about the workflow of authenticating your Stack deployments with dynamic credentials.
 

@@ -29,7 +29,7 @@ You configure a trust relationship between your cloud platform and HCP Terraform
 
 If you are self-hosting [HCP Terraform agents](/terraform/cloud-docs/agents), your agents must use [v1.7.0](/terraform/cloud-docs/agents/changelog#1-7-0-03-02-2023) or newer. To use the latest dynamic credentials features, [upgrade your agents to the latest version](/terraform/cloud-docs/agents/changelog).
 
-## Configure Dynamic Credentials for workspaces
+## Configure dynamic credentials for workspaces
 
 Using dynamic credentials in a workspace requires the following steps for each cloud platform:
 
@@ -46,6 +46,7 @@ following cloud platform configuration instructions for full details:
 - [Google Cloud Platform](/terraform/cloud-docs/dynamic-provider-credentials/gcp-configuration)
 - [Azure](/terraform/cloud-docs/dynamic-provider-credentials/azure-configuration)
 - [Kubernetes](/terraform/cloud-docs/dynamic-provider-credentials/kubernetes-configuration)
+- [Tencent Cloud](/terraform/cloud-docs/dynamic-provider-credentials/tencentcloud-configuration)
 
 You can also use Vault to generate credentials for AWS, GCP, or Azure by setting up [Vault-backed dynamic credentials](/terraform/cloud-docs/dynamic-provider-credentials/vault-backed), which take advantage of Vault's [secrets engines](/vault/docs/secrets) to generate temporary credentials.
 
@@ -65,6 +66,7 @@ The following variables are examples of environment variables you can use to con
 - [Google Cloud Platform](/terraform/cloud-docs/dynamic-provider-credentials/gcp-configuration#required-environment-variables): `TFC_GCP_PLAN_SERVICE_ACCOUNT_EMAIL`
 - [HCP](/terraform/cloud-docs/dynamic-provider-credentials/hcp-configuration#required-environment-variables): `TFC_HCP_PLAN_PROVIDER_RESOURCE_NAME`
 - [Kubernetes](/terraform/cloud-docs/dynamic-provider-credentials/kubernetes-configuration#required-environment-variables): `TFC_KUBERNETES_WORKLOAD_IDENTITY_AUDIENCE`
+- [Tencent Cloud](/terraform/cloud-docs/dynamic-provider-credentials/tencentcloud-configuration#required-environment-variables): `TFC_TENCENTCLOUD_RUN_ROLE_ARN`
 - [Vault](/terraform/cloud-docs/dynamic-provider-credentials/vault-configuration#required-environment-variables): `TFC_VAULT_PLAN_ROLE`
 
 Refer to the cloud platform configuration instructions for full details.