---
title: Creating and accessing a Database Instance using Secret Manager and Terraform/OpenTofu
description: Discover how to create and securely access a Database Instance using Secret Manager and Terraform/OpenTofu
tags: secret-manager terraform
products:
  - security-identity
  - secret-manager
  - managed-databases
dates:
  validation: 2025-06-19
  posted: 2024-06-03
  validation_frequency: 12
difficulty: beginner
usecase:
  - resource-management
ecosystem:
  - third-party
---
import image from './assets/scaleway-db-secret.webp'

import Requirements from '@macros/iam/requirements.mdx'


In this tutorial, you will use a Terraform/OpenTofu configuration file that builds your entire infrastructure, such as a [Database Instance](/managed-databases-for-postgresql-and-mysql/concepts/#database-instance), a [secret](/secret-manager/concepts/#secret), and a [version](/secret-manager/concepts/#version) in which your database credentials are stored. You will then be able to access your database credentials securely from the Scaleway console.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com/)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A valid [API key](/iam/how-to/create-api-keys/)
- [Created an SSH key](/organizations-and-projects/how-to/create-ssh-key/)


## Clone the GitHub repository and configure your environment variables

The Scaleway [GitHub repository](https://github.com/scaleway/tutorial-sem-terraform) contains all the code you need to deploy your infrastructure.

1. Open a terminal and clone the repository to your local machine using the following command:

        ```bash
        git clone git@github.com:scaleway/tutorial-sem-terraform.git
        ```
2. Access the `tutorial-sem-terraform` directory:

    ```bash
    cd tutorial-sem-terraform
    ```
3. Paste the following command in your terminal to configure your environment variables. Make sure that you replace the placeholder values with your own.

    ```bash
    export SCW_ACCESS_KEY="<SCWxxxxxxxxxxxxxxxxx>"
    export SCW_SECRET_KEY="<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    export SCW_PROJECT_ID="<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    export SCW_ORGANIZATION_ID="<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    ```
### Understanding the files and directories

In the `tutorial-sem-terraform` repository, you will find the following folder structure:

```
examples/
├─ key-value/
   ├─ app/
   ├─ infra/

```

- The `key-value` folder contains two additional folders named `app` and `infra`.
- The `app` folder will interact with the database and ask [Secret Manager](/secret-manager/concepts/#secret-manager) for the password to connect to the database.
- The `infra` folder contains the files that will configure your database and secret.

## Build and deploy your infrastructure

1. Access the `infra` folder using the following command:
    ```bash
    cd examples/key-value/infra
    ```
2. Run the following command to download the dependencies and initialize Terraform/OpenTofu:
    ```bash
    terraform init
    ```
3. Run the following command to configure your infrastructure:
    ```bash
    terraform apply
    ```
4. Type `yes` and `Enter` when prompted to enter a value. An output similar to the following displays:
    ```bash
    Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

    Outputs:

    database_public_endpoint = tolist([
      {
        "endpoint_id" = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        "hostname" = ""
        "ip" = "<public-endpoint>"
        "name" = ""
        "port" = <port>
      },
    ])
    ```
5. Navigate to the `app` folder:
    ```bash
    cd .. && cd app
    ```
6. Run the following command:
    ```bash
    go run .
    ```
    An output similar to the following should display:
    ```bash
    SCW_DEFAULT_REGION: fr-parSuccessfully connected!
    ```

## Retrieve your database credentials

1. Click **Secret Manager** in the Security and Identity section of the [Scaleway console](https://console.scaleway.com/) side menu.
2. Click the `database_secret` secret.
    <Lightbox image={image} alt="" />
3. Click the **Versions** tab.
4. Click <Icon name="seeMore" /> next to the secret version. Your database's credentials display.