I sadly gave up on the terraform provider approach. I ended up writing a program that is invoked via command-line to “ensure” a fly app exists and is configured properly. The program reads secrets from stdout of a supplied binary. In my case these secrets come from terraform outputs.