How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance
The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself. 

Example from the Terraform site:

provider "vault" {
  # It is strongly recommended to configure this provider through the
  # environment variables described above, so that each user can have
  # separate credentials set in the environment.
  #
  # This will default to using $VAULT_ADDR
  # But can be set explicitly
  # address = "https://vault.example.net:8200"
}

resource "vault_generic_secret" "example" {
  path = "secret/foo"

  data_json = &lt;&lt;EOT
{
  "foo":   "bar",
  "pizza": "cheese"
}
EOT
}


Optionally you can write a script in whatever language you are comfortable with to make the call out to Vault and invoke via local-exec in Terraform. 

Example of invoking a simple command from the Terraform site:

resource "aws_instance" "web" {
  # ...

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.private_ip} &gt;&gt; private_ips.txt"
  }
}