diff --git a/app/models/manageiq/providers/embedded_terraform/automation_manager/job.rb b/app/models/manageiq/providers/embedded_terraform/automation_manager/job.rb
index 153941a5..a825f925 100644
--- a/app/models/manageiq/providers/embedded_terraform/automation_manager/job.rb
+++ b/app/models/manageiq/providers/embedded_terraform/automation_manager/job.rb
@@ -21,13 +21,9 @@ def pre_execute
   def execute
     template_path = File.join(options[:git_checkout_tempdir], template_relative_path)
     credentials   = Authentication.where(:id => options[:credentials])
+    extra_vars    = options.dig(:input_vars, :extra_vars) || {}
 
-    response = Terraform::Runner.run(
-      options[:input_vars],
-      template_path,
-      :credentials => credentials,
-      :env_vars    => options[:env_vars]
-    )
+    response = Terraform::Runner.run(decrypt_extra_vars(extra_vars), template_path, :credentials => credentials, :env_vars => options[:env_vars])
 
     options[:terraform_stack_id] = response.stack_id
     save!
@@ -110,6 +106,11 @@ def stack_response
     @stack_response ||= Terraform::Runner::ResponseAsync.new(options[:terraform_stack_id])
   end
 
+  def decrypt_extra_vars(extra_vars)
+    result = extra_vars.deep_dup
+    result.transform_values! { |val| val.kind_of?(String) ? ManageIQ::Password.try_decrypt(val) : val }
+  end
+
   def configuration_script_source
     @configuration_script_source ||= template.configuration_script_source
   end
diff --git a/app/models/service_terraform_template.rb b/app/models/service_terraform_template.rb
index fc18967d..af40f37e 100644
--- a/app/models/service_terraform_template.rb
+++ b/app/models/service_terraform_template.rb
@@ -85,7 +85,7 @@ def save_job_options(action, overrides)
     job_options[:extra_vars].try(:transform_values!) do |val|
       val.kind_of?(String) ? val : val[:default] # TODO: support Hash only
     end
-    # TODO: job_options.deep_merge!(parse_dialog_options) unless action == ResourceAction::RETIREMENT
+    job_options.deep_merge!(parse_dialog_options) unless action == ResourceAction::RETIREMENT
     job_options.deep_merge!(overrides)
     translate_credentials!(job_options)
 
@@ -97,6 +97,17 @@ def job_option_key(action)
     "#{action.downcase}_job_options".to_sym
   end
 
+  def parse_dialog_options
+    dialog_options = options[:dialog] || {}
+
+    params = dialog_options.each_with_object({}) do |(attr, val), obj|
+      var_key = attr.sub(/^(password::)?dialog_/, '')
+      obj[var_key] = val
+    end
+
+    params.blank? ? {} : {:extra_vars => params}
+  end
+
   def translate_credentials!(options)
     options[:credentials] = []