diff --git a/env0/resource_aws_credentials.go b/env0/resource_aws_credentials.go
index 51a5ec19..6fa63f80 100644
--- a/env0/resource_aws_credentials.go
+++ b/env0/resource_aws_credentials.go
@@ -50,7 +50,7 @@ func resourceAwsCredentials() *schema.Resource {
 			},
 			"secret_access_key": {
 				Type:          schema.TypeString,
-				Description:   "the aws access key secret",
+				Description:   "the aws access key secret. In case your organization is self-hosted, please use a secret reference in the shape of ${ssm:<secret-id>}",
 				Optional:      true,
 				Sensitive:     true,
 				ForceNew:      true,
diff --git a/env0/resource_azure_credentials.go b/env0/resource_azure_credentials.go
index c5035d2e..c5697da4 100644
--- a/env0/resource_azure_credentials.go
+++ b/env0/resource_azure_credentials.go
@@ -31,7 +31,7 @@ func resourceAzureCredentials() *schema.Resource {
 			},
 			"client_secret": {
 				Type:        schema.TypeString,
-				Description: "the azure client secret",
+				Description: "the azure client secret. In case your organization is self-hosted, please use a secret reference in the shape of ${azure:<secret-name>@<vault-name>}",
 				Required:    true,
 				Sensitive:   true,
 				ForceNew:    true,
diff --git a/env0/resource_gcp_credentials.go b/env0/resource_gcp_credentials.go
index 2f0abab7..506ff845 100644
--- a/env0/resource_gcp_credentials.go
+++ b/env0/resource_gcp_credentials.go
@@ -32,7 +32,7 @@ func resourceGcpCredentials() *schema.Resource {
 			},
 			"service_account_key": {
 				Type:        schema.TypeString,
-				Description: "the gcp service account key",
+				Description: "the gcp service account key. In case your organization is self-hosted, please use a secret reference in the shape of ${gcp:<secret-id>}",
 				Required:    true,
 				Sensitive:   true,
 				ForceNew:    true,