github.com/eliastor/durgaform@v0.0.0-20220816172711-d0ab2d17673e/website/docs/language/settings/backends/oss.mdx (about)

     1  ---
     2  page_title: 'Backend Type: oss'
     3  description: Terraform can store state remotely in OSS and lock that state with OSS.
     4  ---
     5  
     6  # OSS
     7  
     8  Stores the state as a given key in a given bucket on Stores
     9  [Alibaba Cloud OSS](https://www.alibabacloud.com/help/product/31815.htm).
    10  This backend also supports state locking and consistency checking via
    11  [Alibaba Cloud Table Store](https://www.alibabacloud.com/help/doc-detail/27280.htm), which can be enabled by setting
    12  the `tablestore_table` field to an existing TableStore table name.
    13  
    14  This backend supports [state locking](/language/state/locking) via TableStore.
    15  
    16  -> **Note:** The OSS backend is available from terraform version 0.12.2.
    17  
    18  ## Example Configuration
    19  
    20  ```hcl
    21  terraform {
    22    backend "oss" {
    23      bucket = "bucket-for-terraform-state"
    24      prefix   = "path/mystate"
    25      key   = "version-1.tfstate"
    26      region = "cn-beijing"
    27      tablestore_endpoint = "https://terraform-remote.cn-hangzhou.ots.aliyuncs.com"
    28      tablestore_table = "statelock"
    29    }
    30  }
    31  ```
    32  
    33  This assumes we have a [OSS Bucket](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/oss_bucket) created called `bucket-for-terraform-state`,
    34  a [OTS Instance](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ots_instance) called `terraform-remote` and
    35  a [OTS TableStore](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ots_table) called `statelock`. The
    36  Terraform state will be written into the file `path/mystate/version-1.tfstate`. The `TableStore` must have a primary key named `LockID` of type `String`.
    37  
    38  ## Data Source Configuration
    39  
    40  To make use of the OSS remote state in another configuration, use the
    41  [`terraform_remote_state` data
    42  source](/language/state/remote-state-data).
    43  
    44  ```hcl
    45  terraform {
    46    backend "oss" {
    47      bucket = "remote-state-dns"
    48      prefix = "mystate/state"
    49      key    = "terraform.tfstate"
    50      region = "cn-beijing"
    51    }
    52  }
    53  ```
    54  
    55  The `terraform_remote_state` data source will return all of the root outputs
    56  defined in the referenced remote state, an example output might look like:
    57  
    58  ```
    59  data "terraform_remote_state" "network" {
    60      backend   = "oss"
    61      config    = {
    62          bucket = "remote-state-dns"
    63          key    = "terraform.tfstate"
    64          prefix = "mystate/state"
    65          region = "cn-beijing"
    66      }
    67      outputs   = {}
    68      workspace = "default"
    69  }
    70  ```
    71  
    72  ## Configuration Variables
    73  
    74  !> **Warning:**  We recommend using environment variables to supply credentials and other sensitive data. If you use `-backend-config` or hardcode these values directly in your configuration, Terraform will include these values in both the `.terraform` subdirectory and in plan files. Refer to [Credentials and Sensitive Data](/language/settings/backends/configuration#credentials-and-sensitive-data) for details.
    75  
    76  The following configuration options or environment variables are supported:
    77  
    78  * `access_key` - (Optional) Alibaba Cloud access key. It supports environment variables `ALICLOUD_ACCESS_KEY` and  `ALICLOUD_ACCESS_KEY_ID`.
    79  
    80  * `secret_key` - (Optional) Alibaba Cloud secret access key. It supports environment variables `ALICLOUD_SECRET_KEY` and  `ALICLOUD_ACCESS_KEY_SECRET`.
    81  
    82  * `security_token` - (Optional) STS access token. It supports environment variable `ALICLOUD_SECURITY_TOKEN`.
    83  
    84  * `ecs_role_name` - (Optional, Available in 0.12.14+) The RAM Role Name attached on a ECS instance for API operations. You can retrieve this from the 'Access Control' section of the Alibaba Cloud console.
    85  
    86  * `region` - (Optional) The region of the OSS bucket. It supports environment variables `ALICLOUD_REGION` and `ALICLOUD_DEFAULT_REGION`.
    87  
    88  * `endpoint` - (Optional) A custom endpoint for the OSS API. It supports environment variables `ALICLOUD_OSS_ENDPOINT` and `OSS_ENDPOINT`.
    89  
    90  * `bucket` - (Required) The name of the OSS bucket.
    91  
    92  * `prefix` - (Opeional) The path directory of the state file will be stored. Default to "env:".
    93  
    94  * `key` - (Optional) The name of the state file. Defaults to `terraform.tfstate`.
    95  
    96  * `tablestore_endpoint` / `ALICLOUD_TABLESTORE_ENDPOINT` - (Optional) A custom endpoint for the TableStore API.
    97  
    98  * `tablestore_table` - (Optional) A TableStore table for state locking and consistency. The table must have a primary key named `LockID` of type `String`.
    99  
   100  * `sts_endpoint` - (Optional, Available in 1.0.11+) Custom endpoint for the AliCloud Security Token Service (STS) API. It supports environment variable `ALICLOUD_STS_ENDPOINT`.
   101  
   102  * `encrypt` - (Optional) Whether to enable server side
   103    encryption of the state file. If it is true, OSS will use 'AES256' encryption algorithm to encrypt state file.
   104  
   105  * `acl` - (Optional) [Object
   106    ACL](https://www.alibabacloud.com/help/doc-detail/52284.htm)
   107    to be applied to the state file.
   108  
   109  * `shared_credentials_file` - (Optional, Available in 0.12.8+) This is the path to the shared credentials file. It can also be sourced from the `ALICLOUD_SHARED_CREDENTIALS_FILE` environment variable. If this is not set and a profile is specified, `~/.aliyun/config.json` will be used.
   110  
   111  * `profile` - (Optional, Available in 0.12.8+)  This is the Alibaba Cloud profile name as set in the shared credentials file. It can also be sourced from the `ALICLOUD_PROFILE` environment variable.
   112  
   113  * `assume_role_role_arn` - (Optional, Available in 1.1.0+) The ARN of the role to assume. If ARN is set to an empty string, it does not perform role switching. It supports the environment variable `ALICLOUD_ASSUME_ROLE_ARN`.
   114    Terraform executes configuration on account with provided credentials.
   115  
   116  * `assume_role_policy` - (Optional, Available in 1.1.0+) A more restrictive policy to apply to the temporary credentials. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use this policy to grant permissions that exceed those of the role that is being assumed.
   117  
   118  * `assume_role_session_name` - (Optional, Available in 1.1.0+) The session name to use when assuming the role. If omitted, 'terraform' is passed to the AssumeRole call as session name. It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_NAME`.
   119  
   120  * `assume_role_session_expiration` - (Optional, Available in 1.1.0+) The time after which the established session for assuming role expires. Valid value range: \[900-3600] seconds. Default to 3600 (in this case Alibaba Cloud uses its own default value). It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION`.
   121  
   122  * `assume_role` - (**Deprecated as of 1.1.0+**, Available in 0.12.6+) If provided with a role ARN, will attempt to assume this role using the supplied credentials. It will be ignored when `assume_role_role_arn` is specified.
   123  
   124    **Deprecated in favor of flattening assume_role_\* options**
   125  
   126    * `role_arn` - (Required) The ARN of the role to assume. If ARN is set to an empty string, it does not perform role switching. It supports the environment variable `ALICLOUD_ASSUME_ROLE_ARN`.
   127      Terraform executes configuration on account with provided credentials.
   128  
   129    * `policy` - (Optional) A more restrictive policy to apply to the temporary credentials. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use this policy to grant permissions that exceed those of the role that is being assumed.
   130  
   131    * `session_name` - (Optional) The session name to use when assuming the role. If omitted, 'terraform' is passed to the AssumeRole call as session name. It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_NAME`.
   132  
   133    * `session_expiration` - (Optional) The time after which the established session for assuming role expires. Valid value range: \[900-3600] seconds. Default to 3600 (in this case Alibaba Cloud uses its own default value). It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION`.
   134  
   135  -> **Note:** If you want to store state in the custom OSS endpoint, you can specify an environment variable `OSS_ENDPOINT`, like "oss-cn-beijing-internal.aliyuncs.com"