Terraform
Python: Structs
AppConfig
Initializer
import cdktf
cdktf.AppConfig(
context: typing.Mapping[typing.Any] = None,
hcl_output: bool = None,
outdir: str = None,
skip_backend_validation: bool = None,
skip_validation: bool = None,
stack_traces: bool = None
)
Properties
Name | Type | Description |
---|---|---|
context | typing.Mapping[typing.Any] | Additional context values for the application. |
hcl_output | bool | No description. |
outdir | str | The directory to output Terraform resources. |
skip_backend_validation | bool | Whether to skip backend validation during synthesis of the app. |
skip_validation | bool | Whether to skip all validations during synthesis of the app. |
stack_traces | bool | No description. |
context
Optional
context: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
- Default: no additional context
Additional context values for the application.
Context set by the CLI or the context
key in cdktf.json
has precedence.
Context can be read from any construct using node.getContext(key)
.
hcl_output
Optional
hcl_output: bool
- Type: bool
outdir
Optional
outdir: str
- Type: str
- Default: CDKTF_OUTDIR if defined, otherwise "cdktf.out"
The directory to output Terraform resources.
If you are using the CDKTF CLI, this value is automatically set from one of the following three sources:
- The
-o
/--output
CLI option - The
CDKTF_OUTDIR
environment variable - The
outdir
key incdktf.json
If you are using the CDKTF CLI and want to set a different value here, you will also need to set the same value via one of the three ways specified above.
The most common case to set this value is when you are using the CDKTF library directly (e.g. when writing unit tests).
skip_backend_validation
Optional
skip_backend_validation: bool
- Type: bool
- Default: false
Whether to skip backend validation during synthesis of the app.
skip_validation
Optional
skip_validation: bool
- Type: bool
- Default: false
Whether to skip all validations during synthesis of the app.
stack_traces
Optional
stack_traces: bool
- Type: bool
AzurermBackendConfig
Stores the state as a Blob with the given Key within the Blob Container within the Blob Storage Account.
This backend supports state locking and consistency checking with Azure Blob Storage native capabilities.
Note: By default the Azure Backend uses ADAL for authentication which is deprecated in favour of MSAL - MSAL can be used by setting use_microsoft_graph to true. The default for this will change in Terraform 1.2, so that MSAL authentication is used by default.
Read more about this backend in the Terraform docs: https://developer.hashicorp.com/terraform/language/settings/backends/azurerm
Initializer
import cdktf
cdktf.AzurermBackendConfig(
container_name: str,
key: str,
storage_account_name: str,
access_key: str = None,
client_certificate_password: str = None,
client_certificate_path: str = None,
client_id: str = None,
client_secret: str = None,
endpoint: str = None,
environment: str = None,
metadata_host: str = None,
msi_endpoint: str = None,
oidc_request_token: str = None,
oidc_request_url: str = None,
oidc_token: str = None,
oidc_token_file_path: str = None,
resource_group_name: str = None,
sas_token: str = None,
snapshot: bool = None,
subscription_id: str = None,
tenant_id: str = None,
use_azuread_auth: bool = None,
use_microsoft_graph: bool = None,
use_msi: bool = None,
use_oidc: bool = None
)
Properties
Name | Type | Description |
---|---|---|
container_name | str | (Required) The Name of the Storage Container within the Storage Account. |
key | str | (Required) The name of the Blob used to retrieve/store Terraform's State file inside the Storage Container. |
storage_account_name | str | (Required) The Name of the Storage Account. |
access_key | str | access_key - (Optional) The Access Key used to access the Blob Storage Account. |
client_certificate_password | str | (Optional) The password associated with the Client Certificate specified in client_certificate_path. |
client_certificate_path | str | (Optional) The path to the PFX file used as the Client Certificate when authenticating as a Service Principal. |
client_id | str | (Optional) The Client ID of the Service Principal. |
client_secret | str | (Optional) The Client Secret of the Service Principal. |
endpoint | str | (Optional) The Custom Endpoint for Azure Resource Manager. This can also be sourced from the ARM_ENDPOINT environment variable. |
environment | str | (Optional) The Azure Environment which should be used. |
metadata_host | str | (Optional) The Hostname of the Azure Metadata Service (for example management.azure.com), used to obtain the Cloud Environment when using a Custom Azure Environment. This can also be sourced from the ARM_METADATA_HOSTNAME Environment Variable.). |
msi_endpoint | str | (Optional) The path to a custom Managed Service Identity endpoint which is automatically determined if not specified. |
oidc_request_token | str | (Optional) The bearer token for the request to the OIDC provider. |
oidc_request_url | str | (Optional) The URL for the OIDC provider from which to request an ID token. |
oidc_token | str | (Optional) The ID token when authenticating using OpenID Connect (OIDC). |
oidc_token_file_path | str | (Optional) The path to a file containing an ID token when authenticating using OpenID Connect (OIDC). |
resource_group_name | str | (Required) The Name of the Resource Group in which the Storage Account exists. |
sas_token | str | (Optional) The SAS Token used to access the Blob Storage Account. |
snapshot | bool | (Optional) Should the Blob used to store the Terraform Statefile be snapshotted before use? |
subscription_id | str | (Optional) The Subscription ID in which the Storage Account exists. |
tenant_id | str | (Optional) The Tenant ID in which the Subscription exists. |
use_azuread_auth | bool | (Optional) Should AzureAD Authentication be used to access the Blob Storage Account. |
use_microsoft_graph | bool | (Optional) Should MSAL be used for authentication instead of ADAL, and should Microsoft Graph be used instead of Azure Active Directory Graph? |
use_msi | bool | (Optional) Should Managed Service Identity authentication be used? |
use_oidc | bool | (Optional) Should OIDC authentication be used? This can also be sourced from the ARM_USE_OIDC environment variable. |
container_name
Required
container_name: str
- Type: str
(Required) The Name of the Storage Container within the Storage Account.
key
Required
key: str
- Type: str
(Required) The name of the Blob used to retrieve/store Terraform's State file inside the Storage Container.
storage_account_name
Required
storage_account_name: str
- Type: str
(Required) The Name of the Storage Account.
access_key
Optional
access_key: str
- Type: str
access_key - (Optional) The Access Key used to access the Blob Storage Account.
This can also be sourced from the ARM_ACCESS_KEY environment variable.
client_certificate_password
Optional
client_certificate_password: str
- Type: str
(Optional) The password associated with the Client Certificate specified in client_certificate_path.
This can also be sourced from the ARM_CLIENT_CERTIFICATE_PASSWORD environment variable.
client_certificate_path
Optional
client_certificate_path: str
- Type: str
(Optional) The path to the PFX file used as the Client Certificate when authenticating as a Service Principal.
This can also be sourced from the ARM_CLIENT_CERTIFICATE_PATH environment variable.
client_id
Optional
client_id: str
- Type: str
(Optional) The Client ID of the Service Principal.
This can also be sourced from the ARM_CLIENT_ID environment variable.
client_secret
Optional
client_secret: str
- Type: str
(Optional) The Client Secret of the Service Principal.
This can also be sourced from the ARM_CLIENT_SECRET environment variable.
endpoint
Optional
endpoint: str
- Type: str
(Optional) The Custom Endpoint for Azure Resource Manager. This can also be sourced from the ARM_ENDPOINT environment variable.
NOTE: An endpoint should only be configured when using Azure Stack.
environment
Optional
environment: str
- Type: str
(Optional) The Azure Environment which should be used.
This can also be sourced from the ARM_ENVIRONMENT environment variable. Possible values are public, china, german, stack and usgovernment. Defaults to public.
metadata_host
Optional
metadata_host: str
- Type: str
(Optional) The Hostname of the Azure Metadata Service (for example management.azure.com), used to obtain the Cloud Environment when using a Custom Azure Environment. This can also be sourced from the ARM_METADATA_HOSTNAME Environment Variable.).
msi_endpoint
Optional
msi_endpoint: str
- Type: str
(Optional) The path to a custom Managed Service Identity endpoint which is automatically determined if not specified.
This can also be sourced from the ARM_MSI_ENDPOINT environment variable.
oidc_request_token
Optional
oidc_request_token: str
- Type: str
(Optional) The bearer token for the request to the OIDC provider.
This can also be sourced from the ARM_OIDC_REQUEST_TOKEN or ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables.
oidc_request_url
Optional
oidc_request_url: str
- Type: str
(Optional) The URL for the OIDC provider from which to request an ID token.
This can also be sourced from the ARM_OIDC_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_URL environment variables.
oidc_token
Optional
oidc_token: str
- Type: str
(Optional) The ID token when authenticating using OpenID Connect (OIDC).
This can also be sourced from the ARM_OIDC_TOKEN environment variable.
oidc_token_file_path
Optional
oidc_token_file_path: str
- Type: str
(Optional) The path to a file containing an ID token when authenticating using OpenID Connect (OIDC).
This can also be sourced from the ARM_OIDC_TOKEN_FILE_PATH environment variable.
resource_group_name
Optional
resource_group_name: str
- Type: str
(Required) The Name of the Resource Group in which the Storage Account exists.
sas_token
Optional
sas_token: str
- Type: str
(Optional) The SAS Token used to access the Blob Storage Account.
This can also be sourced from the ARM_SAS_TOKEN environment variable.
snapshot
Optional
snapshot: bool
- Type: bool
(Optional) Should the Blob used to store the Terraform Statefile be snapshotted before use?
Defaults to false. This value can also be sourced from the ARM_SNAPSHOT environment variable.
subscription_id
Optional
subscription_id: str
- Type: str
(Optional) The Subscription ID in which the Storage Account exists.
This can also be sourced from the ARM_SUBSCRIPTION_ID environment variable.
tenant_id
Optional
tenant_id: str
- Type: str
(Optional) The Tenant ID in which the Subscription exists.
This can also be sourced from the ARM_TENANT_ID environment variable.
use_azuread_auth
Optional
use_azuread_auth: bool
- Type: bool
(Optional) Should AzureAD Authentication be used to access the Blob Storage Account.
This can also be sourced from the ARM_USE_AZUREAD environment variable.
Note: When using AzureAD for Authentication to Storage you also need to ensure the Storage Blob Data Owner role is assigned.
use_microsoft_graph
Optional
use_microsoft_graph: bool
- Type: bool
(Optional) Should MSAL be used for authentication instead of ADAL, and should Microsoft Graph be used instead of Azure Active Directory Graph?
Defaults to true.
Note: In Terraform 1.2 the Azure Backend uses MSAL (and Microsoft Graph) rather than ADAL (and Azure Active Directory Graph) for authentication by default - you can disable this by setting use_microsoft_graph to false. This setting will be removed in Terraform 1.3, due to Microsoft's deprecation of ADAL.
use_msi
Optional
use_msi: bool
- Type: bool
(Optional) Should Managed Service Identity authentication be used?
This can also be sourced from the ARM_USE_MSI environment variable.
use_oidc
Optional
use_oidc: bool
- Type: bool
(Optional) Should OIDC authentication be used? This can also be sourced from the ARM_USE_OIDC environment variable.
Note: When using OIDC for authentication, use_microsoft_graph must be set to true (which is the default).
CloudBackendConfig
The Cloud Backend synthesizes a {@link https://developer.hashicorp.com/terraform/cli/cloud/settings#the-cloud-block cloud block}. The cloud block is a nested block within the top-level terraform settings block. It specifies which Terraform Cloud workspaces to use for the current working directory. The cloud block only affects Terraform CLI's behavior. When Terraform Cloud uses a configuration that contains a cloud block - for example, when a workspace is configured to use a VCS provider directly - it ignores the block and behaves according to its own workspace settings.
https://developer.hashicorp.com/terraform/cli/cloud/settings#arguments
Initializer
import cdktf
cdktf.CloudBackendConfig(
organization: str,
workspaces: typing.Union[NamedCloudWorkspace, TaggedCloudWorkspaces],
hostname: str = None,
token: str = None
)
Properties
Name | Type | Description |
---|---|---|
organization | str | The name of the organization containing the workspace(s) the current configuration should use. |
workspaces | typing.Union[NamedCloudWorkspace, TaggedCloudWorkspaces] | A nested block that specifies which remote Terraform Cloud workspaces to use for the current configuration. |
hostname | str | The hostname of a Terraform Enterprise installation, if using Terraform Enterprise. |
token | str | The token used to authenticate with Terraform Cloud. |
organization
Required
organization: str
- Type: str
The name of the organization containing the workspace(s) the current configuration should use.
workspaces
Required
workspaces: typing.Union[NamedCloudWorkspace, TaggedCloudWorkspaces]
- Type: typing.Union[NamedCloudWorkspace, TaggedCloudWorkspaces]
A nested block that specifies which remote Terraform Cloud workspaces to use for the current configuration.
The workspaces block must contain exactly one of the following arguments, each denoting a strategy for how workspaces should be mapped:
hostname
Optional
hostname: str
- Type: str
- Default: app.terraform.io
The hostname of a Terraform Enterprise installation, if using Terraform Enterprise.
token
Optional
token: str
- Type: str
The token used to authenticate with Terraform Cloud.
We recommend omitting the token from the configuration, and instead using terraform login or manually configuring credentials in the CLI config file.
ConsulBackendConfig
Stores the state in the Consul KV store at a given path. This backend supports state locking.
Read more about this backend in the Terraform docs: https://developer.hashicorp.com/terraform/language/settings/backends/consul
Initializer
import cdktf
cdktf.ConsulBackendConfig(
access_token: str,
path: str,
address: str = None,
ca_file: str = None,
cert_file: str = None,
datacenter: str = None,
gzip: bool = None,
http_auth: str = None,
key_file: str = None,
lock: bool = None,
scheme: str = None
)
Properties
Name | Type | Description |
---|---|---|
access_token | str | (Required) Access token. |
path | str | (Required) Path in the Consul KV store. |
address | str | (Optional) DNS name and port of your Consul endpoint specified in the format dnsname:port. |
ca_file | str | (Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate. |
cert_file | str | (Optional) A path to a PEM-encoded certificate provided to the remote agent; |
datacenter | str | (Optional) The datacenter to use. |
gzip | bool | (Optional) true to compress the state data using gzip, or false (the default) to leave it uncompressed. |
http_auth | str | (Optional) HTTP Basic Authentication credentials to be used when communicating with Consul, in the format of either user or user:pass. |
key_file | str | (Optional) A path to a PEM-encoded private key, required if cert_file is specified. |
lock | bool | (Optional) false to disable locking. |
scheme | str | (Optional) Specifies what protocol to use when talking to the given address,either http or https. |
access_token
Required
access_token: str
- Type: str
(Required) Access token.
path
Required
path: str
- Type: str
(Required) Path in the Consul KV store.
address
Optional
address: str
- Type: str
(Optional) DNS name and port of your Consul endpoint specified in the format dnsname:port.
Defaults to the local agent HTTP listener.
ca_file
Optional
ca_file: str
- Type: str
(Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate.
cert_file
Optional
cert_file: str
- Type: str
(Optional) A path to a PEM-encoded certificate provided to the remote agent;
requires use of key_file.
datacenter
Optional
datacenter: str
- Type: str
(Optional) The datacenter to use.
Defaults to that of the agent.
gzip
Optional
gzip: bool
- Type: bool
(Optional) true to compress the state data using gzip, or false (the default) to leave it uncompressed.
http_auth
Optional
http_auth: str
- Type: str
(Optional) HTTP Basic Authentication credentials to be used when communicating with Consul, in the format of either user or user:pass.
key_file
Optional
key_file: str
- Type: str
(Optional) A path to a PEM-encoded private key, required if cert_file is specified.
lock
Optional
lock: bool
- Type: bool
(Optional) false to disable locking.
This defaults to true, but will require session permissions with Consul and at least kv write permissions on $path/.lock to perform locking.
scheme
Optional
scheme: str
- Type: str
(Optional) Specifies what protocol to use when talking to the given address,either http or https.
SSL support can also be triggered by setting then environment variable CONSUL_HTTP_SSL to true.
CosBackendAssumeRole
Initializer
import cdktf
cdktf.CosBackendAssumeRole(
role_arn: str,
session_duration: typing.Union[int, float],
session_name: str,
policy: typing.Any = None
)
Properties
Name | Type | Description |
---|---|---|
role_arn | str | (Required) The ARN of the role to assume. |
session_duration | typing.Union[int, float] | (Required) The duration of the session when making the AssumeRole call. |
session_name | str | (Required) The session name to use when making the AssumeRole call. |
policy | typing.Any | (Optional) A more restrictive policy when making the AssumeRole call. |
role_arn
Required
role_arn: str
- Type: str
(Required) The ARN of the role to assume.
It can be sourced from the TENCENTCLOUD_ASSUME_ROLE_ARN.
session_duration
Required
session_duration: typing.Union[int, float]
- Type: typing.Union[int, float]
(Required) The duration of the session when making the AssumeRole call.
Its value ranges from 0 to 43200(seconds), and default is 7200 seconds. It can be sourced from the TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION.
session_name
Required
session_name: str
- Type: str
(Required) The session name to use when making the AssumeRole call.
It can be sourced from the TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME.
policy
Optional
policy: typing.Any
- Type: typing.Any
(Optional) A more restrictive policy when making the AssumeRole call.
Its content must not contains principal elements. Please refer to {@link https://www.tencentcloud.com/document/product/598/10603 policies syntax logic}.
CosBackendConfig
Stores the state as an object in a configurable prefix in a given bucket on Tencent Cloud Object Storage (COS).
This backend supports state locking.
Warning! It is highly recommended that you enable Object Versioning on the COS bucket to allow for state recovery in the case of accidental deletions and human error.
Read more about this backend in the Terraform docs: https://developer.hashicorp.com/terraform/language/settings/backends/cos
Initializer
import cdktf
cdktf.CosBackendConfig(
bucket: str,
accelerate: bool = None,
acl: str = None,
assume_role: CosBackendAssumeRole = None,
domain: str = None,
encrypt: bool = None,
endpoint: str = None,
key: str = None,
prefix: str = None,
region: str = None,
secret_id: str = None,
secret_key: str = None,
security_token: str = None
)
Properties
Name | Type | Description |
---|---|---|
bucket | str | (Required) The name of the COS bucket. |
accelerate | bool | (Optional) Whether to enable global Acceleration. |
acl | str | (Optional) Object ACL to be applied to the state file, allows private and public-read. |
assume_role | CosBackendAssumeRole | (Optional) The assume_role block. |
domain | str | (Optional) The root domain of the API request. |
encrypt | bool | (Optional) Whether to enable server side encryption of the state file. |
endpoint | str | (Optional) The Custom Endpoint for the COS backend. |
key | str | (Optional) The path for saving the state file in bucket. |
prefix | str | (Optional) The directory for saving the state file in bucket. |
region | str | (Optional) The region of the COS bucket. |
secret_id | str | (Optional) Secret id of Tencent Cloud. |
secret_key | str | (Optional) Secret key of Tencent Cloud. |
security_token | str | (Optional) TencentCloud Security Token of temporary access credentials. |
bucket
Required
bucket: str
- Type: str
(Required) The name of the COS bucket.
You shall manually create it first.
accelerate
Optional
accelerate: bool
- Type: bool
(Optional) Whether to enable global Acceleration.
Defaults to false.
acl
Optional
acl: str
- Type: str
(Optional) Object ACL to be applied to the state file, allows private and public-read.
Defaults to private.
assume_role
Optional
assume_role: CosBackendAssumeRole
- Type: CosBackendAssumeRole
(Optional) The assume_role block.
If provided, terraform will attempt to assume this role using the supplied credentials.
domain
Optional
domain: str
- Type: str
(Optional) The root domain of the API request.
Defaults to tencentcloudapi.com. It supports the environment variable TENCENTCLOUD_DOMAIN.
encrypt
Optional
encrypt: bool
- Type: bool
(Optional) Whether to enable server side encryption of the state file.
If it is true, COS will use 'AES256' encryption algorithm to encrypt state file.
endpoint
Optional
endpoint: str
- Type: str
(Optional) The Custom Endpoint for the COS backend.
It supports the environment variable TENCENTCLOUD_ENDPOINT.
key
Optional
key: str
- Type: str
(Optional) The path for saving the state file in bucket.
Defaults to terraform.tfstate.
prefix
Optional
prefix: str
- Type: str
(Optional) The directory for saving the state file in bucket.
Default to "env:".
region
Optional
region: str
- Type: str
(Optional) The region of the COS bucket.
It supports environment variables TENCENTCLOUD_REGION.
secret_id
Optional
secret_id: str
- Type: str
(Optional) Secret id of Tencent Cloud.
It supports environment variables TENCENTCLOUD_SECRET_ID.
secret_key
Optional
secret_key: str
- Type: str
(Optional) Secret key of Tencent Cloud.
It supports environment variables TENCENTCLOUD_SECRET_KEY.
security_token
Optional
security_token: str
- Type: str
(Optional) TencentCloud Security Token of temporary access credentials.
It supports environment variables TENCENTCLOUD_SECURITY_TOKEN.
DataConfig
Initializer
import cdktf
cdktf.DataConfig(
connection: typing.Union[SSHProvisionerConnection, WinrmProvisionerConnection] = None,
count: typing.Union[typing.Union[int, float], TerraformCount] = None,
depends_on: typing.List[ITerraformDependable] = None,
for_each: ITerraformIterator = None,
lifecycle: TerraformResourceLifecycle = None,
provider: TerraformProvider = None,
provisioners: typing.List[typing.Union[FileProvisioner, LocalExecProvisioner, RemoteExecProvisioner]] = None,
input: typing.Mapping[typing.Any] = None,
triggers_replace: typing.Mapping[typing.Any] = None
)
Properties
Name | Type | Description |
---|---|---|
connection | typing.Union[SSHProvisionerConnection, WinrmProvisionerConnection] | No description. |
count | typing.Union[typing.Union[int, float], TerraformCount] | No description. |
depends_on | typing.List[ITerraformDependable] | No description. |
for_each | ITerraformIterator | No description. |
lifecycle | TerraformResourceLifecycle | No description. |
provider | TerraformProvider | No description. |
provisioners | typing.List[typing.Union[FileProvisioner, LocalExecProvisioner, RemoteExecProvisioner]] | No description. |
input | typing.Mapping[typing.Any] | (Optional) A value which will be stored in the instance state, and reflected in the output attribute after apply. |
triggers_replace | typing.Mapping[typing.Any] | (Optional) A value which is stored in the instance state, and will force replacement when the value changes. |
connection
Optional
connection: typing.Union[SSHProvisionerConnection, WinrmProvisionerConnection]
- Type: typing.Union[SSHProvisionerConnection, WinrmProvisionerConnection]
count
Optional
count: typing.Union[typing.Union[int, float], TerraformCount]
- Type: typing.Union[typing.Union[int, float], TerraformCount]
depends_on
Optional
depends_on: typing.List[ITerraformDependable]
- Type: typing.List[ITerraformDependable]
for_each
Optional
for_each: ITerraformIterator
- Type: ITerraformIterator
lifecycle
Optional
lifecycle: TerraformResourceLifecycle
provider
Optional
provider: TerraformProvider
- Type: TerraformProvider
provisioners
Optional
provisioners: typing.List[typing.Union[FileProvisioner, LocalExecProvisioner, RemoteExecProvisioner]]
- Type: typing.List[typing.Union[FileProvisioner, LocalExecProvisioner, RemoteExecProvisioner]]
input
Optional
input: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
(Optional) A value which will be stored in the instance state, and reflected in the output attribute after apply.
https://developer.hashicorp.com/terraform/language/resources/terraform-data#input
triggers_replace
Optional
triggers_replace: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
(Optional) A value which is stored in the instance state, and will force replacement when the value changes.
https://developer.hashicorp.com/terraform/language/resources/terraform-data#triggers_replace
DataTerraformRemoteStateAzurermConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateAzurermConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
container_name: str,
key: str,
storage_account_name: str,
access_key: str = None,
client_certificate_password: str = None,
client_certificate_path: str = None,
client_id: str = None,
client_secret: str = None,
endpoint: str = None,
environment: str = None,
metadata_host: str = None,
msi_endpoint: str = None,
oidc_request_token: str = None,
oidc_request_url: str = None,
oidc_token: str = None,
oidc_token_file_path: str = None,
resource_group_name: str = None,
sas_token: str = None,
snapshot: bool = None,
subscription_id: str = None,
tenant_id: str = None,
use_azuread_auth: bool = None,
use_microsoft_graph: bool = None,
use_msi: bool = None,
use_oidc: bool = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
container_name | str | (Required) The Name of the Storage Container within the Storage Account. |
key | str | (Required) The name of the Blob used to retrieve/store Terraform's State file inside the Storage Container. |
storage_account_name | str | (Required) The Name of the Storage Account. |
access_key | str | access_key - (Optional) The Access Key used to access the Blob Storage Account. |
client_certificate_password | str | (Optional) The password associated with the Client Certificate specified in client_certificate_path. |
client_certificate_path | str | (Optional) The path to the PFX file used as the Client Certificate when authenticating as a Service Principal. |
client_id | str | (Optional) The Client ID of the Service Principal. |
client_secret | str | (Optional) The Client Secret of the Service Principal. |
endpoint | str | (Optional) The Custom Endpoint for Azure Resource Manager. This can also be sourced from the ARM_ENDPOINT environment variable. |
environment | str | (Optional) The Azure Environment which should be used. |
metadata_host | str | (Optional) The Hostname of the Azure Metadata Service (for example management.azure.com), used to obtain the Cloud Environment when using a Custom Azure Environment. This can also be sourced from the ARM_METADATA_HOSTNAME Environment Variable.). |
msi_endpoint | str | (Optional) The path to a custom Managed Service Identity endpoint which is automatically determined if not specified. |
oidc_request_token | str | (Optional) The bearer token for the request to the OIDC provider. |
oidc_request_url | str | (Optional) The URL for the OIDC provider from which to request an ID token. |
oidc_token | str | (Optional) The ID token when authenticating using OpenID Connect (OIDC). |
oidc_token_file_path | str | (Optional) The path to a file containing an ID token when authenticating using OpenID Connect (OIDC). |
resource_group_name | str | (Required) The Name of the Resource Group in which the Storage Account exists. |
sas_token | str | (Optional) The SAS Token used to access the Blob Storage Account. |
snapshot | bool | (Optional) Should the Blob used to store the Terraform Statefile be snapshotted before use? |
subscription_id | str | (Optional) The Subscription ID in which the Storage Account exists. |
tenant_id | str | (Optional) The Tenant ID in which the Subscription exists. |
use_azuread_auth | bool | (Optional) Should AzureAD Authentication be used to access the Blob Storage Account. |
use_microsoft_graph | bool | (Optional) Should MSAL be used for authentication instead of ADAL, and should Microsoft Graph be used instead of Azure Active Directory Graph? |
use_msi | bool | (Optional) Should Managed Service Identity authentication be used? |
use_oidc | bool | (Optional) Should OIDC authentication be used? This can also be sourced from the ARM_USE_OIDC environment variable. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
container_name
Required
container_name: str
- Type: str
(Required) The Name of the Storage Container within the Storage Account.
key
Required
key: str
- Type: str
(Required) The name of the Blob used to retrieve/store Terraform's State file inside the Storage Container.
storage_account_name
Required
storage_account_name: str
- Type: str
(Required) The Name of the Storage Account.
access_key
Optional
access_key: str
- Type: str
access_key - (Optional) The Access Key used to access the Blob Storage Account.
This can also be sourced from the ARM_ACCESS_KEY environment variable.
client_certificate_password
Optional
client_certificate_password: str
- Type: str
(Optional) The password associated with the Client Certificate specified in client_certificate_path.
This can also be sourced from the ARM_CLIENT_CERTIFICATE_PASSWORD environment variable.
client_certificate_path
Optional
client_certificate_path: str
- Type: str
(Optional) The path to the PFX file used as the Client Certificate when authenticating as a Service Principal.
This can also be sourced from the ARM_CLIENT_CERTIFICATE_PATH environment variable.
client_id
Optional
client_id: str
- Type: str
(Optional) The Client ID of the Service Principal.
This can also be sourced from the ARM_CLIENT_ID environment variable.
client_secret
Optional
client_secret: str
- Type: str
(Optional) The Client Secret of the Service Principal.
This can also be sourced from the ARM_CLIENT_SECRET environment variable.
endpoint
Optional
endpoint: str
- Type: str
(Optional) The Custom Endpoint for Azure Resource Manager. This can also be sourced from the ARM_ENDPOINT environment variable.
NOTE: An endpoint should only be configured when using Azure Stack.
environment
Optional
environment: str
- Type: str
(Optional) The Azure Environment which should be used.
This can also be sourced from the ARM_ENVIRONMENT environment variable. Possible values are public, china, german, stack and usgovernment. Defaults to public.
metadata_host
Optional
metadata_host: str
- Type: str
(Optional) The Hostname of the Azure Metadata Service (for example management.azure.com), used to obtain the Cloud Environment when using a Custom Azure Environment. This can also be sourced from the ARM_METADATA_HOSTNAME Environment Variable.).
msi_endpoint
Optional
msi_endpoint: str
- Type: str
(Optional) The path to a custom Managed Service Identity endpoint which is automatically determined if not specified.
This can also be sourced from the ARM_MSI_ENDPOINT environment variable.
oidc_request_token
Optional
oidc_request_token: str
- Type: str
(Optional) The bearer token for the request to the OIDC provider.
This can also be sourced from the ARM_OIDC_REQUEST_TOKEN or ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variables.
oidc_request_url
Optional
oidc_request_url: str
- Type: str
(Optional) The URL for the OIDC provider from which to request an ID token.
This can also be sourced from the ARM_OIDC_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_URL environment variables.
oidc_token
Optional
oidc_token: str
- Type: str
(Optional) The ID token when authenticating using OpenID Connect (OIDC).
This can also be sourced from the ARM_OIDC_TOKEN environment variable.
oidc_token_file_path
Optional
oidc_token_file_path: str
- Type: str
(Optional) The path to a file containing an ID token when authenticating using OpenID Connect (OIDC).
This can also be sourced from the ARM_OIDC_TOKEN_FILE_PATH environment variable.
resource_group_name
Optional
resource_group_name: str
- Type: str
(Required) The Name of the Resource Group in which the Storage Account exists.
sas_token
Optional
sas_token: str
- Type: str
(Optional) The SAS Token used to access the Blob Storage Account.
This can also be sourced from the ARM_SAS_TOKEN environment variable.
snapshot
Optional
snapshot: bool
- Type: bool
(Optional) Should the Blob used to store the Terraform Statefile be snapshotted before use?
Defaults to false. This value can also be sourced from the ARM_SNAPSHOT environment variable.
subscription_id
Optional
subscription_id: str
- Type: str
(Optional) The Subscription ID in which the Storage Account exists.
This can also be sourced from the ARM_SUBSCRIPTION_ID environment variable.
tenant_id
Optional
tenant_id: str
- Type: str
(Optional) The Tenant ID in which the Subscription exists.
This can also be sourced from the ARM_TENANT_ID environment variable.
use_azuread_auth
Optional
use_azuread_auth: bool
- Type: bool
(Optional) Should AzureAD Authentication be used to access the Blob Storage Account.
This can also be sourced from the ARM_USE_AZUREAD environment variable.
Note: When using AzureAD for Authentication to Storage you also need to ensure the Storage Blob Data Owner role is assigned.
use_microsoft_graph
Optional
use_microsoft_graph: bool
- Type: bool
(Optional) Should MSAL be used for authentication instead of ADAL, and should Microsoft Graph be used instead of Azure Active Directory Graph?
Defaults to true.
Note: In Terraform 1.2 the Azure Backend uses MSAL (and Microsoft Graph) rather than ADAL (and Azure Active Directory Graph) for authentication by default - you can disable this by setting use_microsoft_graph to false. This setting will be removed in Terraform 1.3, due to Microsoft's deprecation of ADAL.
use_msi
Optional
use_msi: bool
- Type: bool
(Optional) Should Managed Service Identity authentication be used?
This can also be sourced from the ARM_USE_MSI environment variable.
use_oidc
Optional
use_oidc: bool
- Type: bool
(Optional) Should OIDC authentication be used? This can also be sourced from the ARM_USE_OIDC environment variable.
Note: When using OIDC for authentication, use_microsoft_graph must be set to true (which is the default).
DataTerraformRemoteStateConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None
)
Properties
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
DataTerraformRemoteStateConsulConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateConsulConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
access_token: str,
path: str,
address: str = None,
ca_file: str = None,
cert_file: str = None,
datacenter: str = None,
gzip: bool = None,
http_auth: str = None,
key_file: str = None,
lock: bool = None,
scheme: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
access_token | str | (Required) Access token. |
path | str | (Required) Path in the Consul KV store. |
address | str | (Optional) DNS name and port of your Consul endpoint specified in the format dnsname:port. |
ca_file | str | (Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate. |
cert_file | str | (Optional) A path to a PEM-encoded certificate provided to the remote agent; |
datacenter | str | (Optional) The datacenter to use. |
gzip | bool | (Optional) true to compress the state data using gzip, or false (the default) to leave it uncompressed. |
http_auth | str | (Optional) HTTP Basic Authentication credentials to be used when communicating with Consul, in the format of either user or user:pass. |
key_file | str | (Optional) A path to a PEM-encoded private key, required if cert_file is specified. |
lock | bool | (Optional) false to disable locking. |
scheme | str | (Optional) Specifies what protocol to use when talking to the given address,either http or https. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
access_token
Required
access_token: str
- Type: str
(Required) Access token.
path
Required
path: str
- Type: str
(Required) Path in the Consul KV store.
address
Optional
address: str
- Type: str
(Optional) DNS name and port of your Consul endpoint specified in the format dnsname:port.
Defaults to the local agent HTTP listener.
ca_file
Optional
ca_file: str
- Type: str
(Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate.
cert_file
Optional
cert_file: str
- Type: str
(Optional) A path to a PEM-encoded certificate provided to the remote agent;
requires use of key_file.
datacenter
Optional
datacenter: str
- Type: str
(Optional) The datacenter to use.
Defaults to that of the agent.
gzip
Optional
gzip: bool
- Type: bool
(Optional) true to compress the state data using gzip, or false (the default) to leave it uncompressed.
http_auth
Optional
http_auth: str
- Type: str
(Optional) HTTP Basic Authentication credentials to be used when communicating with Consul, in the format of either user or user:pass.
key_file
Optional
key_file: str
- Type: str
(Optional) A path to a PEM-encoded private key, required if cert_file is specified.
lock
Optional
lock: bool
- Type: bool
(Optional) false to disable locking.
This defaults to true, but will require session permissions with Consul and at least kv write permissions on $path/.lock to perform locking.
scheme
Optional
scheme: str
- Type: str
(Optional) Specifies what protocol to use when talking to the given address,either http or https.
SSL support can also be triggered by setting then environment variable CONSUL_HTTP_SSL to true.
DataTerraformRemoteStateCosConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateCosConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
bucket: str,
accelerate: bool = None,
acl: str = None,
assume_role: CosBackendAssumeRole = None,
domain: str = None,
encrypt: bool = None,
endpoint: str = None,
key: str = None,
prefix: str = None,
region: str = None,
secret_id: str = None,
secret_key: str = None,
security_token: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
bucket | str | (Required) The name of the COS bucket. |
accelerate | bool | (Optional) Whether to enable global Acceleration. |
acl | str | (Optional) Object ACL to be applied to the state file, allows private and public-read. |
assume_role | CosBackendAssumeRole | (Optional) The assume_role block. |
domain | str | (Optional) The root domain of the API request. |
encrypt | bool | (Optional) Whether to enable server side encryption of the state file. |
endpoint | str | (Optional) The Custom Endpoint for the COS backend. |
key | str | (Optional) The path for saving the state file in bucket. |
prefix | str | (Optional) The directory for saving the state file in bucket. |
region | str | (Optional) The region of the COS bucket. |
secret_id | str | (Optional) Secret id of Tencent Cloud. |
secret_key | str | (Optional) Secret key of Tencent Cloud. |
security_token | str | (Optional) TencentCloud Security Token of temporary access credentials. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
bucket
Required
bucket: str
- Type: str
(Required) The name of the COS bucket.
You shall manually create it first.
accelerate
Optional
accelerate: bool
- Type: bool
(Optional) Whether to enable global Acceleration.
Defaults to false.
acl
Optional
acl: str
- Type: str
(Optional) Object ACL to be applied to the state file, allows private and public-read.
Defaults to private.
assume_role
Optional
assume_role: CosBackendAssumeRole
- Type: CosBackendAssumeRole
(Optional) The assume_role block.
If provided, terraform will attempt to assume this role using the supplied credentials.
domain
Optional
domain: str
- Type: str
(Optional) The root domain of the API request.
Defaults to tencentcloudapi.com. It supports the environment variable TENCENTCLOUD_DOMAIN.
encrypt
Optional
encrypt: bool
- Type: bool
(Optional) Whether to enable server side encryption of the state file.
If it is true, COS will use 'AES256' encryption algorithm to encrypt state file.
endpoint
Optional
endpoint: str
- Type: str
(Optional) The Custom Endpoint for the COS backend.
It supports the environment variable TENCENTCLOUD_ENDPOINT.
key
Optional
key: str
- Type: str
(Optional) The path for saving the state file in bucket.
Defaults to terraform.tfstate.
prefix
Optional
prefix: str
- Type: str
(Optional) The directory for saving the state file in bucket.
Default to "env:".
region
Optional
region: str
- Type: str
(Optional) The region of the COS bucket.
It supports environment variables TENCENTCLOUD_REGION.
secret_id
Optional
secret_id: str
- Type: str
(Optional) Secret id of Tencent Cloud.
It supports environment variables TENCENTCLOUD_SECRET_ID.
secret_key
Optional
secret_key: str
- Type: str
(Optional) Secret key of Tencent Cloud.
It supports environment variables TENCENTCLOUD_SECRET_KEY.
security_token
Optional
security_token: str
- Type: str
(Optional) TencentCloud Security Token of temporary access credentials.
It supports environment variables TENCENTCLOUD_SECURITY_TOKEN.
DataTerraformRemoteStateGcsConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateGcsConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
bucket: str,
access_token: str = None,
credentials: str = None,
encryption_key: str = None,
impersonate_service_account: str = None,
impersonate_service_account_delegates: typing.List[str] = None,
kms_encryption_key: str = None,
prefix: str = None,
storeage_custom_endpoint: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
bucket | str | (Required) The name of the GCS bucket. |
access_token | str | (Optional) A temporary [OAuth 2.0 access token] obtained from the Google Authorization server, i.e. the Authorization: Bearer token used to authenticate HTTP requests to GCP APIs. This is an alternative to credentials. If both are specified, access_token will be used over the credentials field. |
credentials | str | (Optional) Local path to Google Cloud Platform account credentials in JSON format. |
encryption_key | str | (Optional) A 32 byte base64 encoded 'customer supplied encryption key' used to encrypt all state. |
impersonate_service_account | str | (Optional) The service account to impersonate for accessing the State Bucket. |
impersonate_service_account_delegates | typing.List[str] | (Optional) The delegation chain for an impersonating a service account. |
kms_encryption_key | str | (Optional) A Cloud KMS key ('customer-managed encryption key') used when reading and writing state files in the bucket. |
prefix | str | (Optional) GCS prefix inside the bucket. |
storeage_custom_endpoint | str | (Optional) A URL containing three parts: the protocol, the DNS name pointing to a Private Service Connect endpoint, and the path for the Cloud Storage API (/storage/v1/b). |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
bucket
Required
bucket: str
- Type: str
(Required) The name of the GCS bucket.
This name must be globally unique.
access_token
Optional
access_token: str
- Type: str
(Optional) A temporary [OAuth 2.0 access token] obtained from the Google Authorization server, i.e. the Authorization: Bearer token used to authenticate HTTP requests to GCP APIs. This is an alternative to credentials. If both are specified, access_token will be used over the credentials field.
credentials
Optional
credentials: str
- Type: str
(Optional) Local path to Google Cloud Platform account credentials in JSON format.
If unset, Google Application Default Credentials are used. The provided credentials must have Storage Object Admin role on the bucket.
Warning: if using the Google Cloud Platform provider as well, it will also pick up the GOOGLE_CREDENTIALS environment variable.
encryption_key
Optional
encryption_key: str
- Type: str
(Optional) A 32 byte base64 encoded 'customer supplied encryption key' used to encrypt all state.
impersonate_service_account
Optional
impersonate_service_account: str
- Type: str
(Optional) The service account to impersonate for accessing the State Bucket.
You must have roles/iam.serviceAccountTokenCreator role on that account for the impersonation to succeed. If you are using a delegation chain, you can specify that using the impersonate_service_account_delegates field. Alternatively, this can be specified using the GOOGLE_IMPERSONATE_SERVICE_ACCOUNT environment variable.
impersonate_service_account_delegates
Optional
impersonate_service_account_delegates: typing.List[str]
- Type: typing.List[str]
(Optional) The delegation chain for an impersonating a service account.
kms_encryption_key
Optional
kms_encryption_key: str
- Type: str
(Optional) A Cloud KMS key ('customer-managed encryption key') used when reading and writing state files in the bucket.
Format should be projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{name}}. For more information, including IAM requirements, see {@link https://cloud.google.com/storage/docs/encryption/customer-managed-keys Customer-managed Encryption Keys}.
prefix
Optional
prefix: str
- Type: str
(Optional) GCS prefix inside the bucket.
Named states for workspaces are stored in an object called < prefix >/< name >.tfstate.
storeage_custom_endpoint
Optional
storeage_custom_endpoint: str
- Type: str
(Optional) A URL containing three parts: the protocol, the DNS name pointing to a Private Service Connect endpoint, and the path for the Cloud Storage API (/storage/v1/b).
{@link https://developer.hashicorp.com/terraform/language/settings/backends/gcs#storage_custom_endpoint See here for more details}
DataTerraformRemoteStateHttpConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateHttpConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
address: str,
client_ca_certificate_pem: str = None,
client_certificate_pem: str = None,
client_private_key_pem: str = None,
lock_address: str = None,
lock_method: str = None,
password: str = None,
retry_max: typing.Union[int, float] = None,
retry_wait_max: typing.Union[int, float] = None,
retry_wait_min: typing.Union[int, float] = None,
skip_cert_verification: bool = None,
unlock_address: str = None,
unlock_method: str = None,
update_method: str = None,
username: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
address | str | (Required) The address of the REST endpoint. |
client_ca_certificate_pem | str | (Optional) A PEM-encoded CA certificate chain used by the client to verify server certificates during TLS authentication. |
client_certificate_pem | str | (Optional) A PEM-encoded certificate used by the server to verify the client during mutual TLS (mTLS) authentication. |
client_private_key_pem | str | (Optional) A PEM-encoded private key, required if client_certificate_pem is specified. |
lock_address | str | (Optional) The address of the lock REST endpoint. |
lock_method | str | (Optional) The HTTP method to use when locking. |
password | str | (Optional) The password for HTTP basic authentication. |
retry_max | typing.Union[int, float] | (Optional) The number of HTTP request retries. |
retry_wait_max | typing.Union[int, float] | (Optional) The maximum time in seconds to wait between HTTP request attempts. |
retry_wait_min | typing.Union[int, float] | (Optional) The minimum time in seconds to wait between HTTP request attempts. |
skip_cert_verification | bool | (Optional) Whether to skip TLS verification. |
unlock_address | str | (Optional) The address of the unlock REST endpoint. |
unlock_method | str | (Optional) The HTTP method to use when unlocking. |
update_method | str | (Optional) HTTP method to use when updating state. |
username | str | (Optional) The username for HTTP basic authentication. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
address
Required
address: str
- Type: str
(Required) The address of the REST endpoint.
client_ca_certificate_pem
Optional
client_ca_certificate_pem: str
- Type: str
(Optional) A PEM-encoded CA certificate chain used by the client to verify server certificates during TLS authentication.
client_certificate_pem
Optional
client_certificate_pem: str
- Type: str
(Optional) A PEM-encoded certificate used by the server to verify the client during mutual TLS (mTLS) authentication.
client_private_key_pem
Optional
client_private_key_pem: str
- Type: str
(Optional) A PEM-encoded private key, required if client_certificate_pem is specified.
lock_address
Optional
lock_address: str
- Type: str
(Optional) The address of the lock REST endpoint.
Defaults to disabled.
lock_method
Optional
lock_method: str
- Type: str
(Optional) The HTTP method to use when locking.
Defaults to LOCK.
password
Optional
password: str
- Type: str
(Optional) The password for HTTP basic authentication.
retry_max
Optional
retry_max: typing.Union[int, float]
- Type: typing.Union[int, float]
(Optional) The number of HTTP request retries.
Defaults to 2.
retry_wait_max
Optional
retry_wait_max: typing.Union[int, float]
- Type: typing.Union[int, float]
(Optional) The maximum time in seconds to wait between HTTP request attempts.
Defaults to 30.
retry_wait_min
Optional
retry_wait_min: typing.Union[int, float]
- Type: typing.Union[int, float]
(Optional) The minimum time in seconds to wait between HTTP request attempts.
Defaults to 1.
skip_cert_verification
Optional
skip_cert_verification: bool
- Type: bool
(Optional) Whether to skip TLS verification.
Defaults to false.
unlock_address
Optional
unlock_address: str
- Type: str
(Optional) The address of the unlock REST endpoint.
Defaults to disabled.
unlock_method
Optional
unlock_method: str
- Type: str
(Optional) The HTTP method to use when unlocking.
Defaults to UNLOCK.
update_method
Optional
update_method: str
- Type: str
(Optional) HTTP method to use when updating state.
Defaults to POST.
username
Optional
username: str
- Type: str
(Optional) The username for HTTP basic authentication.
DataTerraformRemoteStateLocalConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateLocalConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
path: str = None,
workspace_dir: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
path | str | Path where the state file is stored. |
workspace_dir | str | (Optional) The path to non-default workspaces. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
path
Optional
path: str
- Type: str
- Default: defaults to terraform.${stackId}.tfstate
Path where the state file is stored.
workspace_dir
Optional
workspace_dir: str
- Type: str
(Optional) The path to non-default workspaces.
DataTerraformRemoteStateOssConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateOssConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
bucket: str,
access_key: str = None,
acl: str = None,
assume_role: OssAssumeRole = None,
assume_role_policy: str = None,
assume_role_role_arn: str = None,
assume_role_session_expiration: typing.Union[int, float] = None,
assume_role_session_name: str = None,
ecs_role_name: str = None,
encrypt: bool = None,
endpoint: str = None,
key: str = None,
prefix: str = None,
profile: str = None,
region: str = None,
secret_key: str = None,
security_token: str = None,
shared_credentials_file: str = None,
sts_endpoint: str = None,
tablestore_endpoint: str = None,
tablestore_table: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
bucket | str | (Required) The name of the OSS bucket. |
access_key | str | (Optional) Alibaba Cloud access key. |
acl | str | (Optional) Object ACL to be applied to the state file. |
assume_role | OssAssumeRole | No description. |
assume_role_policy | str | (Optional, Available in 1.1.0+) A more restrictive policy to apply to the temporary credentials. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use this policy to grant permissions that exceed those of the role that is being assumed. |
assume_role_role_arn | str | (Optional, Available in 1.1.0+) The ARN of the role to assume. If ARN is set to an empty string, it does not perform role switching. It supports the environment variable ALICLOUD_ASSUME_ROLE_ARN. Terraform executes configuration on account with provided credentials. |
assume_role_session_expiration | typing.Union[int, float] | (Optional, Available in 1.1.0+) The time after which the established session for assuming role expires. Valid value range: [900-3600] seconds. Default to 3600 (in this case Alibaba Cloud uses its own default value). It supports environment variable ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION. |
assume_role_session_name | str | (Optional, Available in 1.1.0+) The session name to use when assuming the role. If omitted, 'terraform' is passed to the AssumeRole call as session name. It supports environment variable ALICLOUD_ASSUME_ROLE_SESSION_NAME. |
ecs_role_name | str | (Optional, Available in 0.12.14+) The RAM Role Name attached on a ECS instance for API operations. You can retrieve this from the 'Access Control' section of the Alibaba Cloud console. |
encrypt | bool | (Optional) Whether to enable server side encryption of the state file. |
endpoint | str | (Optional) A custom endpoint for the OSS API. |
key | str | (Optional) The name of the state file. |
prefix | str | (Optional) The path directory of the state file will be stored. |
profile | str | (Optional, Available in 0.12.8+) This is the Alibaba Cloud profile name as set in the shared credentials file. It can also be sourced from the ALICLOUD_PROFILE environment variable. |
region | str | (Optional) The region of the OSS bucket. |
secret_key | str | (Optional) Alibaba Cloud secret access key. |
security_token | str | (Optional) STS access token. |
shared_credentials_file | str | (Optional, Available in 0.12.8+) This is the path to the shared credentials file. It can also be sourced from the ALICLOUD_SHARED_CREDENTIALS_FILE environment variable. If this is not set and a profile is specified, ~/.aliyun/config.json will be used. |
sts_endpoint | str | (Optional, Available in 1.0.11+) Custom endpoint for the AliCloud Security Token Service (STS) API. It supports environment variable ALICLOUD_STS_ENDPOINT. |
tablestore_endpoint | str | (Optional) A custom endpoint for the TableStore API. |
tablestore_table | str | (Optional) A TableStore table for state locking and consistency. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
bucket
Required
bucket: str
- Type: str
(Required) The name of the OSS bucket.
access_key
Optional
access_key: str
- Type: str
(Optional) Alibaba Cloud access key.
It supports environment variables ALICLOUD_ACCESS_KEY and ALICLOUD_ACCESS_KEY_ID.
acl
Optional
acl: str
- Type: str
(Optional) Object ACL to be applied to the state file.
assume_role
Optional
assume_role
- Deprecated: Use flattened assume role options
assume_role: OssAssumeRole
- Type: OssAssumeRole
assume_role_policy
Optional
assume_role_policy: str
- Type: str
(Optional, Available in 1.1.0+) A more restrictive policy to apply to the temporary credentials. This gives you a way to further restrict the permissions for the resulting temporary security credentials. You cannot use this policy to grant permissions that exceed those of the role that is being assumed.
assume_role_role_arn
Optional
assume_role_role_arn: str
- Type: str
(Optional, Available in 1.1.0+) The ARN of the role to assume. If ARN is set to an empty string, it does not perform role switching. It supports the environment variable ALICLOUD_ASSUME_ROLE_ARN. Terraform executes configuration on account with provided credentials.
assume_role_session_expiration
Optional
assume_role_session_expiration: typing.Union[int, float]
- Type: typing.Union[int, float]
(Optional, Available in 1.1.0+) The time after which the established session for assuming role expires. Valid value range: [900-3600] seconds. Default to 3600 (in this case Alibaba Cloud uses its own default value). It supports environment variable ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION.
assume_role_session_name
Optional
assume_role_session_name: str
- Type: str
(Optional, Available in 1.1.0+) The session name to use when assuming the role. If omitted, 'terraform' is passed to the AssumeRole call as session name. It supports environment variable ALICLOUD_ASSUME_ROLE_SESSION_NAME.
ecs_role_name
Optional
ecs_role_name: str
- Type: str
(Optional, Available in 0.12.14+) The RAM Role Name attached on a ECS instance for API operations. You can retrieve this from the 'Access Control' section of the Alibaba Cloud console.
encrypt
Optional
encrypt: bool
- Type: bool
(Optional) Whether to enable server side encryption of the state file.
If it is true, OSS will use 'AES256' encryption algorithm to encrypt state file.
endpoint
Optional
endpoint: str
- Type: str
(Optional) A custom endpoint for the OSS API.
It supports environment variables ALICLOUD_OSS_ENDPOINT and OSS_ENDPOINT.
key
Optional
key: str
- Type: str
(Optional) The name of the state file.
Defaults to terraform.tfstate.
prefix
Optional
prefix: str
- Type: str
(Optional) The path directory of the state file will be stored.
Default to "env:".
profile
Optional
profile: str
- Type: str
(Optional, Available in 0.12.8+) This is the Alibaba Cloud profile name as set in the shared credentials file. It can also be sourced from the ALICLOUD_PROFILE environment variable.
region
Optional
region: str
- Type: str
(Optional) The region of the OSS bucket.
It supports environment variables ALICLOUD_REGION and ALICLOUD_DEFAULT_REGION.
secret_key
Optional
secret_key: str
- Type: str
(Optional) Alibaba Cloud secret access key.
It supports environment variables ALICLOUD_SECRET_KEY and ALICLOUD_ACCESS_KEY_SECRET.
security_token
Optional
security_token: str
- Type: str
(Optional) STS access token.
It supports environment variable ALICLOUD_SECURITY_TOKEN.
shared_credentials_file
Optional
shared_credentials_file: str
- Type: str
(Optional, Available in 0.12.8+) This is the path to the shared credentials file. It can also be sourced from the ALICLOUD_SHARED_CREDENTIALS_FILE environment variable. If this is not set and a profile is specified, ~/.aliyun/config.json will be used.
sts_endpoint
Optional
sts_endpoint: str
- Type: str
(Optional, Available in 1.0.11+) Custom endpoint for the AliCloud Security Token Service (STS) API. It supports environment variable ALICLOUD_STS_ENDPOINT.
tablestore_endpoint
Optional
tablestore_endpoint: str
- Type: str
(Optional) A custom endpoint for the TableStore API.
tablestore_table
Optional
tablestore_table: str
- Type: str
(Optional) A TableStore table for state locking and consistency.
The table must have a primary key named LockID of type String.
DataTerraformRemoteStatePgConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStatePgConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
conn_str: str,
schema_name: str = None,
skip_index_creation: bool = None,
skip_schema_creation: bool = None,
skip_table_creation: bool = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
conn_str | str | Postgres connection string; |
schema_name | str | Name of the automatically-managed Postgres schema, default to terraform_remote_state. |
skip_index_creation | bool | If set to true, the Postgres index must already exist. |
skip_schema_creation | bool | If set to true, the Postgres schema must already exist. |
skip_table_creation | bool | If set to true, the Postgres table must already exist. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
conn_str
Required
conn_str: str
- Type: str
Postgres connection string;
a postgres:// URL. The PG_CONN_STR and standard libpq environment variables can also be used to indicate how to connect to the PostgreSQL database.
schema_name
Optional
schema_name: str
- Type: str
Name of the automatically-managed Postgres schema, default to terraform_remote_state.
Can also be set using the PG_SCHEMA_NAME environment variable.
skip_index_creation
Optional
skip_index_creation: bool
- Type: bool
If set to true, the Postgres index must already exist.
Can also be set using the PG_SKIP_INDEX_CREATION environment variable. Terraform won't try to create the index, this is useful when it has already been created by a database administrator.
skip_schema_creation
Optional
skip_schema_creation: bool
- Type: bool
If set to true, the Postgres schema must already exist.
Can also be set using the PG_SKIP_SCHEMA_CREATION environment variable. Terraform won't try to create the schema, this is useful when it has already been created by a database administrator.
skip_table_creation
Optional
skip_table_creation: bool
- Type: bool
If set to true, the Postgres table must already exist.
Can also be set using the PG_SKIP_TABLE_CREATION environment variable. Terraform won't try to create the table, this is useful when it has already been created by a database administrator.
DataTerraformRemoteStateRemoteConfig
Initializer
import cdktf
cdktf.DataTerraformRemoteStateRemoteConfig(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
organization: str,
workspaces: IRemoteWorkspace,
hostname: str = None,
token: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
organization | str | No description. |
workspaces | IRemoteWorkspace | No description. |
hostname | str | No description. |
token | str | No description. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
organization
Required
organization: str
- Type: str
workspaces
Required
workspaces: IRemoteWorkspace
- Type: IRemoteWorkspace
hostname
Optional
hostname: str
- Type: str
token
Optional
token: str
- Type: str
DataTerraformRemoteStateS3Config
Initializer
import cdktf
cdktf.DataTerraformRemoteStateS3Config(
defaults: typing.Mapping[typing.Any] = None,
workspace: str = None,
bucket: str,
key: str,
access_key: str = None,
acl: str = None,
allowed_account_ids: typing.List[str] = None,
assume_role: S3BackendAssumeRoleConfig = None,
assume_role_policy: str = None,
assume_role_policy_arns: typing.List[str] = None,
assume_role_tags: typing.Mapping[str] = None,
assume_role_transitive_tag_keys: typing.List[str] = None,
assume_role_with_web_identity: S3BackendAssumeRoleWithWebIdentityConfig = None,
custom_ca_bundle: str = None,
dynamodb_endpoint: str = None,
dynamodb_table: str = None,
ec2_metadata_service_endpoint: str = None,
ec2_metadata_service_endpoint_mode: str = None,
encrypt: bool = None,
endpoint: str = None,
endpoints: S3BackendEndpointConfig = None,
external_id: str = None,
forbidden_account_ids: typing.List[str] = None,
force_path_style: bool = None,
http_proxy: str = None,
https_proxy: str = None,
iam_endpoint: str = None,
insecure: bool = None,
kms_key_id: str = None,
max_retries: typing.Union[int, float] = None,
no_proxy: str = None,
profile: str = None,
region: str = None,
retry_mode: str = None,
role_arn: str = None,
secret_key: str = None,
session_name: str = None,
shared_config_files: typing.List[str] = None,
shared_credentials_file: str = None,
shared_credentials_files: typing.List[str] = None,
skip_credentials_validation: bool = None,
skip_metadata_api_check: bool = None,
skip_region_validation: bool = None,
skip_requesting_account_id: bool = None,
skip_s3_checksum: bool = None,
sse_customer_key: str = None,
sts_endpoint: str = None,
sts_region: str = None,
token: str = None,
use_legacy_workflow: bool = None,
use_path_style: bool = None,
workspace_key_prefix: str = None
)
Properties
Name | Type | Description |
---|---|---|
defaults | typing.Mapping[typing.Any] | No description. |
workspace | str | No description. |
bucket | str | Name of the S3 Bucket. |
key | str | Path to the state file inside the S3 Bucket. |
access_key | str | (Optional) AWS access key. |
acl | str | (Optional) Canned ACL to be applied to the state file. |
allowed_account_ids | typing.List[str] | (Optional) List of allowed AWS account IDs to prevent potential destruction of a live environment. |
assume_role | S3BackendAssumeRoleConfig | Assuming an IAM Role can be configured in two ways. |
assume_role_policy | str | (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed. |
assume_role_policy_arns | typing.List[str] | (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed. |
assume_role_tags | typing.Mapping[str] | (Optional) Map of assume role session tags. |
assume_role_transitive_tag_keys | typing.List[str] | (Optional) Set of assume role session tag keys to pass to any subsequent sessions. |
assume_role_with_web_identity | S3BackendAssumeRoleWithWebIdentityConfig | Assume Role With Web Identity Configuration. |
custom_ca_bundle | str | (Optional) File containing custom root and intermediate certificates. |
dynamodb_endpoint | str | (Optional) Custom endpoint for the AWS DynamoDB API. |
dynamodb_table | str | (Optional) Name of DynamoDB Table to use for state locking and consistency. |
ec2_metadata_service_endpoint | str | Optional) Custom endpoint URL for the EC2 Instance Metadata Service (IMDS) API. |
ec2_metadata_service_endpoint_mode | str | (Optional) Mode to use in communicating with the metadata service. |
encrypt | bool | (Optional) Enable server side encryption of the state file. |
endpoint | str | (Optional) Custom endpoint for the AWS S3 API. |
endpoints | S3BackendEndpointConfig | (Optional) The endpoint configuration block. |
external_id | str | (Optional) External identifier to use when assuming the role. |
forbidden_account_ids | typing.List[str] | (Optional) List of forbidden AWS account IDs to prevent potential destruction of a live environment. |
force_path_style | bool | (Optional) Enable path-style S3 URLs (https://< HOST >/< BUCKET > instead of https://< BUCKET >.< HOST >). |
http_proxy | str | (Optional) URL of a proxy to use for HTTP requests when accessing the AWS API. |
https_proxy | str | (Optional) URL of a proxy to use for HTTPS requests when accessing the AWS API. |
iam_endpoint | str | (Optional) Custom endpoint for the AWS Identity and Access Management (IAM) API. |
insecure | bool | Optional) Whether to explicitly allow the backend to perform "insecure" SSL requests. |
kms_key_id | str | (Optional) Amazon Resource Name (ARN) of a Key Management Service (KMS) Key to use for encrypting the state. |
max_retries | typing.Union[int, float] | (Optional) The maximum number of times an AWS API request is retried on retryable failure. |
no_proxy | str | (Optional) Comma-separated list of hosts that should not use HTTP or HTTPS proxies. |
profile | str | (Optional) Name of AWS profile in AWS shared credentials file (e.g. ~/.aws/credentials) or AWS shared configuration file (e.g. ~/.aws/config) to use for credentials and/or configuration. This can also be sourced from the AWS_PROFILE environment variable. |
region | str | AWS Region of the S3 Bucket and DynamoDB Table (if used). |
retry_mode | str | (Optional) Specifies how retries are attempted. |
role_arn | str | (Optional) Amazon Resource Name (ARN) of the IAM Role to assume. |
secret_key | str | (Optional) AWS secret access key. |
session_name | str | (Optional) Session name to use when assuming the role. |
shared_config_files | typing.List[str] | (Optional) List of paths to AWS shared configuration files. |
shared_credentials_file | str | (Optional) Path to the AWS shared credentials file. |
shared_credentials_files | typing.List[str] | (Optional) List of paths to AWS shared credentials files. |
skip_credentials_validation | bool | (Optional) Skip credentials validation via the STS API. |
skip_metadata_api_check | bool | (Optional) Skip usage of EC2 Metadata API. |
skip_region_validation | bool | (Optional) Skip validation of provided region name. |
skip_requesting_account_id | bool | (Optional) Whether to skip requesting the account ID. |
skip_s3_checksum | bool | (Optional) Do not include checksum when uploading S3 Objects. |
sse_customer_key | str | (Optional) The key to use for encrypting state with Server-Side Encryption with Customer-Provided Keys (SSE-C). |
sts_endpoint | str | (Optional) Custom endpoint for the AWS Security Token Service (STS) API. |
sts_region | str | (Optional) AWS region for STS. |
token | str | (Optional) Multi-Factor Authentication (MFA) token. |
use_legacy_workflow | bool | (Optional) Use the legacy authentication workflow, preferring environment variables over backend configuration. |
use_path_style | bool | (Optional) Enable path-style S3 URLs (https://< HOST >/< BUCKET > instead of https://< BUCKET >.< HOST >). |
workspace_key_prefix | str | (Optional) Prefix applied to the state path inside the bucket. |
defaults
Optional
defaults: typing.Mapping[typing.Any]
- Type: typing.Mapping[typing.Any]
workspace
Optional
workspace: str
- Type: str
bucket
Required
bucket: str
- Type: str
Name of the S3 Bucket.
key
Required
key: str
- Type: str
Path to the state file inside the S3 Bucket.
When using a non-default workspace, the state path will be /workspace_key_prefix/workspace_name/key
access_key
Optional
access_key: str
- Type: str
(Optional) AWS access key.
If configured, must also configure secret_key. This can also be sourced from the AWS_ACCESS_KEY_ID environment variable, AWS shared credentials file (e.g. ~/.aws/credentials), or AWS shared configuration file (e.g. ~/.aws/config).
acl
Optional
acl: str
- Type: str
(Optional) Canned ACL to be applied to the state file.
allowed_account_ids
Optional
allowed_account_ids: typing.List[str]
- Type: typing.List[str]
(Optional) List of allowed AWS account IDs to prevent potential destruction of a live environment.
Conflicts with forbidden_account_ids.