• HashiCorp Developer

  • HashiCorp Cloud Platform
  • Terraform
  • Packer
  • Consul
  • Vault
  • Boundary
  • Nomad
  • Waypoint
  • Vagrant
Terraform
  • Install
  • Tutorials
    • About the Docs
    • Configuration Language
    • Terraform CLI
    • Terraform Cloud
    • Terraform Enterprise
    • CDK for Terraform
    • Provider Use
    • Plugin Development
    • Registry Publishing
    • Integration Program
  • Registry(opens in new tab)
  • Try Cloud(opens in new tab)
  • Sign up
Terraform Home

Configuration Language

Skip to main content
  • Configuration Language
  • Data Sources
    • Overview
    • Terraform Cloud
      • Backend Configuration
        • local
        • remote
        • azurerm
        • consul
        • cos
        • gcs
        • http
        • Kubernetes
        • oss
        • pg
        • s3
  • Upgrading to Terraform v1.3
  • v1.x Compatibility Promises

  • Terraform Internals

  • Resources

  • Tutorial Library
  • Certifications
  • Community Forum
    (opens in new tab)
  • Support
    (opens in new tab)
  • GitHub
    (opens in new tab)
  • Terraform Registry
    (opens in new tab)
  1. Developer
  2. Terraform
  3. Configuration Language
  4. Terraform Settings
  5. Backends
  6. consul
  • Terraform
  • v1.2.x
  • v1.1 and earlier

»consul

Stores the state in the Consul KV store at a given path.

This backend supports state locking.

Example Configuration

terraform {
  backend "consul" {
    address = "consul.example.com"
    scheme  = "https"
    path    = "full/path"
  }
}

Note that for the access credentials we recommend using a partial configuration.

Data Source Configuration

data "terraform_remote_state" "foo" {
  backend = "consul"
  config = {
    path = "full/path"
  }
}

Configuration Variables

Warning: We recommend using environment variables to supply credentials and other sensitive data. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. Refer to Credentials and Sensitive Data for details.

The following configuration options / environment variables are supported:

  • path - (Required) Path in the Consul KV store
  • access_token / CONSUL_HTTP_TOKEN - (Required) Access token
  • address / CONSUL_HTTP_ADDR - (Optional) DNS name and port of your Consul endpoint specified in the format dnsname:port. Defaults to the local agent HTTP listener.
  • scheme - (Optional) Specifies what protocol to use when talking to the given address, either http or https. SSL support can also be triggered by setting then environment variable CONSUL_HTTP_SSL to true.
  • datacenter - (Optional) The datacenter to use. Defaults to that of the agent.
  • http_auth / CONSUL_HTTP_AUTH - (Optional) HTTP Basic Authentication credentials to be used when communicating with Consul, in the format of either user or user:pass.
  • gzip - (Optional) true to compress the state data using gzip, or false (the default) to leave it uncompressed.
  • lock - (Optional) false to disable locking. This defaults to true, but will require session permissions with Consul and at least kv write permissions on $path/.lock to perform locking.
  • ca_file / CONSUL_CACERT - (Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate.
  • cert_file / CONSUL_CLIENT_CERT - (Optional) A path to a PEM-encoded certificate provided to the remote agent; requires use of key_file.
  • key_file / CONSUL_CLIENT_KEY - (Optional) A path to a PEM-encoded private key, required if cert_file is specified.
Edit this page on GitHub

On this page

  1. consul
  2. Example Configuration
  3. Data Source Configuration
  4. Configuration Variables
Give Feedback(opens in new tab)
  • Certifications
  • System Status
  • Terms of Use
  • Security
  • Privacy
  • Trademark Policy
  • Trade Controls
  • Give Feedback(opens in new tab)