3

In my CI environment (Bitbucket pipelines) I'm trying to use the new Terraform Cloud remote state management. The announcement video clearly states you can use environment variables instead of the .terraformrc file to pass your API token. However, I cannot find any documentation on the exact environment variable I have to use.

I followed the getting started guide about Terraform Cloud, but there they also don't mention anything about environment variables.

I also looked at the environment variables section of the Terraform documentation, but there was also no mentioning of how to set (or override) the cli configuration.

7
  • Could you add the commands you used to the Q&A to prevent that they get lost if the links get deprecated?
    – 030
    Jul 17, 2019 at 18:19
  • What version of terraform do you use?
    – 030
    Jul 17, 2019 at 18:21
  • So you created an account on terraform enterprise?
    – 030
    Jul 17, 2019 at 18:22
  • Did you check the issue list or create an issue on the terraform github?
    – 030
    Jul 17, 2019 at 18:24
  • @030, I did check the github issues before posting a question here, however asking the question here seemed more logical.
    – jorianvo
    Jul 18, 2019 at 7:23

4 Answers 4

4

This can be done with environment variables of the form TF_TOKEN_${sanitized_hostname}.

For example for Terraform Cloud:

export TF_TOKEN_app_terraform_io=xxxxxx.atlasv1.zzzzzzzzzzzzz

terraform apply

This takes precedence over any terraform login or .tfrc file. It is documented under the developer CLI config pages.

2

If you are using the Terraform Cloud/Enterprise provider, you could set the TFE_TOKEN environment variable.

Alternatively, you could write the terraform config file temporarily during the build, e.g.:

# Set environment variable
MY_TF_TOKEN='abc.123.abc123'

# Create .terraformrc with credential config for user
cat >~/.terraformrc <<EOL
credentials "app.terraform.io" {
  token = "${TF_CLOUD_TOKEN}"
}
EOL

Otherwise, you could (but not recommended) manipulate the credentials.tfrc.json in ~/.terraform.d but beware that this may be overwritten when running terraform commands. For example using jq in bash:

# Set environment variable
MY_TF_TOKEN='abc.123.abc123'

# Create json from environment variable and (over)write expected file 
jq --arg token $MY_TF_TOKEN \
    '{"credentials":{"app.terraform.io":{"token": $token}}}' \
    > ~/.terraform.d/credentials.tfrc.json

You should get the following when e.g. running cat ~/.terraform.d/credentials.tfrc.json:

{
  "credentials": {
    "app.terraform.io": {
      "token": "abc.123.abc123"
    }
  }
}
0

In the video they don't specify whether terraform expects a certain variable of not. One thing you can do however, is use the method to pass arbitrary environment variables, as long as their name starts with TF_VAR_ (example: TF_VAR_myvar). Then in your terraform files (in this example the terraformrc file) declare the variable with this line:

variable myvar {}

Then you can use it instead of hardcoded token value with this syntax: ${var.myvar}

2
  • Thank your for your answer, I'll try and let you know!
    – jorianvo
    Jul 18, 2019 at 14:18
  • So I tried and (after reading the documentation) agreed it should work, but it sadly does not.
    – jorianvo
    Jul 18, 2019 at 15:36
0

I want to contribute to this topic with 2 articles that helped me to configure my Azure Pipelines to log in to Terraform Cloud and download Modules hosted in a Private Registry in Terraform Cloud.

https://blog.devgenius.io/how-to-configure-azure-devops-with-terraform-enterprise-cac1bbd9810b https://mikehacker.dev/blog/configuring-terraform-enterprise-credentials-to-work-with-azure-devops/

2
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – Dave M
    Apr 12, 2022 at 21:21
  • Welcome to Server Fault! Your answer suggests a workable solution to the question is available via another website. The Stack Exchange family of Q&A websites generally frowns on this type of answer. Please read How do I write a good answer? and consider revising your answer to include the steps required to resolve the issue. And don't forget to take the site tour.
    – Paul
    Apr 12, 2022 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .