Plan b terraform
Author: b | 2025-04-24
Unity/BepInEx mods for the Steam game Plan B Terraform - akarnokd/plan-b-terraform-mods Plan B: Terraform on Steam: B: Terraform is a calm and contemplative science-fiction game ba
Plan B: Terraform - Official Plan B: Terraform Wiki
Latest version, as displayed in your workspace details. When you create a new workspace, HCP Terraform automatically selects the mostrecent version of Terraform available. If you migrate an existing project fromthe CLI to HCP Terraform, HCP Terraform configures the workspace to use thesame version as the Terraform binary you used when migrating. HCP Terraformlets you change the version a workspace uses on the workspace's settings pageto control how and when your projects use newer versions of Terraform.Click on the workspace version to go to the workspace’s general settings page,then scroll down to the version selector. Select version 0.12.31 to satisfyyour configuration’s version constraint. Then, click Save settings.Trigger a new Terraform run by selecting Start new run from the Actionsmenu in your workspace. Click Start run. Then, click Confirm & Apply to create your resources. At this point, your example workspace is in good working condition, but uses an outdated Terraform version. Your current Terraform configuration only works with Terraform versions in the0.12 series. To upgrade your project, you will need to modify both theworkspace version and the version constraint in your configuration.Note In this tutorial scenario, the only compatibility issue is theconfiguration's version constraint. Production configuration upgrades mayrequire more modification; when updating configurations, consult the Terraformupgrade guides.Clone your fork of the tutorial repository, replacing USERNAME with your GitHub username.$ git clone to the repository directory.$ cd learn-terraform-versionsOpen main.tf and update the required_version constraint to ~> 0.13.0.terraform { required_providers { aws = { version = "~> 4.0" } random = { version = ">= 2.1.2" } } required_version = "~> 0.13.0"}To verify that your configuration is still valid using the new Terraform version, you will open a pull request in the repository to trigger a speculative plan. First, create a new branch. $ git checkout -b upgrade_terraform_013Stage your changes.Commit your changes.$ True role_based_access_control_enabled = true secret_rotation_enabled = true sku_tier = "Standard" storage_profile_blob_driver_enabled = true storage_profile_enabled = true temporary_name_for_rotation = "a${random_string.aks_temporary_name_for_rotation.result}" vnet_subnet_id = azurerm_subnet.aks.id rbac_aad_admin_group_object_ids = [azuread_group.aks_admins.object_id] agents_labels = { "Agent" : "agentLabel" } agents_tags = { "Agent" : "agentTag" } depends_on = [ azurerm_subnet.aks, ]}The provided GitHub Action workflow automates the deployment of an Azure Kubernetes Service (AKS) cluster using Terraform. This workflow is triggered on two conditions: when changes are pushed to the main branch within the terraform directory, or manually through a workflow dispatch event. The manual trigger allows users to specify the desired Terraform operation (plan, apply, or destroy) through an input parameter. This flexibility enables users to review changes, apply the infrastructure configuration, or tear it down as needed.The workflow defines a single job named 'Terraform' that runs on the latest Ubuntu environment. It sets up necessary environment variables using secrets for secure authentication with Azure. The steps include checking out the repository, setting up the specified version of Terraform, and initializing Terraform with backend configuration sourced from environment variables. The workflow then validates the Terraform configuration to ensure correctness. Depending on the trigger, it proceeds to execute the appropriate Terraform command: plan to review the changes, apply to deploy the infrastructure, or destroy to remove it. This automation streamlines the management of the AKS cluster, ensuring consistent and reproducible deployments.on: push: branches: [main] paths: - 'terraform/**' workflow_dispatch: inputs: terraform_operation: description: "Terraform operation: plan, apply, destroy" required: true default: "plan" type: choice options: - plan - apply - destroyname: Deploy AKS Clusterjobs: terraform: name: 'Terraform' runs-on: ubuntu-latest env: ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }} ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }} ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }} ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }} GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} TF_VERSION: 1.6.1 defaults: run: shell: bash working-directory: ./terraform steps: - name: Checkout uses: actions/checkout@v4 - name: Setup Terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: ${{ env.TF_VERSION }} - name: Terraform Init id: init run: | set -a source ../.env.backend terraform init \ -backend-config="resource_group_name=$TF_VAR_state_resource_group_name" \ -backend-config="storage_account_name=$TF_VAR_state_storage_account_name" - name: Terraform Validate id: validate run: terraform validate -no-color - name: Terraform Plan id: plan run: terraform plan -no-color if: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.terraform_operation == 'plan' || github.event_name == 'push' }}" - name: Terraform Apply id: apply run: terraform apply -auto-approve if: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.terraform_operation == 'apply' }}" - name: Terraform Destroy id: destroy run: terraform destroy --auto-approve if: "${{ github.event.inputs.terraform_operation == 'destroy' }}"The provided Terraform code defines resources forPlan B: Terraform - Plan B: Terraform demo is now live! - Steam
Git commit -m "Upgrade version constraint to Terraform 0.13"Finally, push your changes.$ git push -u origin upgrade_terraform_013In the GitHub web UI, open a new pull request for your changes against yourfork of the repository. Once you open the pull request, HCP Terraform willcreate a speculative plan to demonstrate the changes in the pull request. Sinceyou updated the version constraint in your configuration, but your HCPTerraform workspace still uses version 0.12.31, the plan will fail. Click on the Details link next to the failed plan to see the plan detailsin HCP Terraform. As expected, the output shows that the Terraform versionused for the plan does not satisfy the configuration. Though Terraform uses the version configured for your workspace for normalTerraform runs, you can select a specific version of Terraform to use for aspeculative plan to test version-sensitive changes. Select version 0.13.7 from the dropdown menu below the run output, then clickRetry run to verify that your configuration works with a newer Terraformversion. In the plan details, HCP Terraform indicates that you used a differentversion for this plan than the version configured for the workspace. The runsucceeds and shows no planned changes, confirming that your configuration iscompatible with Terraform 0.13. On the HCP Terraform workspace settings page, update your workspace's versionto 0.13.7 and save the change.Then, merge your pull request to update the version constraint on your mainbranch. Your merged pull request does not modify your resources, so Terraform willtrigger and complete the run automatically. It will not ask you to apply yourconfiguration in order to upgrade the state since there are no changes. If you inspectthe latest state file stored in the workspace, it still shows state version 4and Terraform version 0.12.31. Although your workspace can now use Terraform 0.13 for runs, the upgrade isincomplete. Terraform 0.13 introduced changes to the. Unity/BepInEx mods for the Steam game Plan B Terraform - akarnokd/plan-b-terraform-modsPlan B: Terraform - gamepressure.com
Policies for cloud storage, using private repositories for version control, and restricting access to your Terraform configurations.For example, you can use AWS IAM policies to control access to your S3 bucket:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::my-terraform-state" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-terraform-state/path/to/my/key" } ]}8. Automate State Management with CI/CDIntegrating Terraform state management into your CI/CD pipelines can automate many of the best practices we've discussed. This includes running Terraform plans and applies, backing up state files, and enforcing access controls.For example, you can use GitHub Actions to automate Terraform workflows. Here's a simple example of a GitHub Actions workflow that runs Terraform plan and apply:name: Terraformon: [push]jobs: terraform: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: terraform_version: 1.0.0 - name: Terraform Init run: terraform init - name: Terraform Plan run: terraform plan - name: Terraform Apply run: terraform apply -auto-approve9. Monitor and Audit State ChangesRegularly monitoring and auditing changes to your state files can help you catch issues early and ensure compliance with your organization's policies. You can use tools like Terraform Cloud's audit logging or custom scripts to monitor state changes.For example, you can use AWS CloudTrail to monitor changes to your S3 bucket:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:LookupEvents" ], "Resource": "*" } ]}10. Document Your State Management PoliciesFinally, it's important to document your state management policies and procedures. This ensures that everyone on your team understands how && (steps.tflint.outcome == 'success' || steps.tflint.outcome == 'failure') }} uses: GetTerminus/terraform-pr-commenter@dpr-update-commenter with: commenter_type: tflint commenter_input: ${{ format('{0}{1}', steps.tflint.outputs.stdout, steps.tflint.outputs.stderr) }} commenter_exitcode: ${{ steps.tflint.outputs.exitcode }} - name: Terraform Plan id: plan run: terraform plan -lock=false -input=false |& tee tf_plan.txt - uses: GetTerminus/terraform-pr-commenter@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TF_WORKSPACE: ${{ inputs.terraform_workspace }} with: commenter_type: plan commenter_plan_path: tf_plan.txt commenter_exitcode: ${{ steps.plan.outputs.exit }}InputsNameRequirementDescriptioncommenter_typerequiredThe type of comment. Options: [fmt, init, plan, validate, tflint]commenter_inputoptionalThe comment to post from a previous step output. For plan commenter type either commenter_input or commenter_plan_path must be set. This is limited to 128KiBcommenter_plan_pathoptionalThe plan file path including the filename. Only available for plan commenter types.commenter_exitcoderequiredThe exit code from a previous step output.terraform_versionoptionalThe version of terraform from the workflow. Defaults to 1.4.6.use_beta_versionoptionalWhether or not to use the beta version of the commenter.Environment VariablesNameRequirementDescriptionGITHUB_TOKENrequiredUsed to execute API calls. The ${{ secrets.GITHUB_TOKEN }} already has permissions, but if you're using your own token, ensure it has the repo scope.TF_WORKSPACEoptionalDefault: default. This is used to separate multiple comments on a pull request in a matrix run.EXPAND_SUMMARY_DETAILSoptionalDefault: false. This controls whether the comment output is collapsed or not.HIGHLIGHT_CHANGESoptionalDefault: true. This switches ~ to ! in plan diffs to highlight Terraform changes in orange. Set to false to disable.COMMENTER_DEBUGoptionalDefault: false. This switches the commenter into debug mode.NotesThe commenter requires a pull request to run so the github event must contain a .pull_request.number.For large terraform plans using stdout/stder, there is aproximately 128KiB limit to the size of the commenter_input. If your output is larger than that you will need to either truncate or switch the output to a text file as shown in the workflow example above. An example of how to truncate the plan output is shown below.Example TF Plan Truncate:&1 # merge stderr into stdout and print it to fd5 (parent shell's stdout); exit with the code from terraform plan OUTPUT=$(terraform plan -lock=false -input=false 2>&1 | tee /dev/fd/5; exit ${PIPESTATUS[0]}) # store the exit code here EXITCODE=$? # github actions doesn't allow us to set a multiline output so we export it to the environment EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) echo "PLAN_OUTPUT> $GITHUB_OUTPUT echo "${OUTPUT::128000}" >> $GITHUB_OUTPUT echo "$EOF" >> $GITHUB_OUTPUT # set exit code for pickup later, and make sure we exit with same code echo "exitcode=$EXITCODE" >> $GITHUB_OUTPUT exit $EXITCODE">- name: TF Plan - Truncate id: plan # have to use /bin/bash because GHA runs by default with `set -e` to endPlan B: Terraform - hry.seznam.cz
This project was forked from project, originally created by Rob Burger.SummaryThis Docker-based GitHub Action is designed to work in tandem with hashicorp/setup-terraform and terraform-linters/setup-tflint with the wrapper enabled, taking the output from a fmt, init, plan, validate or tflint, formatting it and adding it to a pull request. Any previous comments from this Action are removed to keep the PR timeline clean.The terraform_wrapper needs to be set to true for the hashicorp/setup-terraform step if using stdout, stderr and the exitcode step outputs like the below examples.The tflint_wrapper needs to be set to true for the terraform-linters/setup-tflint step if using stdout, stderr and the exitcode step outputs like the below examples.Support (for now) is limited to Linux as Docker-based GitHub Actions can only be used on Linux runners.UsageThis action can only be run after a Terraform fmt, init, plan, validate or tflint has completed, and the output has been captured. Terraform rarely writes to stdout and stderr in the same action, so the commenter_input needs to be concatenated. For the plan commenter type we recommend saving the output to a file instead of using stdout/stderr as this allows us to bypass size limits for variables so large terraform plans don't need to be truncated.Example Workflow:name: Terraformon: pull_request:env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TF_WORKSPACE: "example" TF_VERSION: "1.4.6"jobs: terraform: name: Run Terraform and Comment runs-on: ubuntu-latest steps: - name: HashiCorp - Setup Terraform uses: hashicorp/setup-terraform@v2 with: terraform_version: ${{ env.TF_VERSION }} - name: Terraform Format id: fmt run: | terraform fmt -check -recursive -diff continue-on-error: true - name: Post Format Comment if: ${{ always() && (steps.fmt.outcome == 'success' || steps.fmt.outcome == 'failure') }} uses: GetTerminus/terraform-pr-commenter@v3 with: commenter_type: fmt commenter_input: ${{ format('{0}{1}', steps.fmt.outputs.stdout, steps.fmt.outputs.stderr) }} commenter_exitcode: ${{ steps.fmt.outputs.exitcode }} - name: Terraform Init id: init run: terraform init -lock=false -input=false - name: Post Init Comment if: ${{ always() && (steps.init.outcome == 'success' || steps.init.outcome == 'failure') }} uses: GetTerminus/terraform-pr-commenter@v3 with: commenter_type: init commenter_input: ${{ format('{0}{1}', steps.init.outputs.stdout, steps.init.outputs.stderr) }} commenter_exitcode: ${{ steps.init.outputs.exitcode }} - name: Terraform Validate id: validate run: terraform validate - name: Post TF Validate Comment if: ${{ always() && (steps.validate.outcome == 'success' || steps.validate.outcome == 'failure') }} uses: GetTerminus/terraform-pr-commenter@v3 with: commenter_type: validate commenter_input: ${{ format('{0}{1}', steps.validate.outputs.stdout, steps.validate.outputs.stderr) }} commenter_exitcode: ${{ steps.validate.outputs.exitcode }} - name: TFLint - Setup id: tflint uses: terraform-linters/setup-tflint@v3 with: tflint_wrapper_enabled: true - name: TFLint - Run run: | tflint --version tflint --init tflint - name: Post TFLint Comment if: ${{ always()I TERRAFORMED An Alien Planet in Plan B: Terraform
Terraform would see that now the Desired State and Current State no longer match and add one virtual server. 1) Write Write the IaC in HCL using blocks, arguments, variables, and expressions. 2) Plan Run terraform plan to get a preview of the modifications that will be made to the environment. The plan output will notate what will be added, destroyed, and changed. 3) Apply If satisfied with the plan output, run terraform apply to apply the desired changes to reach your desired state.Terraform apply output Troy Ingram is a Cloud DevOps Engineer/Subject Matter Expert on GovCIO’s SANDBAR contract, which supports the DoD and its interagency partners. With seven years of experience in the IT field, Troy specializes in AWS Cloud, DevOps, Infrastructure as Code, and automation.Where Else to Find Troy OnlineBe Sure to Connect with Troy on LinkedInCheck his Medium for plenty of Hands On Terraform Projects Troy Ingram Cloud & DevOps SME. Unity/BepInEx mods for the Steam game Plan B Terraform - akarnokd/plan-b-terraform-mods Plan B: Terraform on Steam: B: Terraform is a calm and contemplative science-fiction game baEXCELLENT Automation Terraforming Game!! - Plan B: Terraform
"aws_instance" "app_server" { + ami = "ami-830c94e3" + arn = (known after apply)##...Plan: 1 to add, 0 to change, 0 to destroy.Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value:Tip If your configuration fails to apply, you may have customized yourregion or removed your default VPC. Refer to thetroubleshooting section of this tutorial forhelp.Before it applies any changes, Terraform prints out the execution planwhich describes the actions Terraform will take in order to change yourinfrastructure to match the configuration.The output format is similar to the diff format generated by tools such as Git.The output has a + next to aws_instance.app_server, meaning that Terraformwill create this resource. Beneath that, it shows the attributes that will beset. When the value displayed is (known after apply), it means that the valuewill not be known until the resource is created. For example, AWS assignsAmazon Resource Names (ARNs) to instances upon creation, so Terraform cannotknow the value of the arn attribute until you apply the change and the AWSprovider returns that value from the AWS API.Terraform will now pause and wait for your approval before proceeding. Ifanything in the plan seems incorrect or dangerous, it is safe to abort here beforeTerraform modifies your infrastructure.In this case the plan is acceptable, so type yes at the confirmation prompt toproceed. Executing the plan will take a few minutes since Terraform waits forthe EC2 instance to become available. Enter a value: yesaws_instance.app_server: Creating...aws_instance.app_server:Comments
Latest version, as displayed in your workspace details. When you create a new workspace, HCP Terraform automatically selects the mostrecent version of Terraform available. If you migrate an existing project fromthe CLI to HCP Terraform, HCP Terraform configures the workspace to use thesame version as the Terraform binary you used when migrating. HCP Terraformlets you change the version a workspace uses on the workspace's settings pageto control how and when your projects use newer versions of Terraform.Click on the workspace version to go to the workspace’s general settings page,then scroll down to the version selector. Select version 0.12.31 to satisfyyour configuration’s version constraint. Then, click Save settings.Trigger a new Terraform run by selecting Start new run from the Actionsmenu in your workspace. Click Start run. Then, click Confirm & Apply to create your resources. At this point, your example workspace is in good working condition, but uses an outdated Terraform version. Your current Terraform configuration only works with Terraform versions in the0.12 series. To upgrade your project, you will need to modify both theworkspace version and the version constraint in your configuration.Note In this tutorial scenario, the only compatibility issue is theconfiguration's version constraint. Production configuration upgrades mayrequire more modification; when updating configurations, consult the Terraformupgrade guides.Clone your fork of the tutorial repository, replacing USERNAME with your GitHub username.$ git clone to the repository directory.$ cd learn-terraform-versionsOpen main.tf and update the required_version constraint to ~> 0.13.0.terraform { required_providers { aws = { version = "~> 4.0" } random = { version = ">= 2.1.2" } } required_version = "~> 0.13.0"}To verify that your configuration is still valid using the new Terraform version, you will open a pull request in the repository to trigger a speculative plan. First, create a new branch. $ git checkout -b upgrade_terraform_013Stage your changes.Commit your changes.$
2025-04-19True role_based_access_control_enabled = true secret_rotation_enabled = true sku_tier = "Standard" storage_profile_blob_driver_enabled = true storage_profile_enabled = true temporary_name_for_rotation = "a${random_string.aks_temporary_name_for_rotation.result}" vnet_subnet_id = azurerm_subnet.aks.id rbac_aad_admin_group_object_ids = [azuread_group.aks_admins.object_id] agents_labels = { "Agent" : "agentLabel" } agents_tags = { "Agent" : "agentTag" } depends_on = [ azurerm_subnet.aks, ]}The provided GitHub Action workflow automates the deployment of an Azure Kubernetes Service (AKS) cluster using Terraform. This workflow is triggered on two conditions: when changes are pushed to the main branch within the terraform directory, or manually through a workflow dispatch event. The manual trigger allows users to specify the desired Terraform operation (plan, apply, or destroy) through an input parameter. This flexibility enables users to review changes, apply the infrastructure configuration, or tear it down as needed.The workflow defines a single job named 'Terraform' that runs on the latest Ubuntu environment. It sets up necessary environment variables using secrets for secure authentication with Azure. The steps include checking out the repository, setting up the specified version of Terraform, and initializing Terraform with backend configuration sourced from environment variables. The workflow then validates the Terraform configuration to ensure correctness. Depending on the trigger, it proceeds to execute the appropriate Terraform command: plan to review the changes, apply to deploy the infrastructure, or destroy to remove it. This automation streamlines the management of the AKS cluster, ensuring consistent and reproducible deployments.on: push: branches: [main] paths: - 'terraform/**' workflow_dispatch: inputs: terraform_operation: description: "Terraform operation: plan, apply, destroy" required: true default: "plan" type: choice options: - plan - apply - destroyname: Deploy AKS Clusterjobs: terraform: name: 'Terraform' runs-on: ubuntu-latest env: ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }} ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }} ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }} ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }} GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} TF_VERSION: 1.6.1 defaults: run: shell: bash working-directory: ./terraform steps: - name: Checkout uses: actions/checkout@v4 - name: Setup Terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: ${{ env.TF_VERSION }} - name: Terraform Init id: init run: | set -a source ../.env.backend terraform init \ -backend-config="resource_group_name=$TF_VAR_state_resource_group_name" \ -backend-config="storage_account_name=$TF_VAR_state_storage_account_name" - name: Terraform Validate id: validate run: terraform validate -no-color - name: Terraform Plan id: plan run: terraform plan -no-color if: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.terraform_operation == 'plan' || github.event_name == 'push' }}" - name: Terraform Apply id: apply run: terraform apply -auto-approve if: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.terraform_operation == 'apply' }}" - name: Terraform Destroy id: destroy run: terraform destroy --auto-approve if: "${{ github.event.inputs.terraform_operation == 'destroy' }}"The provided Terraform code defines resources for
2025-04-15Git commit -m "Upgrade version constraint to Terraform 0.13"Finally, push your changes.$ git push -u origin upgrade_terraform_013In the GitHub web UI, open a new pull request for your changes against yourfork of the repository. Once you open the pull request, HCP Terraform willcreate a speculative plan to demonstrate the changes in the pull request. Sinceyou updated the version constraint in your configuration, but your HCPTerraform workspace still uses version 0.12.31, the plan will fail. Click on the Details link next to the failed plan to see the plan detailsin HCP Terraform. As expected, the output shows that the Terraform versionused for the plan does not satisfy the configuration. Though Terraform uses the version configured for your workspace for normalTerraform runs, you can select a specific version of Terraform to use for aspeculative plan to test version-sensitive changes. Select version 0.13.7 from the dropdown menu below the run output, then clickRetry run to verify that your configuration works with a newer Terraformversion. In the plan details, HCP Terraform indicates that you used a differentversion for this plan than the version configured for the workspace. The runsucceeds and shows no planned changes, confirming that your configuration iscompatible with Terraform 0.13. On the HCP Terraform workspace settings page, update your workspace's versionto 0.13.7 and save the change.Then, merge your pull request to update the version constraint on your mainbranch. Your merged pull request does not modify your resources, so Terraform willtrigger and complete the run automatically. It will not ask you to apply yourconfiguration in order to upgrade the state since there are no changes. If you inspectthe latest state file stored in the workspace, it still shows state version 4and Terraform version 0.12.31. Although your workspace can now use Terraform 0.13 for runs, the upgrade isincomplete. Terraform 0.13 introduced changes to the
2025-04-01Policies for cloud storage, using private repositories for version control, and restricting access to your Terraform configurations.For example, you can use AWS IAM policies to control access to your S3 bucket:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::my-terraform-state" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-terraform-state/path/to/my/key" } ]}8. Automate State Management with CI/CDIntegrating Terraform state management into your CI/CD pipelines can automate many of the best practices we've discussed. This includes running Terraform plans and applies, backing up state files, and enforcing access controls.For example, you can use GitHub Actions to automate Terraform workflows. Here's a simple example of a GitHub Actions workflow that runs Terraform plan and apply:name: Terraformon: [push]jobs: terraform: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: terraform_version: 1.0.0 - name: Terraform Init run: terraform init - name: Terraform Plan run: terraform plan - name: Terraform Apply run: terraform apply -auto-approve9. Monitor and Audit State ChangesRegularly monitoring and auditing changes to your state files can help you catch issues early and ensure compliance with your organization's policies. You can use tools like Terraform Cloud's audit logging or custom scripts to monitor state changes.For example, you can use AWS CloudTrail to monitor changes to your S3 bucket:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:LookupEvents" ], "Resource": "*" } ]}10. Document Your State Management PoliciesFinally, it's important to document your state management policies and procedures. This ensures that everyone on your team understands how
2025-04-16