Terraform tips

[dmarcoux]

How to rename/move/update the state of Terraform resources

Explain this with an example on how to remove duplication in Terraform configuration file with for_each and how the state can be moved to match the changes in the configuration file.

1. terraform state list to list all the resources in the Terraform state.
2. terraform state mv -dry-run SOURCE DESTINATION to double-check if what would happen is really what we want
3. If happy with the previous step, remove -dry-run from previous command, so terraform state mv SOURCE DESTINATION

As an extra, show how to loop in shell (with zsh) to avoid error-prone manual typing as much as possible:

for bucket_name in bookmarks recipes documents; do terraform state mv "scaleway_object_bucket_policy.bucket_policy_$bucket_name" "scaleway_object_bucket_policy.bucket_policy[\"$bucket_name\"]"; done

How to retrieve a sensitive value

When looking at the state of a resource, its sensitive values will always be masked. This is great to prevent security leaks, but what if, only once, I need to store this sensitive value in my password manager.

resource "scaleway_iam_application" "API-Object_Storage" {
  name        = "API - Object Storage"
}

resource "scaleway_iam_api_key" "API-Object_Storage" {
  application_id = scaleway_iam_application.API-Object_Storage.id
}

It's possible with the command below:

terraform show -json | jq -r '.values.root_module.resources[] | select(.address=="scaleway_iam_api_key.API-Object_Storage").values.secret_key'