Moving from s3 remote to tf remote; how to prefix and workspace?

Terraform
1

I’m experimenting with the “terraform remote”, aka “terraform enterprise” remote. I previously have had remote state in s3. A repo might look like this:

myrepo/
  project_a/main.yml
  project_b/main.yml

In that case, the “key” param of the s3 backend might be “project_a” and “project_b”. Some interpolation is required when pulling the terraform_remote_state to interpolate with workspaces.

Moving to the “remote” remote means there’s a name (no workspace support) or a prefix. I thought that I should use a prefix of myrepo- but it seems to stomp on the subdirs. Should I be using a prefix of myrepo-project_a- and so on? I just can’t tell if that’s the best practice.

2

Hello Ted!

Yes, I believe your mapping of S3 key and prefix to workspace names is the correct pattern since workspaces are not prefixed / subdirectories in Terraform Cloud (AKA enterprise free tier).

Thus, if my S3 remote state looks like this:

my_terraform_repo/
  dev/terraform.tfstate
  qa/terraform.tfstate
  prod/terraform.tfstate

I would transition it to Terraform Cloud by setting up workspace names as:

my_terraform_repo-dev
my_terraform_repo-qa
my_terraform_repo-prod

I have found the following references to be useful in describing workspaces:

1 Like
3

I guess I’m mostly wondering about multi-level repos. So, supposing my workspaces are “dev”, “qa”, “prod” and I have the following:

my_repo/project_a/subgroup_1
my_repo/project_a/subgroup_2

traditionally with s3 my workspace is already specified, and I’d use ‘subdirs’:

key = my_repo/project_a/subgroup_1

In TF Cloud I’m assuming I need to do something similar:

prefix = my_repo-project_a-subgroup_1

Right? Again I can ignore the workspace because it is handled outside of this value.

4

Ah! I think I am misunderstanding your question, my apologies.

Just to clarify, what of the below are you looking to migrate?

  1. TF Enterprise remote state in S3 to TF Enterprise remote state managed?
  2. TF Enterprise remote state in S3 to TF Cloud?
  3. TF open source remote state in S3 to TF Cloud?

If you’re using Terraform Cloud (free tier), it currently does not support interpolation of workspaces. We need to explicitly state the prefix and workspace as the name:

terraform {
  backend "remote" {
    organization = "my_organization"

    workspaces {
      name = "my_repo-project_a-subgroup_1-dev"
    }
  }
}
5

Thanks. I’m doing option 3 (so far), it looks like my combination of project+subproject is on the right path. It does look, however, like I can use prefix and the workspace is implicitly added- obviously I can’t do actual interpolation in the .tf, but it gets added:

terraform {
  backend "remote" {
    organization = "myorg"
    workspaces {
      prefix = "projecta-subgroup1-"
    }

and given a workspace:

$ tf workspace list
* thisworkspace

In the UI, I see a workspace name of projecta-subgroup1-thisworkspace.

Ultimately what I was trying to determine you’ve already answered for me- that the “subgroup” needs to be added to the name or prefix.