Terraform cloud backend

[JustLeo]

Hello, I’m trying to do the following: I have a terraform template and I want to run it using different backend configurations pointing to a terraform cloud workspace. I was trying to do this by using the --backend-config=“PATH_TO_FILE” but it is not taking the configuration and it’s initializing terraform with local backend. What am I doing wrong? the backend config is ok, cause if I place the file among with the template files and do “terraform init” it works fine.
Is it possible that “backend-config” doesn’t work with a terraform cloud config? I was not able to find a clear answer on any page.

[apparentlymart]

Hi @JustLeo,

The -backend-config option, when given a file, specifies only the contents of the backend block. For the Terraform Cloud integration it instead specifies the content of the cloud block.

To get the effect you want then, you will need to write at least an empty cloud block into your configuration so that Terraform can see that you intend these settings to be for the cloud integration rather than for the local backend:

terraform {
  cloud {}
}

You can then write into your backend config file any of the arguments that would normally be valid inside that cloud block.

With that said, when working with Terraform Cloud it’s uncommon to need special overrides during init because Terraform Cloud aims to encapsulate all of the details remotely: you only need to use terraform login to establish a session on your system and specify the rules for which workspaces are in scope for this particular configuration. The -backend-config setting is more commonly used by folks who aren’t using Terraform Cloud so they can do things like use a different S3 bucket for different environments, or similar.

If possible I’d recommend placing the entire configuration inside the main cloud block, because then you and your team can just run terraform init without any funny extra options and get the correct behavior.

[JustLeo]

Hi @apparentlymart, thanks for you response. But I already tried your suggestion and i got the bellow error message:

Initializing Terraform Cloud...

 Error: Invalid command-line option

 The -backend-config=... command line option is only for state backends, and is not applicable to Terraform Cloud-based configurations.

 To change the set of workspaces associated with this configuration, edit the Cloud configuration block in the root module.

I’m getting this error by having an empty block of the backend:

terraform {
  cloud {}
}

and doing the init this way:

terraform init -backend-config="../some_path/backend.tf"

the content of backend.tf is like this:

organization = "My_ORG"
workspaces { name = "My_Workspace" }

The reason behind why I’m trying to do it this way, is because I have a template that I want to use in different workspaces without having to edit it. So the idea was to call it and point to different workspaces using the “–backend-config” option.

Apart from that, I’m sorry but i did not understand well what you said here:

you only need to use terraform login to establish a session on your system and specify the rules for which workspaces are in scope for this particular configuration.

cause unless i have my backend block correct after doing login, I don’t see the workspaces, it only shows “default”. Is this due to some permissions I should change?

Thanks in advance.

[apparentlymart]

I’m sorry; I made an error in my original comment by confusing the cloud integration with the remote backend that it replaced. Indeed, as the error message suggests the -backend-config option is not applicable here.

The way this is intended to work is that in Terraform Cloud you would add a common tag to all of the workspaces that you intend to use this configuration with, and then specify that tag as the workspace filter.

For example, if you tagged all of the relevant workspaces “foo” then you would write the cloud block this way:

terraform {
  cloud {
    organization = "My_ORG"
    workspaces {
      tags = ["foo"]
    }
  }
}

Once you initialize the working directory with terraform init you should then be able to use terraform workspace list to see all of the relevant workspaces and terraform workspace select to switch between them, without any need to edit the configuration each time.

If you would prefer to set the workspace “ambiently” (without editing the configuration) then you can optionally set the environment variable TF_WORKSPACE to the name of the workspace you intend to use, and then that will take priority over the working directory’s currently-selected workspace.

In either case you should not need to manually edit or generate any files on disk to specify the workspace.

By “specify the rules for which workspaces are in scope” I was meaning the contents of the workspaces block. In my example above, the workspaces in scope are any that have the tag “foo”.