You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/terraform/v1.13.x/docs/language/stacks/component/declare-providers.mdx
+5-7Lines changed: 5 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -78,10 +78,10 @@ component "s3" {
78
78
After configuring your provider, you can use the Terraform CLI to generate a provider lock file:
79
79
80
80
```shell
81
-
$ terraform stacks providers-lock
81
+
$ terraform stacks init
82
82
```
83
83
84
-
If you update a provider version and want to apply those changes to your Stack locally, re-run the [`terraform stacks providers-lock` command](terraform/cli/commands/stacks/providers-lock) to update the provider lock file.
84
+
If you update a provider version and want to apply those changes to your Stack locally, re-run the [`terraform stacks init -upgrade` command](terraform/cli/commands/stacks/init) to update the provider lock file.
85
85
86
86
### Dynamic provider configurations
87
87
@@ -149,15 +149,13 @@ Check your provider in the [Terraform registry](https://registry.terraform.io/)
149
149
150
150
## Provider lock file
151
151
152
-
A Stack cannot run without a lock file for its providers. After defining your providers, use the Terraform CLI to generate a `.terraform.lock.hcl` lock file. The `terraform stacks providers-lock` command creates and updates your `.terraform.lock.hcl` file:
152
+
A Stack cannot run without a lock file for its providers. After defining your providers, use the Terraform CLI to generate a `.terraform.lock.hcl` lock file. The `terraform stacks init` command creates and updates your `.terraform.lock.hcl` file:
153
153
154
154
```shell-session
155
-
$ terraform stacks providers-lock
155
+
$ terraform stacks init
156
156
```
157
157
158
-
The `terraform stacks providers-lock` command uses the `required_providers` block from your configuration to download the listed providers and compute the provider lock hashes. The `terraform stacks providers-lock` command only checks the `required_providers` block, so you must list all of the providers you use in that block to ensure that the `terraform stacks` CLI can find them.
159
-
160
-
If you update your Stack’s providers, rerun the `terraform stacks providers-lock` command to update your Stack’s lock file locally. For more details, refer to the [`terraform stacks` commands](/terraform/cli/commands/stacks).
158
+
The `terraform stacks init` command uses the `required_providers` block from your configuration to download the listed providers and compute the provider lock hashes. If you update your Stack’s providers, run `terraform stacks init -upgrade` command to update your Stack’s lock file locally. For more details, refer to the [`terraform stacks` commands](/terraform/cli/commands/stacks).
Copy file name to clipboardExpand all lines: content/terraform/v1.13.x/docs/language/stacks/deploy/authenticate.mdx
+39-43Lines changed: 39 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ We recommend authenticating your Stack with OIDC because using static credential
13
13
14
14
## Authenticate with OIDC
15
15
16
-
[OpenID Connect](https://openid.net/connect/) (OIDC) is an identity layer on top of the OAuth 2.0 protocol. You can use HCP Terraform’s [Workload identity](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens) tokens, built on the OpenID Connect protocol, to securely connect and authenticate your Stacks with cloud providers.
16
+
[OpenID Connect](https://openid.net/connect/) (OIDC) is an identity layer on top of the OAuth 2.0 protocol. You can use HCP Terraform's [Workload identity](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens) tokens, built on the OpenID Connect protocol, to securely connect and authenticate your Stacks with cloud providers.
17
17
18
18
-> **Hands on**: Walk through setting up OIDC for a Stack in the [Deploy a Stack with HCP Terraform](/terraform/tutorials/cloud/stacks-deploy) tutorial.
19
19
@@ -24,9 +24,9 @@ Stacks have a built-in `identity_token` block that creates workload identity tok
24
24
The details of Stack authentication differ based on which cloud provider you are setting up, but the basic steps remain the same:
25
25
26
26
1. Set up the trust configuration between your cloud provider and HCP Terraform, which usually includes creating roles and policies for your cloud provider.
27
-
1. Add an `identity_token` block to your Stack’s deployment file using the audience and roles you created in the previous step.
27
+
1. Add an `identity_token` block to your Stack's deployment file using the audience and roles you created in the previous step.
28
28
29
-
Your deployments can reference the value of the `identity_token` block to pass the trust relationship role to your Stack’s operations.
29
+
Your deployments can reference the value of the `identity_token` block to pass the trust relationship role to your Stack's operations.
30
30
31
31
### Configure trust configuration
32
32
@@ -127,8 +127,7 @@ output "role_arn" {
127
127
128
128
</CodeBlockConfig>
129
129
130
-
131
-
After setting up your workspace in HCP Terraform, perform a plan and apply operation. HCP Terraform will create your OpenID provider, policy, and role before outputting your new role’s ARN with the `role_arn` output. Copy your new AWS ARN role because this is the value you use to configure your cloud provider with your Stack and HCP Terraform.
130
+
After setting up your workspace in HCP Terraform, perform a plan and apply operation. HCP Terraform will create your OpenID provider, policy, and role before outputting your new role's ARN with the `role_arn` output. Copy your new AWS ARN role because this is the value you use to configure your cloud provider with your Stack and HCP Terraform.
132
131
133
132
To learn more about the workload identity trust claims and metadata, refer to the `identity_token` block reference](/terraform/language/block/stack/deploy/identity_token#token-attributes).
134
133
@@ -140,63 +139,62 @@ When you define the `identity_token` block, you specify its audience. For exampl
140
139
141
140
```hcl
142
141
identity_token "aws" {
143
-
audience = ["aws.workload.identity"]
142
+
audience = ["aws.workload.identity"]
144
143
}
145
144
```
146
145
147
-
Once defined, you can reference an identity token in a deployment's input variables and reference that token in a provider’s configuration.
146
+
Once defined, you can reference an identity token in a deployment's input variables and reference that token in a provider's configuration.
148
147
149
148
You also need to add your trust relationship, your role ARN, to configure your token with the trust relationship to authenticate AWS resources.
Now, the deployments are authenticated with AWS and can pass the trust configuration to your Stack’s providers for authentication.
169
-
167
+
Now, the deployments are authenticated with AWS and can pass the trust configuration to your Stack's providers for authentication.
170
168
171
169
```hcl
172
170
# variables.tfcomponent.hcl
173
171
174
172
variable "role_arn" {
175
-
type = string
173
+
type = string
176
174
}
177
175
178
176
variable "identity_token" {
179
-
type = string
180
-
ephemeral = true
177
+
type = string
178
+
ephemeral = true
181
179
}
182
180
183
181
# providers.tfcomponent.hcl
184
182
185
183
required_providers {
186
-
aws = {
187
-
source = "hashicorp/aws"
188
-
version = "~> 5.7.0"
189
-
}
184
+
aws = {
185
+
source = "hashicorp/aws"
186
+
version = "~> 5.7.0"
187
+
}
190
188
}
191
189
192
190
provider "aws" "this" {
193
-
config {
194
-
region = var.region
195
-
assume_role_with_web_identity {
196
-
role_arn = var.aws_role
197
-
web_identity_token = var.aws_token
198
-
}
191
+
config {
192
+
region = var.region
193
+
assume_role_with_web_identity {
194
+
role_arn = var.aws_role
195
+
web_identity_token = var.aws_token
199
196
}
197
+
}
200
198
}
201
199
```
202
200
@@ -214,27 +212,27 @@ Next, add a `store` block to your deployment configuration file to access the va
214
212
215
213
```hcl
216
214
store "varset" "tokens" {
217
-
name = "Example_Varset_Name"
215
+
name = "Example_Varset_Name"
218
216
category = "env"
219
217
}
220
218
```
221
219
222
220
</CodeBlockConfig>
223
221
224
-
Once defined, your deployments can access your variable set’s values. In the following example, the `test` deployment uses the `tokens` store to access the variable set named `Example_Varset_Name`:
222
+
Once defined, your deployments can access your variable set's values. In the following example, the `test` deployment uses the `tokens` store to access the variable set named `Example_Varset_Name`:
@@ -249,22 +247,22 @@ After defining a `store` block, deployments can reference specific values from t
249
247
```hcl
250
248
variable "access_key" {
251
249
description = "AWS access key"
252
-
type = string
253
-
ephemeral = true
250
+
type = string
251
+
ephemeral = true
254
252
}
255
253
256
254
variable "secret_key" {
257
255
description = "AWS sensitive secret key."
258
-
type = string
259
-
sensitive = true
260
-
ephemeral = true
256
+
type = string
257
+
sensitive = true
258
+
ephemeral = true
261
259
}
262
260
263
261
variable "session_token" {
264
262
description = "AWS session token."
265
-
type = string
266
-
sensitive = true
267
-
ephemeral = true
263
+
type = string
264
+
sensitive = true
265
+
ephemeral = true
268
266
}
269
267
270
268
required_providers {
@@ -278,15 +276,13 @@ provider "aws" "this" {
278
276
config {
279
277
access_key = var.access_key
280
278
secret_key = var.secret_key
281
-
token = var.session_token
279
+
token = var.session_token
282
280
}
283
281
}
284
282
```
285
283
286
284
</CodeBlockConfig>
287
285
288
-
289
286
By default, Stacks deployments do not save the values of variable sets into their state, because variable set values usually include sensitive data, such as passwords or API keys. For variables that need to persist in your deployment state, such as license keys, you can use the `stable` keyword. To learn more, refer to [Persist store values for deployments](/terraform/language/block/stack/deploy/store#persist-store-values-for-deployments).
290
287
291
-
292
288
For more information and examples about the `store` block, refer to the [`store` block reference](/terraform/language/block/stack/deploy/store).
Copy file name to clipboardExpand all lines: content/terraform/v1.13.x/docs/language/stacks/deploy/config.mdx
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: Learn how to write Stack deployment configuration files to define h
5
5
6
6
# Define deployment configuration
7
7
8
-
In Stacks, deployments let you replicate infrastructure across multiple environments, regions, or accounts. Each deployment has in its own isolated state, ensuring that changes in one deployment do not affect others. Learn how to write a deployment configuration to define how HCP Terraform deploys your infrastructure.
8
+
In Stacks, deployments let you replicate infrastructure across multiple environments, regions, or accounts. Each deployment has its own isolated state, ensuring that changes in one deployment do not affect others. Learn how to write a deployment configuration to define how HCP Terraform deploys your infrastructure.
9
9
10
10
## Background
11
11
@@ -22,7 +22,7 @@ You can also create deployment groups to define rules that let you auto-approve
22
22
23
23
## Write a deployment configuration file
24
24
25
-
Deployment configuration files live at the top level of your repository and use the `.tfdeploy.hcl` file extension. We recommend naming your deployments file `deployments.tfdeploy.hcl`.
25
+
Deployment configuration files live at the top level of your repository and use the `.tfdeploy.hcl` file extension. You can organize your deployment configuration into multiple files, as in traditional Terraform configurations.
26
26
27
27
You can define the following blocks in deployment configuration files to support setting up your Stack's deployments:
28
28
@@ -149,6 +149,8 @@ To learn more about the `identity_token` block, refer to the [`identity_token` b
149
149
150
150
## Automatically approve deployment runs
151
151
152
+
@include 'premium-deployment-groups.mdx'
153
+
152
154
You can create deployment groups to define rules that let you auto-approve deployment runs that match your specified criteria.
153
155
154
156
@@ -158,7 +160,6 @@ Deployment groups only support one deployment per group at this time.
158
160
159
161
</Note>
160
162
161
-
162
163
Define a `deployment_group` block to create a new group, and specify the auto-approve rules that deployment group enforces. In the following example, the `production` deployment group enforces the `no_destroys` rule:
page_title: Stack configuration files for Terraform
3
+
description: |-
4
+
Learn about the new general release of Stacks and how to migrate from the beta to the general release.
5
+
---
6
+
7
+
# Move from Stacks beta to general availability
8
+
9
+
The GA release of Stacks introduces several new features and improvements.
10
+
11
+
## Terraform CLI changes
12
+
13
+
During the Stacks beta, you could initialize your Stack using the `terraform-stacks-cli`. The separate `terraform-stacks-cli` is now deprecated. To provide a more unified experience, all Stacks commands are now in the main Terraform CLI as a new subcommand: `terraform stacks`. You can now manage all of your Terraform Stack operations from a single tool, streamlining your workflow. To learn more, refer to [the `terraform stacks` CLI commands](/terraform/cli/commands/stacks).
14
+
15
+
## Language changes
16
+
17
+
The general availability release of Stacks introduced a few backward-incompatible syntax changes to the Stacks language:
18
+
19
+
- Syntax change for deployment groups and auto-approval:
20
+
- The `auto_approve`, `orchestrate`, and `replan` blocks for orchestration rule are now deprecated.
21
+
- The `auto_approve` block is replaced by a new auto_approve_checks argument on the deployment_group block. The new `deployment_group` syntax lets you define auto-approval rules directly within your custom deployment groups, giving you more granular control. [Learn more about defining conditions for your deployment runs](/terraform/language/stacks/deploy/conditions).
22
+
- Stacks no longer support the `<NAME>.tfstack.hcl` file extension.
23
+
- The new extension for configuring your Stack components is `<NAME>.tfcomponent.hcl`. The file name change better reflects the mental model of a component-based configuration.
24
+
25
+
## Billing Changes
26
+
27
+
The Stacks public beta did not count toward your HCP Terraform organization's Resources Under Management (RUM). With the GA release, Stacks RUM is aggregated with your workspace RUM for billing purposes.
28
+
29
+
### Billing Dashboard
30
+
31
+
The HCP Terraform usage page has been updated to reflect the new billing metrics, including:
32
+
33
+
-**Billable Managed Resources** displays the sum of your total Stacks and total workspace RUM.
34
+
-**Total Applies** displays the sum of your total Stacks and workspace applies.
35
+
-**Applies this month** displays the Stacks and workspace applies this month.
36
+
-**Billable Stack Resources** displays the sum of your total Stacks RUM.
37
+
38
+
For more information on billing, refer to the [HCP Terraform pricing page](https://www.hashicorp.com/en/pricing).
39
+
40
+
## Steps for migration
41
+
42
+
If you used Stacks during the public beta, you need to take a few steps to transition your existing configurations to the GA release.
43
+
44
+
<Note>
45
+
46
+
After the release of Stacks in general availability, your existing beta configurations and state history are no longer available.
47
+
48
+
</Note>
49
+
50
+
### Update your configuration files
51
+
52
+
Perform the following updates to your Stack configuration files to use the new `tfcomponent.hcl` file extension and the new syntax for deployment groups and auto-approval rules:
53
+
54
+
1. Rename all of your `<NAME>.tfstack.hcl` files to `<NAME>.tfcomponent.hcl`. For example you could run the following command to rename your file:
2. Update your configuration files to use the new `deployment_group` syntax for auto-approval. For example, the following code snippet uses the deprecated `orchestrate` block:
You can rewrite your auto-approval rules using the `deployment_auto_approve` block to define your rules, then attaching those rules to deployment groups using the `auto_approve_checks` argument. The following example rewrites the `auto_approve` rule using deployment groups:
For more information about deployment groups and auto-approval rules, refer to [Defining conditions for your deployment runs](/terraform/language/stacks/deploy/conditions).
108
+
109
+
### Fetch your configuration
110
+
111
+
Trigger a new configuration fetch for each of your Stacks. The fetching process pulls your configuration from your Version Control System (VCS) and reinitializes your Stack. You can do this by using the [`terraform stacks fetch`](/terraform/cli/commands/stacks/configuration/fetch) command in the new CLI, or by triggering a deployment run in the HCP Terraform UI.
0 commit comments