sr2c.terraform.terraform_s3_backend role – Create the AWS resources to keep Terraform state in S3

Note

This role is part of the sr2c.terraform collection (version 1.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install sr2c.terraform.

To use it in a playbook, specify: sr2c.terraform.terraform_s3_backend.

Entry point `main` – Create the AWS resources to keep Terraform state in S3 

Creates a private S3 bucket for Terraform state, with versioning and default encryption, and optionally a KMS key for encrypting secrets with SOPS.
Locks the state with an S3 lock file (use_lockfile), which needs Terraform 1.10 or later, or OpenTofu, or with a DynamoDB table when terraform_s3_backend_use_lockfile is false.
Sets the fact terraform_s3_backend_config to the backend configuration, without a key, so add a different key for each module. Sets the fact terraform_s3_backend_sops_kms_key_arn when it creates a KMS key.
Creates no IAM roles or policies, so it assumes an administrator account in the same AWS account as the infrastructure. To keep state for several projects in one account, use per-project IAM roles. Policies limited to the state object must also allow s3:GetObject, s3:PutObject and s3:DeleteObject on <key>.tflock.
Requires the boto3 and botocore Python libraries on the host running the role, and the AWS CLI when terraform_s3_backend_region is not set.

Parameter	Comments
terraform_s3_backend_bucket_name string / required	The name of the S3 bucket to create for the state.
terraform_s3_backend_dynamodb_table_name string	The DynamoDB table to create when `terraform_s3_backend_use_lockfile` is `false`. Defaults to `terraform_s3_backend_bucket_name`.
terraform_s3_backend_region string	The region for the bucket and any DynamoDB table. Defaults to the AWS profile’s region, from `aws configure get region`.
terraform_s3_backend_register_config boolean	Set the `terraform_s3_backend_config` fact. Choices: `false` `true` ← (default)
terraform_s3_backend_sops_kms_key_create_enabled boolean	Create a KMS key for encrypting secrets with SOPS. Defaults to `true` when `terraform_s3_backend_sops_kms_key_name` is set, and `false` otherwise. Choices: `false` `true`
terraform_s3_backend_sops_kms_key_name string	The alias of the KMS key to create. Required when `terraform_s3_backend_sops_kms_key_create_enabled` is `true`.
terraform_s3_backend_use_lockfile boolean	Lock the state with an S3 lock file instead of a DynamoDB table. Existing tables are not deleted. Set to `false` for Terraform older than 1.10. Choices: `false` `true` ← (default)