search

hashicorp / terraform

Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.
https://www.terraform.io/
Other
42.66k stars 9.55k forks source link

Add tags to s3 backend resources #30054

Open ArtyMaury opened 2 years ago

ArtyMaury commented 2 years ago

Current Terraform Version

1.0.11

Use-cases

In my company we'd like to simplify terraform backend management and use a unique s3 bucket for all projects. We already have a custom rôle by project, but to secure access by folder we've reached a limit in aws bucket policies. The best solution would be to tag the s3 objects to better handle access.

Proposal

Looking at the code for remote-state/s3, the tags would work a lot like the current acl work. It would be another option in the s3 backend config with small impact in the client. https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/s3/client.go#L175

apparentlymart commented 2 years ago

Hi @ArtyMaury! Thanks for sharing this use-case.

Assuming you're talking about tagging individual the S3 objects inside buckets rather than the buckets themselves, that does seem like a reasonable use-case to consider but I also wanted to note that if you want to achieve that with Terraform as it exists today then I expect (but have not actually verified) that subsequent writes to the state after you manually add tags via the S3 API should preserve the tags you set, because the S3 backend is writing a new version of the object in-place and isn't currently setting any tags explicitly itself. If you've tried that and found that it didn't work for some reason, please let us know!

ArtyMaury commented 2 years ago

Hi @apparentlymart

I've just tried and it doesn't work. But I think that but modifying the Put method in the s3 client it will push the tags every time so it should work. I can try to do a pull request if you're ok.

bjornrog commented 1 year ago

Another use-case for tags on the state object.

We tag resources with git repository information. If we could tag the state object, we could easily locate the correct repository using the given state object tags.