Consuming AWS workspace setup

The repo declares resources. Terrakube owns execution and state. OpenBao mints the AWS session.

Repo shape

<repo>/
├── versions.tf
├── providers.tf
├── main.tf
└── .github/workflows/ci-gate.yml

versions.tf declares OpenTofu, providers, and the Terrakube cloud block. The workspace coordinates come from the repo-owned environment contract, not from a committed internal hostname.

terraform {
  required_version = ">= 1.11"

  cloud {}

  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
    vault = {
      source = "hashicorp/vault"
    }
  }
}

Credentials

Terrakube gives the run a short-lived OpenBao identity. The Vault provider uses that native identity, and an ephemeral AWS credentials resource mints a scoped STS session for the AWS provider. No long-lived AWS key, aws-vault profile, Doppler value, or Terrakube secret variable is in the path.

provider "vault" {}

ephemeral "vault_aws_access_credentials" "workspace" {
  mount = var.openbao_aws_mount
  role  = var.openbao_aws_role
  type  = "sts"
}

provider "aws" {
  region     = var.aws_region
  access_key = ephemeral.vault_aws_access_credentials.workspace.access_key
  secret_key = ephemeral.vault_aws_access_credentials.workspace.secret_key
  token      = ephemeral.vault_aws_access_credentials.workspace.security_token
}

The OpenBao role, policy, and AWS trust relationship are platform-owned. A workspace can mint only the role assigned to it.

Validate and run

CI stays credential-free:

tofu init -backend=false
tofu fmt -check
tofu validate
tofu test

Plans and applies run remotely:

tofu plan
tofu apply

Terrakube queues concurrent runs, stores state versions, and records approval. Provider and module packages resolve through the homelab mirror.

Infrastructure

Observability

Automation

Consuming AWS workspace setup

Repo shape

Credentials

Validate and run

​Repo shape

​Credentials

​Validate and run

​Related pages

Repo shape

Credentials

Validate and run

Related pages