Announcing Private Plan Storage

By Malcolm Matalka on Oct 21, 2023
Announcing User Defined Plan Storage

Why User Defined Plan Storage

Executing an OpenTofu or Terraform plan operation produces a plan file. This file describes the changes that will be made to your infrastructure and needs to be stored somewhere between plan and apply operations. Plan files may contain sensitive data, such as passwords.

By default, Terrateam stores the plan in its backend. We take the following steps to secure the plan file:

  1. Plan files are encrypted
  2. Plan files are deleted as soon as they are used in an apply operation
  3. Plan files are expired and deleted after 14 days

Customer control

Some customers want more control as to where these files are stored. One of the core Terrateam values is to do right by our customers. Part of that position is our stance on security. We want to have as little access as possible to customer sensitive information. For example, leveraging GitHub Secrets allows us to never have the need to store customer secrets on our infrastructure.

Announcing Plan Storage

Customers can now specify where their OpenTofu and Terraform plan files are stored.

How it works

There is a new section storage in the Terrateam configuration file .terrateam/config.yml.

Default configuration

The default configuration will safely store your encrypted plan files on the Terrateam infrastructure.

method: terrateam

S3 configuration

If you want to store plan files on a private S3 bucket, your configuration would like something like the following:

method: s3
bucket: my-plan-bucket
region: us-east-1

The configuration above would store all Terrateam-produced plan files in a private S3 bucket called my-plan-bucket.

Custom configuration

The cmd method is the most versatile as it allows specifying any command to run to store, fetch, and delete a plan.

Here’s an example using the cmd method to implement s3 storage.

This is essentially what happens in our code when someone uses the s3 method.

method: cmd
delete: ['aws', 's3', 'rm', 's3://$PLAN_BUCKET/plans/$dir/$workspace/$date-$time-$token'],
fetch: ['aws', 's3', 'cp', 's3://$PLAN_BUCKET/plans/$dir/$workspace/$date-$time-$token', '$plan_dst_path'],
store: ['aws', 's3', 'cp', '$plan_path', 's3://$PLAN_BUCKET/plans/$dir/$workspace/$date-$time-$token'],


For more information see the documentation.

Join the Terrateam Slack if you have any questions, comments, or suggestions.

We use cookies and similar technologies to provide certain features, enhance the user experience and deliver content that is relevant to your interests. Depending on their purpose, analysis and marketing cookies may be used in addition to technically necessary cookies. By clicking on "Agree and continue", you declare your consent to the use of the aforementioned cookies. Here you can make detailed settings or revoke your consent (in part if necessary) with effect for the future. For further information, please refer to our Privacy Policy .