storage

The storage configuration allows users to define where plan files are stored, providing control over security and access. By default, plan files are stored on the Terrateam database, but alternative methods are supported. Workflows can also set storage to override the top-level storage configuration for matching directory spaces.

Default Configuration

storage:
  plans:
    method: terrateam

Storage Methods

The method key specifies how plans are stored: terrateam, s3, or cmd.

Terrateam Storage

With method: terrateam, the default, plan files are stored in the Terrateam server’s database. No other keys are accepted.

S3-compatible Storage

To store plans in an S3-compatible storage, configure the following:

Key	Type	Description
bucket	String	Bucket to store plans. Supports environment variables. Required.
region	String	Region where the bucket resides. Supports environment variables. Required.
path	String	Path to store plans within the bucket. Defaults to terrateam/plans/$dir/$workspace/$date-$time-$token. See template variables for details.
access_key_id	String	Access key ID for authentication. Supports environment variables. Optional.
secret_access_key	String	Secret access key for authentication. Supports environment variables. Optional.
delete_used_plans	Boolean	Delete plan after use. Default is true.
store_extra_args	List	Additional arguments for aws s3 cp during storage. Optional.
fetch_extra_args	List	Additional arguments for aws s3 cp during fetching. Optional.
delete_extra_args	List	Additional arguments for aws s3 rm during deletion. Optional.

Custom Command Storage

For custom commands to store, fetch, and delete plans, configure:

Key	Type	Description
delete	String list	Command to delete the plan after use. Supports environment and template variables. Optional.
fetch	String list	Command to fetch the plan. Supports environment and template variables. Required.
store	String list	Command to store the plan. Supports environment and template variables. Required.

No Persistent Plan Storage

Set method: none to skip storing the generated plan file after the plan workflow completes.

Key	Type	Description
unsafe_apply_without_plan	Boolean	Allow apply to run when no plan file was stored. Default is false.

Apply fails when method: none is set and unsafe_apply_without_plan is false, because no saved plan file is available to apply. Set unsafe_apply_without_plan: true to let apply evaluate the configuration again and apply that result.

Caution

With method: none, Terrateam cannot apply the exact binary plan reviewed in the pull request. The apply workflow runs a new non-interactive apply, so use this only for workflows where avoiding persisted plan files is more important than applying the reviewed plan file.

Template Variables

Variables available during plan and apply operations:

Variable	Description
date	Date of the plan operation in YYYY-MM-DD format.
dir	Directory being processed, e.g., foo/bar/baz.
plan_path	Path on disk where the plan is stored.
plan_dst_path	Destination path on disk for fetched plans.
time	Time of the plan operation in HHMMSS format.
token	Unique token for the run.
workspace	Workspace being processed, e.g., default.

Examples

Storing Plans in AWS S3

storage:
  plans:
    method: s3
    bucket: my-plan-bucket
    region: us-west-2
    access_key_id: $AWS_ACCESS_KEY_ID
    secret_access_key: $AWS_SECRET_ACCESS_KEY

Custom Commands for Plan Storage

storage:
  plans:
    method: cmd
    store: ['gsutil', 'cp', '$plan_path', 'gs://my-plan-bucket/terrateam/plans/$dir/$workspace/$date-$time-$token']
    fetch: ['gsutil', 'cp', 'gs://my-plan-bucket/terrateam/plans/$dir/$workspace/$date-$time-$token', '$plan_dst_path']
    delete: ['gsutil', 'rm', 'gs://my-plan-bucket/terrateam/plans/$dir/$workspace/$date-$time-$token']

Disabling Plan Storage for a Workflow

storage:
  plans:
    method: s3
    bucket: my-plan-bucket
    region: us-west-2

workflows:
  - tag_query: "engine:terragrunt"
    engine:
      name: terragrunt
    storage:
      plans:
        method: none
        unsafe_apply_without_plan: true