Terraform provider

Terraform provider

Manage Infra resources through reviewed Terraform plans and protected state.

The official Terraform provider maps supported Infra resources to project and organization API operations. Provider configuration does not grant permission beyond its service-account identity.

Configure the provider

Use the solarius/infra provider and pin a release compatible with the installed control-plane API. Set INFRA_API_TOKEN through the execution environment's secret facility rather than embedding it in HCL or a plan archive.

To select the provider and configure its project scope, use:

Hcl
terraform {
  required_providers {
    infra = {
      source = "solarius/infra"
    }
  }
}

provider "infra" {
  api_url         = "https://infra.example.com/api/v1"
  organization_id = "org_main"
  project_id      = "prj_payments"
}

Add an approved version constraint and commit the dependency lock file in the deployment repository. The provider reference for that release lists supported resources, arguments, and import IDs.

Plan and apply

Run a refresh and inspect replacements, dependency changes, and retained resources. A region or immutable image change can propose replacement rather than an in-place edit. Deletion protection and retention remain enforced at the server.

The provider waits for accepted operations within configured timeouts. A local apply timeout does not cancel server work. Inspect the recorded operation before retrying or removing state entries.

Imports and ownership

Import by immutable resource ID in the selected scope. A successful import records identity; the next plan can still propose changes to match HCL. Do not simultaneously manage the same resource through Terraform and an active Infra blueprint.

Use remote state locking and restrict access to state and saved plans. Secret references can be safe to store, while provider-returned one-time credentials or user-supplied values can remain sensitive even when display output masks them.

Recovery

After a partial apply, refresh observed state and inspect child operations. Removing a state entry does not delete or release the actual resource. Conversely, a destroy plan must not be used as a substitute for a reviewed application decommissioning procedure.

See Blueprint imports, API authentication, and Operation API.