|
1 | 1 | --- |
2 | 2 | title: Object Storage - Manage an Object Storage bucket with Terraform |
3 | | -updated: 2024-08-27 |
| 3 | +updated: 2025-04-10 |
4 | 4 | --- |
5 | 5 |
|
6 | 6 | ## Objective |
7 | 7 |
|
8 | | -This tutorial will show you how to automate some actions on Object Storage with Terraform which is an open source tool to automate infrastructure provisioning. The following actions will be automated: |
9 | | - |
10 | | -- Object Storage user creation |
11 | | -- bucket creation |
12 | | -- file copy into the bucket |
13 | | -- S3 **\*** policies and assignment |
| 8 | +This tutorial will help you automate and orchestrate actions to use the Object Storage - S3 API with Terraform. Terraform is an open source tool for orchestrating the provisioning and provisioning of resources. |
14 | 9 |
|
15 | 10 | ## Requirements |
16 | 11 |
|
17 | | -- Have terraform command line installed (see this [tutorial](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) from Hashicorp, the company behind Terraform). |
18 | | -- Have git command line installed |
19 | | -- You will need to have set up an account to interact with the OVHcloud API (see this [tutorial](/pages/manage_and_operate/api/first-steps)). Depending on your needs in terms of permissions (http verbs PUT/GET/POST/DELETE), enter the route `/cloud/project/{serviceName}/region/{regionName}/storage/` to target object storage where *{serviceName}* corresponds to your Public Cloud project id and *{regionName}* corresponds to the region where your resources will be located. From the application keys created, you will need to export the 4 environment variables : |
20 | | - |
21 | | -```bash |
22 | | -$ export OVH_ENDPOINT=ovh-eu |
23 | | -$ export OVH_APPLICATION_KEY=Your_key_application_OVH(or_AK) |
24 | | -$ export OVH_APPLICATION_SECRET=Your_secret_application_key_OVH(or_AS) |
25 | | -$ export OVH_CONSUMER_KEY=Your_token(or_CK) |
26 | | -``` |
| 12 | +- Installation of the [Terraform CLI](https://www.terraform.io/downloads.html){.external} |
| 13 | +- Access to the [OVHcloud API](/links/api) (create your login by consulting [this guide](/pages/manage_and_operate/api/first-steps)) |
| 14 | +- A [Public Cloud project](/links/public-cloud/public-cloud) in your OVHcloud account. |
| 15 | +- OVHcloud provides a [Terraform provider](https://registry.terraform.io/providers/ovh/ovh/latest){.external} which is available in the official Terraform registry. You must have installed a version >= 2.0. You can follow this guide [How to use Terraform on the OVHcloud Public Cloud](/pages/public_cloud/compute/how_to_use_terraform). |
27 | 16 |
|
28 | | -- A Public Cloud project, with the ID exported as the variable `TF_VAR_OVH_PUBLIC_CLOUD_PROJECT_ID` |
29 | | - |
30 | | -```bash |
31 | | -$ export TF_VAR_OVH_PUBLIC_CLOUD_PROJECT_ID=Your_public_cloud_project_id |
32 | | -``` |
| 17 | +## Getting information on your cluster/API tokens |
33 | 18 |
|
34 | | -**If you do not have your AWS CLI** configured, you should set dummy values with the following. This is due to a limitation in Terraform dependency graph for providers initialization (see this long lasting terraform [issue)](https://github.com/hashicorp/terraform/issues/2430)): |
| 19 | +The “OVH provider” must be configured with a set of credentials: |
35 | 20 |
|
36 | | -```bash |
37 | | -$ export AWS_ACCESS_KEY_ID="no_need_to_define_an_access_key" |
38 | | -$ export AWS_SECRET_ACCESS_KEY="no_need_to_define_a_secret_key" |
39 | | -``` |
| 21 | +- an `application_key` |
| 22 | +- an `application_secret` |
| 23 | +- a `consumer_key` |
40 | 24 |
|
41 | | -## Instructions |
| 25 | +Why? |
42 | 26 |
|
43 | | -### Manage an Object Storage bucket with terraform @OVHcloud |
| 27 | +Because, behind the scenes, the OVH Terraform provider makes requests to the OVHcloud APIs. |
44 | 28 |
|
45 | | -#### Initialize |
| 29 | +To retrieve this necessary information, please follow the tutorial [First steps with the OVHcloud APIs](/pages/manage_and_operate/api/first-steps). |
46 | 30 |
|
47 | | -Clone the repository: |
| 31 | +Once you've successfully generated your OVH tokens, keep them. You'll need to set them in the next few minutes. |
48 | 32 |
|
49 | | -```bash |
50 | | -git clone https://github.com/yomovh/tf-at-ovhcloud && cd tf-at-ovhcloud/s3_bucket_only |
51 | | -``` |
| 33 | +The last piece of information you'll need is the `service_name`: this is the ID of your Public Cloud project. |
52 | 34 |
|
53 | | -Initialize Terraform: |
| 35 | +How do I get it? |
54 | 36 |
|
55 | | -```bash |
56 | | -$ terraform init |
57 | | -``` |
| 37 | +In the Public Cloud section, you can retrieve your service name ID using the `Copy to clipboard`{.action} button. |
58 | 38 |
|
59 | | -#### Plan |
| 39 | +{.thumbnail} |
60 | 40 |
|
61 | | -With the following command, you will see what are the actions that Terraform is going to perform: |
| 41 | +You can also use this information in Terraform resource definition files. |
62 | 42 |
|
63 | | -```bash |
64 | | -$ terraform plan |
65 | | -``` |
| 43 | +## Instructions |
66 | 44 |
|
67 | | -Now let's have a look at the content of the `main.tf` file: |
| 45 | +### Configuration |
68 | 46 |
|
69 | | -- The *variable* block defines the region and s3 endpoint that are used to create the bucket. You can update it according to your needs : check this [page](/pages/storage_and_backup/object_storage/s3_location) to know what region / endpoints are available. |
70 | | -- The *Providers* block defines 2 providers : ovh and Hashicorp AWS one. The first one is necessary to create the user whose identity / credentials will be used for the latest. |
71 | | -- The *User / Credential* block defines the user & credential that are visible in the Settings > Users & Roles tab. They are needed to configure the Hashicorp AWS provider. |
72 | | -- The Bucket block defines the bucket itself. |
73 | | -- The Output defines the access & secret key that may be useful for CLI usage. |
| 47 | +First, create a `provider.tf` file with the minimum version, the European endpoint (“ovh-eu”) and the keys you obtained in this guide. |
74 | 48 |
|
75 | | -#### Run |
| 49 | +Terraform: |
76 | 50 |
|
77 | | -```bash |
78 | | -$ terraform apply |
79 | 51 | ``` |
80 | | - |
81 | | -Now you can go in the Console and check the "Object Storage" tab. Your bucket is created. |
82 | | - |
83 | | -#### Destroy |
84 | | - |
85 | | -With the following command you will be back to your original state: Terraform will destroy all the resources that were previously created. |
86 | | - |
87 | | -```bash |
88 | | -$ terraform destroy |
| 52 | +terraform { |
| 53 | + required_providers { |
| 54 | + ovh = { |
| 55 | + source = "ovh/ovh" |
| 56 | + version = "2.1.0" # greater than or equal to 2.0 |
| 57 | + } |
| 58 | + } |
| 59 | +} |
| 60 | +
|
| 61 | +provider "ovh" { |
| 62 | + endpoint = "ovh-eu" |
| 63 | + application_key = "<your_access_key>" |
| 64 | + application_secret = "<your_application_secret>" |
| 65 | + consumer_key = "<your_consumer_key>" |
| 66 | +} |
89 | 67 | ``` |
90 | 68 |
|
91 | | -> [!primary] |
92 | | -> |
93 | | -> - This script does not follow Terraform best practices to split the project in multiple files e.g. **`provider.tf`, `main.tf`, `variables.tf`, `outputs.tf`**, ... This has been done intentionnaly to avoid switching into multiples files for what is a really simple example. |
94 | | -> - The secret that is created by this script is stored in the [local](https://developer.hashicorp.com/terraform/language/settings/backends/local) state back-end. If you use this back-end in production, make sure to consider the state file as a secret. |
95 | | -
|
96 | | -### Automating Object Storage policies with Terraform |
| 69 | +Here, we've defined the `ovh-eu` endpoint because we want to call the OVHcloud Europe API, but other endpoints exist, depending on your needs: |
97 | 70 |
|
98 | | -#### Initialize |
| 71 | +- `ovh-eu` pour OVHcloud Europe API |
| 72 | +- `ovh-us` pour OVHcloud US API |
| 73 | +- `ovh-ca` pour OVHcloud North-America API |
99 | 74 |
|
100 | | -Clone the repository: |
| 75 | +### Create a bucket |
101 | 76 |
|
102 | | -```bash |
103 | | -git clone https://github.com/yomovh/tf-at-ovhcloud && cd tf-at-ovhcloud/s3_policy |
104 | | -``` |
105 | | - |
106 | | -Initialize Terraform: |
| 77 | +You can create a file named 'object_storage_simple.tf' and write the following: |
107 | 78 |
|
108 | | -```bash |
109 | | -$ terraform init |
| 79 | +```python |
| 80 | +# Create an Object Storage bucket |
| 81 | +resource "ovh_cloud_project_storage" "my-bucket" { |
| 82 | + service_name = "my_service_name" # Replace with your OVHcloud project ID |
| 83 | + region_name = "GRA" # Replace with the desired region in uppercase. |
| 84 | + name = "object-storage-simple" |
| 85 | +} |
110 | 86 | ``` |
111 | 87 |
|
112 | | -#### Plan |
113 | | - |
114 | | -With the following command, you will see what are the actions that Terraform is going to perform: |
| 88 | +You can create your resource by entering the following command: |
115 | 89 |
|
116 | 90 | ```bash |
117 | | -$ terraform plan |
| 91 | +terraform apply |
118 | 92 | ``` |
119 | 93 |
|
120 | | -Now let's have a look at the content of the `main.tf` file and compare it with the previous example: |
| 94 | +### Delete a bucket |
121 | 95 |
|
122 | | -- The *User / Credential* block defines 3 users and credentials : one user will be administrator of the bucket and create it, the two others will have read/write & read-only access. |
123 | | -- In the *Bucket* block we have added the creation of a file into the bucket |
124 | | -- The *Policy* block defines 2 policies, one for read/write and the other for read-only on the bucket. |
125 | | - |
126 | | -#### Run |
| 96 | +You can delete your bucket and all the objects it contains by entering the following command: |
127 | 97 |
|
128 | 98 | ```bash |
129 | | -$ terraform apply |
| 99 | +terraform destroy |
130 | 100 | ``` |
131 | 101 |
|
132 | | -Now you can go in the Console and check the "Object Storage" tab. You will see the bucket and the file. |
133 | | - |
134 | | -You can also check the access right by using the AWS CLI with the 2 users that have the read / write & read-only access |
135 | | - |
136 | | -#### Destroy |
137 | | - |
138 | | -With the following command you will be back to your original state: Terraform will destroy all the resources that were previously created. |
139 | | - |
140 | | -```bash |
141 | | -$ terraform destroy |
142 | | -``` |
| 102 | +> [!primary] |
| 103 | +> |
| 104 | +> This process may fail if the bucket contains locked objects. In this case, you'll need to delete these objects manually before you can run the command again. |
| 105 | +> |
143 | 106 |
|
144 | 107 | ## Go further |
145 | 108 |
|
|
0 commit comments