Volcengine Cloud Control Provider

The Volcengine Cloud Control Provider enables interaction with various Volcengine-supported resources through the Cloud Control API. Prior to usage, you must configure the provider with appropriate credentials.

Use the left navigation panel to explore available resource documentation. If you cannot find the desired resource, please submit an issue report for assistance.

NOTE：

The Volcengine Cloud Control provider requires the use of Terraform 1.0.7 or later.

This guide requires an available Volcengine account or sub-account to create resources.

Network Mirror Configuration

If you experience slow provider downloads, you can configure a network mirror to accelerate the process. Add the following configuration to your Terraform CLI configuration file:

Linux & macOS

Create or edit the ~/.terraformrc file:

provider_installation {
  network_mirror {
    url     = "https://mirrors.volces.com/terraform/terraformcc/"
    include = ["registry.terraform.io/volcengine/volcenginecc"]
  }
  direct {
    exclude = ["registry.terraform.io/volcengine/volcenginecc"]
  }
}

Windows

Create or edit the %APPDATA%\terraform.rc file:

provider_installation {
  network_mirror {
    url     = "https://mirrors.volces.com/terraform/terraformcc/"
    include = ["registry.terraform.io/volcengine/volcenginecc"]
  }
  direct {
    exclude = ["registry.terraform.io/volcengine/volcenginecc"]
  }
}

NOTE: The direct block with exclude ensures that only the volcenginecc provider is fetched from the mirror, while other providers continue to be downloaded directly from the Terraform registry.

Example Usage

Terraform 1.0.7 and later:

# Configure the Volcenginecc Provider
terraform {
  required_providers {
    volcenginecc = {
      source  = "volcengine/volcenginecc"
      version = "~> 0.0.1"
    }
  }
}

# Create VPC
resource "volcenginecc_vpc_vpc" "VPCDemo" {
  vpc_name = "vpc-demo"
  description = "VpcDemo Example"
  cidr_block = "192.168.0.0/24"
  support_ipv_4_gateway = true
  enable_ipv_6 = false
  project_name = "default"
  tags = [
    {
      key = "env"
      value = "test"
    }
  ]
}

# Query VPC
data "volcenginecc_vpc_vpc" "VpcVpcDataSource" {
  id = volcenginecc_vpc_vpc.VPCDemo.id
}

Authentication

The Volcenginecc provider offers a flexible means of providing credentials for authentication. The following methods are supported, in this order, and explained below:

Static credentials

Static credentials can be provided by adding an public_key and private_key in-line in the volcengine provider block:

Warning: Hard-coded credentials are not recommended in any Terraform configuration and risks secret leakage should this file ever be committed to a public version control system.

Authentication Priority and Requirements:

AK/SK Authentication: The access_key and secret_key parameters have the highest priority for authentication.
Profile Authentication: The profile parameter can be used as an alternative authentication method.
Validation Rules:
- At least one authentication method must be provided: either access_key/secret_key OR profile
- If both AK/SK and Profile are provided, AK/SK authentication takes precedence over Profile authentication
- The file_path parameter is optional. If not specified, the default path ~/.volcengine will be used to locate the profile configuration file

Usage:

provider "volcenginecc" {
   access_key = "your ak"
   secret_key = "your sk"
   region = "cn-beijing"
   profile = "your profile" 
   file_path = "" # if empty, default path is ~/.volcengine
}

Environment variables

You can provide your credentials via VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY environment variables, representing your volcengine public key and private key respectively. VOLCENGINE_REGION, VOLCENGINE_PROFILE, and VOLCENGINE_FILE_PATH are also used, if applicable:

provider "volcenginecc" {

}

Usage:

$ export VOLCENGINE_ACCESS_KEY="your_public_key"
$ export VOLCENGINE_SECRET_KEY="your_private_key"
$ export VOLCENGINE_REGION="cn-beijing"
$ export VOLCENGINE_PROFILE="your_profile"
$ export VOLCENGINE_FILE_PATH="your_file_path" # if empty, default path is ~/.volcengine

Schema

Optional

access_key (String) The Access Key for Volcengine Provider. It must be provided, but it can also be sourced from the VOLCENGINE_ACCESS_KEY environment variable
secret_key (String) he Secret Key for Volcengine Provider. It must be provided, but it can also be sourced from the VOLCENGINE_SECRET_KEY environment variable
profile (String) The Profile for Volcengine Provider. It can be used as an alternative authentication method to AK/SK, and can also be sourced from the VOLCENGINE_PROFILE environment variable
file_path (String) The File Path for Volcengine Provider. It specifies the path to the profile configuration file. If not specified, the default path ~/.volcengine will be used, and can also be sourced from the VOLCENGINE_FILE_PATH environment variable
assume_role (Attributes) An assume_role block (documented below). Only one assume_role block may be in the configuration. (see below for nested schema)
customer_headers (String) CUSTOMER HEADERS for Volcengine Provider. The customer_headers field uses commas (,) to separate multiple headers, and colons (:) to separate each header key from its corresponding value.
disable_ssl (Boolean) Disable SSL for Volcengine Provider
endpoints (Attributes) An endpoints block (documented below). Only one endpoints block may be in the configuration. (see below for nested schema)
proxy_url (String) PROXY URL for Volcengine Provider
region (String) The Region for Volcengine Provider. It must be provided, but it can also be sourced from the VOLCENGINE_REGION environment variable

Nested Schema for `assume_role`

Required:

assume_role_session_name (String) The session name to use when making the AssumeRole call.
assume_role_trn (String) he TRN of the role to assume.
duration_seconds (Number) The duration of the session when making the AssumeRole call. Its value ranges from 900 to 43200(seconds), and default is 3600 seconds.

Optional:

policy (String) A more restrictive policy when making the AssumeRole call

Nested Schema for `endpoints`