Infrastructure as code for Akamai CDN and edge computing resources centers on two complementary toolchains: the Akamai Terraform Provider for declarative provisioning and the Akamai CLI Terraform library for exporting existing Akamai configuration assets into Terraform state. Together they enable version control, peer review and repeatable deployments for CDN properties, DNS zones, security policies, identity and access management and edge workers.

Overview of the Akamai Terraform Ecosystem

Akamai is one of the largest CDN and edge computing platforms in the world. Managing Akamai configurations through the Akamai Control Center by clicking through the user interface is tedious at scale. The Akamai Terraform provider lets you define CDN properties, DNS zones and security policies as code.

The Akamai Provider for Terraform is the official provider for managing and provisioning Akamai configurations in Terraform. You can use the Akamai Provider for many Akamai products. The provider has been tested with Terraform up to version 1.15.5. Versions newer than 1.15.5 may work, but are not officially supported.

The Akamai Provider requires Terraform 1.0.x or newer.

To automatically install the Akamai Provider, run terraform init on a configuration.

The Akamai Provider for Terraform uses a version of dnsjava that was modified by Akamai. dnsjava is used under the terms of the BSD 3-clause license, as shown in this notice.

CLI Terraform Library for Exporting Existing Assets

This library provides a command-line interface to export Akamai configuration assets that you can import later into your Terraform state.

Requires Go 1.25 or later.

To install this package, you can use the Akamai CLI.

akamai install terraform

If you already have the package installed on your system, run akamai update terraform to update it.

You can also use the package as a stand-alone command by downloading the latest release binary or cloning this repository and compiling the binary yourself.

```

Linux/macOS/*nix

go build -o akamai-terraform

Windows

go build -o akamai-terraform.exe
```

When exporting multiple assets, merge the variable file content, removing any duplicates.

To get an overview of the library, run one of these:

akamai terraform help

Lists commands and global flags available in the library.

akamai terraform list

Lists available commands with a short description of each command’s usage.

To get help information for a given Terraform CLI command, pass the export command and the --help flag.

akamai terraform export-iam --help

Help output:

Name: akamai terraform export-iam Usage: akamai [global flags] terraform export-iam [command flags] <subcommand> Description: Generates Terraform configuration for Identity and Access Management resources. Subcommands: all allowlist client group role user Command Flags: --tfworkpath value Directory used to store files created when running commands

Export Commands and Flags

The export surface covers imaging, mTLS and other asset types.

Export imaging policy configuration:

akamai terraform export-imaging --policy-as-hcl "C-0N7RAC7" "my-policy-set_12345"

akamai terraform export-imaging --policy-json-dir "path/to/your/directory" "C-0N7RAC7" "my-policy-set_12345"

--policy-as-hcl sets the policy output as HCL. --policy-json-dir sets the path to a directory in which you want to store your policy in JSON format. The default is your active directory.

Export a Terraform configuration for your mTLS client certificate.

Note: For third-party certificates, version information is always exported without being commented out as there is no automatic rotation. You can manually update the version fields as needed before applying the configuration.

akamai [global flags] terraform export-mtls-keystore [command flags] <certificate_id> [<group_id> <contract_id>] akamai terraform export-mtls-keystore 12345

Export a Terraform configuration for your Mutual TLS Edge Truststore CA set, along with associated activations if they exist.

Note:
If the CA set you’re exporting hasn’t been activated on any networks, staging or production, the akamaimtlstruststorecasetactivation resource will still be included in your configuration but commented out. This is to avoid accidental activation

Authentication for the Terraform Provider

Authentication credentials for the Terraform provider use a hash-based message authentication code or HMAC-SHA-256 created through an API client. Each member of your team should use their own client set up locally to prevent accidental exposure of credentials.

There are different types of API clients that grant access based on your need, role, or how many accounts you manage.

Prerequisites before getting started:

• An Akamai account with API credentials
• Terraform 1.0 or later installed
• An .edgerc file or API credentials from Akamai Control Center

To generate API credentials, log into the Akamai Control Center, go to Identity and Access Management, and create an API client. You will receive a clientsecret, host, accesstoken, and client_token.

Setting Up the .edgerc File

Akamai uses a credentials file called .edgerc, typically stored in your home directory.

The format looks like this:

```

~/.edgerc - Akamai API credentials file

[default]
clientsecret = your-client-secret-here
host = akab-xxxx.luna.akamaiapis.net
accesstoken = akab-xxxx
client_token = akab-xxxx

You can have multiple sections for different environments

[production]
clientsecret = prod-client-secret
host = akab-yyyy.luna.akamaiapis.net
accesstoken = akab-yyyy
client_token = akab-yyyy
```

Provider Configuration

Basic Provider Configuration

Here is a minimal provider setup:

```

main.tf - Akamai provider configuration

terraform {
required_providers {
akamai = {

Official Akamai provider from the Terraform registry

source = "akamai/akamai"
version = "~> 10.0"
}
}
required_version = ">= 1.0"
}

Use the default section of ~/.edgerc

provider "akamai" {
edgerc = "~/.edgerc"
config_section = "default"
}
```

Akamai releases frequently. Lock to a major version with ~> 10.0 to avoid breaking changes.

Authentication Alternatives

Besides the .edgerc file, you can authenticate using environment variables or inline credentials.

Environment Variables

```

Set Akamai credentials as environment variables

export AKAMAICLIENTSECRET="your-client-secret"
export AKAMAIHOST="akab-xxxx.luna.akamaiapis.net"
export AKAMAIACCESSTOKEN="akab-xxxx"
export AKAMAICLIENT_TOKEN="akab-xxxx"
```

With environment variables set, the provider block can be empty:

```

Provider reads credentials from environment variables

provider "akamai" {}
```

Inline Credentials (Not Recommended for Production)

For quick testing, you can pass credentials directly:

```

Inline credentials - only use for testing

provider "akamai" {
config
```

Manage credentials securely. In CI/CD, use environment variables or a secrets manager. Never commit .edgerc to version control.

Operational Practices for Akamai Terraform

Use staging activations first. Always test property changes on the staging network before pushing to production. The depends_on pattern shown above enforces this ordering.

Store rules as templates. Keep your property rules in JSON template files rather than inline HCL. This makes them easier to review and test.

Import existing resources. If you already have Akamai configurations, use terraform import or the Akamai CLI's export feature to generate Terraform code from existing properties.

The guide covers everything you need to get the provider working and start managing Akamai resources through Terraform.

Provider Compatibility and Installation Summary

CLI Installation Summary

Conclusion

The Akamai Terraform provider brings infrastructure-as-code practices to your CDN and edge computing setup. By managing DNS, properties, security policies and edge workers through Terraform, you get version control, peer review and repeatable deployments for your entire Akamai configuration. Start with DNS records if you want a quick win, then progressively move property configurations into Terraform as you get comfortable with the workflow.

The CLI Terraform export library complements the provider by enabling you to reverse engineer existing Akamai assets into Terraform configuration. Exporting IAM, imaging policies, mTLS keystores and truststore CA sets creates a path from manual control center changes to codified state. Combined with secure credential handling via .edgerc sections, environment variables and per-user API clients using HMAC-SHA-256 authentication, teams can safely operate Akamai at scale with Terraform.

Sources

1. akamai.github.io/cli-terraform
2. github.com/akamai/terraform-provider-akamai
3. oneuptime.com/blog/post/2026-02-23-how-to-configure-akamai-provider-in-terraform/view