Terraform remote state management is central to safe multi-user infrastructure workflows. The OSS backend provides a remote state solution that stores the state as a given key in a given bucket on Alibaba Cloud OSS. This backend also supports state locking and consistency checking via Alibaba Cloud Table Store, which can be enabled by setting the tablestore_table field to an existing TableStore table name. This backend supports state locking via TableStore. Note: The OSS backend is available from terraform version 0.12.2.
The backend is designed for teams that want centralized, durable state storage with locking guarantees on Alibaba Cloud. The state file is written to a path constructed from bucket, prefix and key, and the locking layer relies on TableStore with a required LockID primary key of type String.
Overview of Terraform OSS Backend
The OSS backend stores the state as a given key in a given bucket on Stores Alibaba Cloud OSS. Configuration is declared in the Terraform block.
Example configuration assumes we have a OSS Bucket created called bucket-for-terraform-state, a OTS Instance called terraform-remote and a OTS TableStore called statelock. The Terraform state will be written into the file path/mystate/version-1.tfstate
terraform {
backend "oss" {
bucket = "bucket-for-terraform-state"
prefix = "path/mystate"
key = "version-1.tfstate"
region = "cn-beijing"
tablestore_endpoint = "https://terraform-remote.cn-hangzhou.ots.aliyuncs.com"
tablestore_table = "statelock"
}
}
This assumes we have a OSS Bucket created called bucket-for-terraform-state,
a OTS Instance called terraform-remote
and
a OTS TableStore called statelock
. The
Terraform state will be written into the file path/mystate/version-1.tfstate
The TableStore must have a primary key named LockID of type String.
When a second configuration needs to read outputs from the remote state, the terraformremotestate data source is used.
terraform {
backend "oss" {
bucket = "remote-state-dns"
prefix = "mystate/state"
key = "terraform.tfstate"
region = "cn-beijing"
}
}
The terraformremotestate data source will return all of the root outputs defined in the referenced remote state, an example output might look like:
data "terraform_remote_state" "network" {
backend = "oss"
config = {
bucket = "remote-state-dns"
key = "terraform.tfstate"
prefix = "mystate/state"
region = "cn-beijing"
}
outputs = {}
workspace = "default"
}
Configuration Anatomy and Required Resources
The OSS backend requires a bucket and a region at minimum. Optional parameters control prefix and key naming, endpoint overrides, and TableStore locking.
The example configuration with locking shows bucket = "bucket-for-terraform-state", prefix = "path/mystate", key = "version-1.tfstate", region = "cn-beijing", tablestoreendpoint = "https://terraform-remote.cn-hangzhou.ots.aliyuncs.com", tablestoretable = "statelock".
A second example for remote state consumption uses bucket = "remote-state-dns", prefix = "mystate/state", key = "terraform.tfstate", region = "cn-beijing".
The prefix is the path directory of the state file will be stored. Default to "env:".
The key is the name of the state file. Defaults to terraform.tfstate.
State Locking and Consistency Checking with TableStore
State locking prevents concurrent applies from corrupting state. The OSS backend supports state locking via TableStore.
This backend also supports state locking and consistency checking via Alibaba Cloud Table Store, which can be enabled by setting the tablestore_table field to an existing TableStore table name.
The TableStore must have a primary key named LockID of type String.
Configuration parameters for locking include:
- tablestoreendpoint - A custom endpoint for the TableStore API. It supports environment variables ALICLOUDTABLESTOREENDPOINT and ALIBABACLOUDTABLESTOREENDPOINT
- tablestoreinstancename - Specifies the name of an instance that TableStore belongs to. By default, Terraform parses the name from tablestore_endpoint
- tablestore_table - The TableStore table name used for locking
Locking is optional but recommended for team environments.
Credentials and Sensitive Data Handling
Warning: We recommend using environment variables to supply credentials and other sensitive data. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. Refer to Credentials and Sensitive Data for details.
The following configuration options or environment variables are supported:
- accesskey - Optional Alibaba Cloud access key. It supports environment variables ALICLOUDACCESSKEY and ALIBABACLOUDACCESSKEY_ID
- secretkey - Optional Alibaba Cloud secret access key. It supports environment variables ALICLOUDSECRETKEY and ALIBABACLOUDSECRETKEY
- securitytoken - Optional STS access token. It supports environment variable ALICLOUDSECURITYTOKEN and ALIBABACLOUDSECURITYTOKEN
- ecsrolename - Optional The RAM Role Name attached on a ECS instance for API operations. You can retrieve this from the 'Access Control' section of the Alibaba Cloud console
- region - Optional The region of the OSS bucket. It supports environment variables ALICLOUDREGION and ALIBABACLOUD_REGION
- endpoint - Optional A custom endpoint for the OSS API. It supports environment variables ALICLOUDOSSENDPOINT and ALIBABACLOUDOSS_ENDPOINT
- bucket - Required The name of the OSS bucket
- prefix - Optional The path directory of the state file will be stored. Default to "env:"
- key - Optional The name of the state file. Defaults to terraform.tfstate
- tablestoreendpoint - Optional A custom endpoint for the TableStore API. It supports environment variables ALICLOUDTABLESTOREENDPOINT and ALIBABACLOUDTABLESTOREENDPOINT
- tablestoreinstancename - Optional Specifies the name of an instance that TableStore belongs to. By default, Terraform parses the name from tablestore_endpoint
Configuration Options Reference Table
| Option | Requirement | Description |
| bucket | Required | The name of the OSS bucket |
| prefix | Optional | The path directory of the state file will be stored. Default to "env:" |
| key | Optional | The name of the state file. Defaults to terraform.tfstate |
| region | Optional | The region of the OSS bucket. It supports environment variables ALICLOUDREGION and ALIBABACLOUDREGION |
| endpoint | Optional | A custom endpoint for the OSS API. It supports environment variables ALICLOUDOSSENDPOINT and ALIBABACLOUDOSSENDPOINT |
| accesskey | Optional | Alibaba Cloud access key. It supports environment variables ALICLOUDACCESSKEY and ALIBABACLOUDACCESSKEYID |
| secretkey | Optional | Alibaba Cloud secret access key. It supports environment variables ALICLOUDSECRETKEY and ALIBABACLOUDSECRETKEY |
| securitytoken | Optional | STS access token. It supports environment variable ALICLOUDSECURITYTOKEN and ALIBABACLOUDSECURITYTOKEN |
| ecsrolename | Optional | The RAM Role Name attached on a ECS instance for API operations |
| tablestoreendpoint | Optional | A custom endpoint for the TableStore API. It supports environment variables ALICLOUDTABLESTOREENDPOINT and ALIBABACLOUDTABLESTOREENDPOINT |
| tablestoreinstancename | Optional | Specifies the name of an instance that TableStore belongs to. By default, Terraform parses the name from tablestoreendpoint |
| tablestore_table | Optional | TableStore table name for state locking |
Terraform Open Source Context and Enterprise Differentiation
Understanding the OSS backend sits within the broader Terraform ecosystem.
Terraform Open-Source is a free, community-supported version of HashiCorp's Infrastructure as Code tool.
It allows users to define infrastructure as code, enabling consistent and repeatable infrastructure provisioning.
Core Functionality: Supports the basic functionality of defining infrastructure as code using the HCL or JSON.
Provider Ecosystem: Access to a wide range of providers to manage various cloud services AWS, Azure, GCP, etc., as well as other services like GitHub, Kubernetes, and more.
State Management: Manages infrastructure state, which tracks the current state of resources and allows Terraform to know what to create, update, or delete.
Modules: Supports reusable modules to share and reuse configurations.
Cost: Free to use, making it ideal for small teams or individual developers.
Flexibility: Open-source nature allows for customization and integration with other tools.
Community Support: Strong community with extensive documentation, forums, and third-party tutorials.
Scalability: Limited scalability for larger teams and complex infrastructures.
Collaboration: Lacks built-in collaboration features like role-based access control, policy enforcement, and private module registry.
Enterprise Features: Missing advanced features such as audit logging, single sign-on, and integrations with enterprise authentication providers.
Terraform Enterprise is a paid version designed for businesses and large organizations.
It provides the tools necessary for managing complex and large-scale infrastructures efficiently and securely.
While the open-source version of Terraform is a powerful and free tool, Terraform Enterprise offers additional capabilities and features that can be invaluable for organizations with complex infrastructure needs and a strong emphasis on collaboration, governance, and automation.
Comparison table:
| Dimension | Terraform Open Source | Terraform Enterprise |
| Cost | Free to use | Paid version designed for businesses and large organizations |
| Collaboration | Lacks built-in collaboration features like role-based access control, policy enforcement, and private module registry | Provides tools for managing complex and large-scale infrastructures efficiently and securely |
| Enterprise Features | Missing advanced features such as audit logging, single sign-on, and integrations with enterprise authentication providers | Offers additional capabilities and features for collaboration, governance, and automation |
| Support | Strong community with extensive documentation, forums, and third-party tutorials | Paid support and enterprise features |
| Scalability | Limited scalability for larger teams and complex infrastructures | Designed for larger teams and complex infrastructures |
Core Terraform Capabilities Supporting Remote Backends
Terraform is a tool for building, changing, and versioning infrastructure safely and efficiently. Terraform can manage existing and popular service providers as well as custom in-house solutions.
The key features of Terraform are:
- Infrastructure as Code: Infrastructure is described using a high-level configuration syntax. This allows a blueprint of your datacenter to be versioned and treated as you would any other code. Additionally, infrastructure can be shared and re-used.
- Execution Plans: Terraform has a "planning" step where it generates an execution plan. The execution plan shows what Terraform will do when you call apply. This lets you avoid any surprises when Terraform manipulates infrastructure.
- Resource Graph: Terraform builds a graph of all your resources, and parallelizes the creation and modification of any non-dependent resources. Because of this, Terraform builds infrastructure as efficiently as possible, and operators get insight into dependencies in their infrastructure.
- Change Automation: Complex changesets can be applied to your infrastructure with minimal human interaction
Resources for learning:
- Website: https://developer.hashicorp.com/terraform
- Forums: HashiCorp Discuss
- Documentation: https://developer.hashicorp.com/terraform/docs
- Tutorials: HashiCorp's Learn Platform
- Certification Exam: HashiCorp Certified: Terraform Associate
Conclusion
The OSS backend delivers a concrete remote state solution for Alibaba Cloud users. State is stored as a given key in a given bucket on Alibaba Cloud OSS with optional prefix control. State locking and consistency checking are enabled via Alibaba Cloud Table Store by setting the tablestore_table field to an existing TableStore table name. The backend is available from terraform version 0.12.2 and requires a TableStore table with a primary key named LockID of type String.
Configuration spans bucket, prefix, key, region, endpoint overrides, and credential options. Credentials should be supplied via environment variables ALICLOUDACCESSKEY, ALIBABACLOUDACCESSKEYID, ALICLOUDSECRETKEY, ALIBABACLOUDSECRETKEY, ALICLOUDSECURITYTOKEN, ALIBABACLOUDSECURITYTOKEN, ALICLOUDREGION, ALIBABACLOUDREGION, ALICLOUDOSSENDPOINT, ALIBABACLOUDOSSENDPOINT, ALICLOUDTABLESTOREENDPOINT, ALIBABACLOUDTABLESTORE_ENDPOINT. Hardcoding values risks exposure in .terraform subdirectory and plan files.
Remote state consumption uses the terraformremotestate data source with backend = "oss" and a matching config block for bucket, key, prefix, and region.
Within the broader Terraform landscape, the open-source edition provides free, community-supported IaC with HCL support, provider ecosystem, state management, and modules. It offers flexibility and community support but has limited scalability for larger teams and lacks built-in collaboration features like role-based access control, policy enforcement, and private module registry, as well as advanced features such as audit logging, single sign-on, and integrations with enterprise authentication providers. Terraform Enterprise is a paid version designed for businesses and large organizations that need those governance, collaboration, and automation capabilities.
The core Terraform capabilities of Infrastructure as Code, Execution Plans, Resource Graph, and Change Automation remain the foundation that makes remote backends like OSS valuable for safe, repeatable, and efficient infrastructure operations.