Migrate State to Terraform Cloud

As a current user of the Terraform CLI, you are responsible for maintaining a state file as a source of truth for your cloud infrastructure. You can keep your state file secure and share it with collaborators, by migrating it to Terraform Cloud without interrupting or recreating your existing infrastructure.

»Prerequisites

This tutorial assumes that you have the following:

• The Terraform CLI installed locally
• A Terraform Cloud account

If you don't have Terraform installed locally, you can complete this tutorial in an interactive lab from your web browser. Launch it here.

»Create state

Start by cloning this GitHub repository.

$ git clone https://github.com/hashicorp/learn-state-migration

Next, change into the directory.

$ cd learn-state-migration

Review the main.tf file in the working directory to get an overview of the resources you are about to create. This configuration uses the random_pet resource to generate and output a random pet name with a given number of words. The length of the name is determined by the value of the name_length variable, which defaults 3.

In a real-world configuration you may have additional variables such as cloud platform credentials defined in a .tfvars file. We'll cover how to set these values in the Terraform Cloud workspace later on in this tutorial, after you've migrated the state file.

## Terraform configuration

terraform {
  required_providers {
    random = {
      source  = "hashicorp/random"
      version = "3.0.1"
    }
  }
  required_version = "~> 0.14"
}

variable "name_length" {
  description = "The number of words in the pet name"
  default     = "3"
}

resource "random_pet" "pet_name" {
  length    = var.name_length
  separator = "-"
}

output "pet_name" {
  value = random_pet.pet_name.id
}

Initialize the directory.

$ terraform init

After Terraform initializes, apply the configuration and approve the run by typing "yes" at the prompt.

$ terraform apply

Terraform will output a three word randomly generated pet name.

»Set up the remote backend

Now that you have a local state file, you need to create a backend code block in your configuration. Backends tell Terraform where to load and save its state file.

Terraform uses the local backend by default if you do not explicitly define a backend code block in your configuration. The local backend saves your state as a terraform.tfstate file in the directory where you run terraform apply. To migrate state files to Terraform Cloud, define a remote backend in your configuration by adding a new code block to the beginning of your main.tf file.

terraform {
  required_providers {
    random = {
      source  = "hashicorp/random"
      version = "3.0.1"
    }
  }
  required_version = "~> 0.14"
  backend "remote" {
    hostname      = "app.terraform.io"
    organization  = "<YOUR-ORG-NAME>"

    workspaces {
      name = "state-migration"
    }
  }
}

Replace the organization and workspaces attribute values with the name of your Terraform Cloud organization and desired workspace name. While the organization defined in the backend stanza must already exist, the workspace does not have to; Terraform Cloud will create it if necessary. If you opt to use a workspace that already exists, the workspace must not have any existing states.

»Authenticate with Terraform Cloud

Now that you have defined your backend, you must authenticate with Terraform Cloud in order to proceed with initialization. In order to authenticate with Terraform Cloud, run the terraform login subcommand, and follow the prompts to log in.

$ terraform login
Terraform will request an API token for app.terraform.io using your browser.

If login is successful, Terraform will store the token in plain text in
the following file for use by subsequent commands:
    /Users/username/.terraform.d/credentials.tfrc.json

Do you want to proceed?
  Only 'yes' will be accepted to confirm.

  Enter a value:

Respond to the confirmation prompt with a yes.

For more detailed instructions on logging in, see the login tutorial.

»Migrate the state file

Once you have authenticated the remote backend, you're ready to migrate your local state file to Terraform Cloud. To begin the migration, reinitialize. This causes Terraform to recognize your changed backend configuration.

$ terraform init

Initializing the backend...
Do you want to copy existing state to the new backend?
  Pre-existing state was found while migrating the previous "local" backend to the
  newly configured "remote" backend. No existing state was found in the newly
  configured "remote" backend. Do you want to copy this state to the new "remote"
  backend? Enter "yes" to copy and "no" to start with an empty state.

  Enter a value:

During reinitialization, Terraform presents a prompt saying that it will copy the state file to the new backend. Enter yes and Terraform will migrate the state from your local machine to Terraform Cloud.

»Configure the Terraform Cloud workspace

After migrating your state to Terraform Cloud, log in to the Terraform Cloud web UI, find your workspace name as defined in your backend configuration, and click on it. Navigate to the "States" tab of the workspace, and see your first action within the workspace.

Remember that your configuration has a variable that you need to add to the new workspace. Click the "Variables" tab in the workspace and then "Add variable". Enter the name of the variable, name_length, as the key. Then enter a new value, 5, and save the variable.

For real-world configurations, add cloud platform credentials and any other configuration variables to the workspace as well.

»Initiate a run in the new workspace

After verifying that the state was migrated to the Terraform Cloud workspace, remove the local state file.

$ rm terraform.tfstate

Apply a new run.

$ terraform apply

Terraform will stream logs from Terraform Cloud and provide a link to the run in the Terraform Cloud UI. You set a new value for the name_length variable, so the resource will be replaced with one matching the new parameters.

»Next steps

Destroy the resources you created for this tutorial by first clicking the "Settings" option in the Terraform Cloud workspace, selecting "Destruction and Deletion", ensuring the "Allow destroy plans" checkbox is checked, and then clicking "Queue destroy plan".

After the resources have been destroyed, return to the "Destruction and Deletion" page and click "Delete from Terraform Cloud" to delete the workspace.

In this tutorial, you migrated a state file from your local machine to a Terraform Cloud workspace. To learn how to migrate the state files of multiple local workspaces, or restrict workspace access to a particular team, see the following documentation.

• Migrating State from Multiple Local Workspaces
• Managing Workspace Access

If you have a large number of state files that you would like to migrate to Terraform Cloud, consider using the Terraform Cloud API to do so. For information on uploading state versions using the API, refer to the State Version API documentation.