Object Storage Service:Use Terraform to manage OSS

Prerequisites

• We recommend that you use a RAM user that has the minimum required permissions to perform the operations in this topic. This minimizes the risk of leaking the AccessKey pair of your Alibaba Cloud account. For information about how to attach the minimum required policy to the RAM user, see Create a RAM user and Grant permissions to a RAM user. The following policy is provided for this topic:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "oss:*",
        "Resource": "*"
      }
    ]
  }

• The runtime environment for Terraform is prepared by using one of the following methods:

  • Explorer: Alibaba Cloud provides Terraform Explorer, an online runtime environment for Terraform. You can use Terraform after you log on to Terraform Explorer without the need to install Terraform. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at no additional cost.

  • Cloud Shell: Terraform is preinstalled in Cloud Shell and identity credentials are configured. You can directly run Terraform commands in Cloud Shell. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at low cost.

  • Install and configure Terraform on your local computer: This method is suitable for scenarios in which network conditions are poor or a custom development environment is required.

Required resources

• alicloud_oss_bucket: creates an OSS bucket.

• alicloud_oss_bucket_acl: configures the ACL of the bucket.

Create a bucket

1. Create a directory and a configuration file named main.tf in the directory. Copy the following code to the main.tf configuration file:

   variable "region"{
     default = "cn-beijing"
   }
   
   provider "alicloud"{
     region = var.region
   }
   
   resource "random_uuid" "default" {
   }
   
   # Create a bucket.
   resource "alicloud_oss_bucket" "bucket" {
     bucket = substr("tf-example-${replace(random_uuid.default.result, "-", "")}", 0, 16)
   }
   
   # Configure the ACL of the bucket.
   resource "alicloud_oss_bucket_acl" "bucket-ac"{
     bucket = alicloud_oss_bucket.bucket.id
     acl = "private"
   }
   

2. Run the following command to initialize the Terraform runtime environment:

   terraform init

   If the following command output is returned, Terraform is initialized:

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Run the following command to start code execution:

   terraform apply

   During the code execution, enter yes as prompted and press the Enter key. Wait until the command is complete. If the following command output is returned, the code runs successfully.

   You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   
   Apply complete!  Resources: 3 added, 0 changed, 0 destroyed.

4. Verify the results.

   Run the terraform show command

   Run the following command in the directory to query the details of the bucket that is created by using Terraform:

   terraform show

   

   Log on to the OSS console

   1. Log on to the OSS console. In the left-side navigation pane, click Buckets to go to the Buckets page to view the created bucket.

      

   2. Click the name of the created bucket. In the left-side navigation tree, choose Permission Control > ACL. On the ACL tab, view the ACL of the bucket.

      

Release resources

If you no longer require the preceding resources that are created or managed by using Terraform, run the following command to release the resources. For more information about the terraform destroy command, see Common commands.

terraform destroy

Example

variable "region"{
  default = "cn-beijing"
}

provider "alicloud"{
  region = var.region
}

resource "random_uuid" "default" {
}

# Create a bucket.
resource "alicloud_oss_bucket" "bucket" {
  bucket = substr("tf-example-${replace(random_uuid.default.result, "-", "")}", 0, 16)
}

# Configure the ACL of the bucket.
resource "alicloud_oss_bucket_acl" "bucket-ac"{
  bucket = alicloud_oss_bucket.bucket.id
  acl = "private"
}

If you want to view more complete examples, visit the directory of the corresponding service on the More Complete Examples page.