Object Storage Service:Use Terraform to manage OSS

Prerequisites

• To minimize security risks, we recommend that you use a RAM user with the minimum required permissions to perform the operations in this topic. This helps prevent the accidental exposure of your Alibaba Cloud account's AccessKey pair. For information about how to attach the minimum required policy to the RAM user, see Create a RAM user and Grant permissions to a RAM user. The following policy is provided for this topic:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "oss:*",
        "Resource": "*"
      }
    ]
  }

• Prepare a Terraform runtime environment by using one of the following methods:

  • Explorer: Alibaba Cloud provides Terraform Explorer, an online runtime environment for Terraform. You can use Terraform Explorer after you log on, without needing to install Terraform locally. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at no additional cost.

  • Cloud Shell: Terraform is preinstalled in Cloud Shell and identity credentials are configured. You can directly run Terraform commands in Cloud Shell. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at low cost.

  • Install and configure Terraform on your local computer: This method is suitable for scenarios in which network conditions are poor or a custom development environment is required.

Required resources

• alicloud_oss_bucket: creates an OSS bucket.

• alicloud_oss_bucket_acl: configures the ACL of the bucket.

Create a bucket

1. Create a working directory and a configuration file named main.tf within it. Copy the following code to the main.tf configuration file:

   variable "region"{
     default = "cn-beijing"
   }
   
   provider "alicloud"{
     region = var.region
   }
   
   resource "random_uuid" "default" {
   }
   
   # Create a bucket.
   resource "alicloud_oss_bucket" "bucket" {
     bucket = substr("tf-example-${replace(random_uuid.default.result, "-", "")}", 0, 16)
   }
   
   # Configure the ACL of the bucket.
   resource "alicloud_oss_bucket_acl" "bucket-ac"{
     bucket = alicloud_oss_bucket.bucket.id
     acl = "private"
   }
   

2. Run the following command to initialize the Terraform runtime environment:

   terraform init

   If the following output is displayed, Terraform is initialized:

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Run the following command to start code execution:

   terraform apply

   At the prompt, enter yes and press the Enter key. Wait for the command to complete. If the following output is displayed, the command succeeded:

   You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   
   Apply complete!  Resources: 3 added, 0 changed, 0 destroyed.

4. Verify the results.

   Run the terraform show command

   Run the following command in the working directory to query the details of the resources created via Terraform:

   terraform show

   

   Log on to the OSS console

   1. Log on to the OSS console. In the left-side navigation pane, click Buckets to view the newly created bucket on the Buckets page.

      

   2. Click the name of the created bucket. In the left-side navigation tree, choose Permission Control > ACL. On the ACL tab, view the ACL of the bucket.

      

Release resources

If you no longer need the resources created or managed via Terraform, run the following command to release them. For more information about the terraform destroy command, see Common commands.

terraform destroy

Example

variable "region"{
  default = "cn-beijing"
}

provider "alicloud"{
  region = var.region
}

resource "random_uuid" "default" {
}

# Create a bucket.
resource "alicloud_oss_bucket" "bucket" {
  bucket = substr("tf-example-${replace(random_uuid.default.result, "-", "")}", 0, 16)
}

# Configure the ACL of the bucket.
resource "alicloud_oss_bucket_acl" "bucket-ac"{
  bucket = alicloud_oss_bucket.bucket.id
  acl = "private"
}

If you want to view more complete examples, visit the directory of the corresponding service on the More Complete Examples page.