Partial backend configuration in Terraform - Commands & Configuration

Introduction

When using Terraform, you can set up the backend partially to share some settings while allowing others to be configured later. This helps teams reuse common backend settings but customize details like workspace or key per environment.

When multiple Terraform projects share the same backend type but differ in specific settings like workspace or key.

When you want to enforce some backend settings centrally but allow developers to override others locally.

When you want to commit partial backend configuration to version control but keep sensitive details out.

When you want to migrate backend settings gradually without breaking existing infrastructure.

When you want to reuse backend configuration blocks across multiple Terraform modules or repos.

Config File - main.tf

main.tf

terraform {
  backend "s3" {
    bucket = "example-terraform-state"
    region = "us-east-1"
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket-terraform"
  acl    = "private"
}

This Terraform configuration sets a partial backend for S3 with the bucket and region fixed. Other backend settings like the key or workspace can be set later by the user or environment.

The provider block configures AWS region for resource creation.

The resource block creates an S3 bucket as an example resource.

Commands

Initializes Terraform, reads the partial backend configuration, and prompts for missing backend settings like the key or workspace.

Terminal

terraform init

Expected Output

Initializing the backend...



Do you want to configure a backend? (yes/no) yes



Backend configuration required. Please enter the missing settings.



key [default]: env:dev/terraform.tfstate



Successfully configured the backend "s3"!



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see any changes.

Shows the execution plan for the resources defined, verifying that the backend is configured and state is stored remotely.

Terminal

terraform plan

Expected Output

Refreshing Terraform state in-memory prior to plan...



An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # aws_s3_bucket.example will be created

  + resource "aws_s3_bucket" "example" {

      + acl    = "private"

      + bucket = "example-bucket-terraform"

      + id     = (known after apply)

    }



Plan: 1 to add, 0 to change, 0 to destroy.

Applies the planned changes, creating the S3 bucket and storing state in the configured backend.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example: Creating...

aws_s3_bucket.example: Creation complete after 2s [id=example-bucket-terraform]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Skips interactive approval prompt to apply changes immediately

Key Concept

Partial backend configuration lets you fix some backend settings in code while supplying others interactively or per environment.

Common Mistakes

Defining all backend settings in the config file but expecting Terraform to prompt for missing ones.

Terraform will not prompt if all backend settings are present; partial config requires some settings to be omitted.

Omit the settings you want to supply later, like 'key' or 'workspace', to enable partial backend configuration.

Running 'terraform init' without supplying missing backend settings interactively or via CLI/environment.

Terraform initialization will fail or hang waiting for backend configuration input.

Provide missing backend settings when prompted or supply them via CLI flags or environment variables.

Summary

Create a Terraform config with partial backend settings, omitting some keys like 'key' or 'workspace'.

Run 'terraform init' to initialize and supply missing backend settings interactively.

Use 'terraform plan' and 'terraform apply' to manage infrastructure with the backend storing state remotely.

Practice

1. What is the main purpose of using a partial backend configuration in Terraform?

easy

A. To disable backend configuration completely

B. To store all backend secrets directly in the Terraform code

C. To automatically generate backend settings without user input

D. To split backend settings between code and runtime for flexibility and security

Solution

1. Step 1: Understand partial backend config concept

   Partial backend config allows some backend settings to be defined in code and others provided at runtime.

2. Step 2: Identify benefits

   This approach improves security by not hardcoding secrets and increases reusability of configs.

3. Final Answer:

   To split backend settings between code and runtime for flexibility and security -> Option D

4. Quick Check:

   Partial backend config = split settings [OK]

Hint: Partial config splits settings for safety and reuse [OK]

Common Mistakes:

• Thinking partial config disables backend
• Assuming all settings are auto-generated
• Storing secrets directly in code

2. Which of the following is the correct syntax to declare a partial backend configuration in Terraform code?

easy

A. terraform { backend "s3" { bucket = my-bucket } }

B. terraform { backend "s3" {} }

C. terraform { backend "s3" { bucket = "my-bucket" region = us-east-1 } }

D. terraform { backend "s3" { bucket = "my-bucket" key = state.tfstate } }

Solution

1. Step 1: Identify partial backend syntax

   Partial backend config uses empty braces to declare backend type without settings in code.

2. Step 2: Compare options

   terraform { backend "s3" {} } shows empty braces, meaning settings will be provided at runtime. Others have syntax errors (missing quotes around string values), so only A is valid.

3. Final Answer:

   terraform { backend "s3" {} } -> Option B

4. Quick Check:

   Empty braces = partial config [OK]

Hint: Empty braces mean partial backend config [OK]

Common Mistakes:

• Including settings inside backend block means full config
• Missing backend block entirely
• Using incorrect syntax for backend

3. Given this partial backend config:

terraform {
  backend "azurerm" {}
}

Which command do you run to provide missing backend settings?

medium

A. terraform validate -backend-config=storage_account_name=example

B. terraform apply -backend-config=storage_account_name=example

C. terraform init -backend-config=storage_account_name=example

D. terraform plan -backend-config=storage_account_name=example

Solution

1. Step 1: Understand partial backend config usage

   Partial backend requires missing settings at init time using -backend-config flag.

2. Step 2: Identify correct command

   Only terraform init accepts -backend-config to supply backend settings.

3. Final Answer:

   terraform init -backend-config=storage_account_name=example -> Option C

4. Quick Check:

   Init + -backend-config = provide missing settings [OK]

Hint: Use terraform init with -backend-config for missing settings [OK]

Common Mistakes:

• Using apply or plan with -backend-config
• Not providing missing backend settings before init
• Confusing validate command with init

4. You wrote this partial backend config:

terraform {
  backend "gcs" {
    bucket = "my-bucket"
  }
}

When running terraform init, you get an error about missing backend settings. What is the likely cause?

medium

A. You must provide missing settings like credentials or prefix at runtime

B. The bucket name is invalid and must be removed

C. Partial backend config cannot include any settings in code

D. Terraform does not support partial backend for GCS

Solution

1. Step 1: Analyze partial backend with some settings

   Partial backend can include some settings but missing required ones must be provided at runtime.

2. Step 2: Identify missing required settings

   Credentials or prefix may be missing, causing init error until supplied via CLI or env vars.

3. Final Answer:

   You must provide missing settings like credentials or prefix at runtime -> Option A

4. Quick Check:

   Missing settings provided via -backend-config at init [OK]

Hint: Partial config needs all required settings before init [OK]

Common Mistakes:

• Assuming bucket name alone is enough
• Thinking partial backend disallows any settings in code
• Believing GCS backend doesn't support partial config

5. You want to reuse the same Terraform code for multiple environments but keep backend secrets safe. Which partial backend config approach is best?

hard

A. Declare backend type with empty braces in code, supply secrets via CLI or env vars at init

B. Hardcode all backend settings including secrets in Terraform code

C. Use full backend config in code and commit secrets to version control

D. Avoid backend config and store state locally for all environments

Solution

1. Step 1: Understand goal of reusability and secret safety

   Reusing code means backend config should be generic; secrets must not be in code.

2. Step 2: Choose partial backend with empty braces

   Empty braces let you specify backend type but provide secrets securely at runtime.

3. Step 3: Evaluate other options

   Hardcoding secrets or committing them risks exposure; local state is not scalable.

4. Final Answer:

   Declare backend type with empty braces in code, supply secrets via CLI or env vars at init -> Option A

5. Quick Check:

   Partial config + runtime secrets = reusable & safe [OK]

Hint: Use empty backend block and supply secrets at init [OK]

Common Mistakes:

• Hardcoding secrets in code
• Committing secrets to version control
• Using local state for multiple environments