Provider Configuration
Relevant source files
The following files were used as context for generating this wiki page:
The Terraform AWS provider serves as a plugin for Terraform, enabling the complete lifecycle management of AWS resources. The provider's configuration is the entry point for authenticating with AWS and setting region-specific and service-specific behavior for all managed resources. It defines the schema for user-provided credentials, endpoints, and other operational parameters.
This configuration is processed to initialize AWS service clients, which are then used by the individual resource and data source implementations throughout the provider. The provider is maintained by the HashiCorp AWS Provider team and is structured to support a vast number of AWS services in a modular fashion.
Sources: README.md, internal/provider/provider.go
Provider Initialization
The provider is initialized via the New() function, which returns a schema.Provider. This function sets up the provider's schema, defines its available resources and data sources, and configures the connection logic for interacting with AWS APIs.
Sources: internal/provider/provider.go:27-51
The initialization flow is as follows:
This diagram shows the steps taken within the New() function to construct the provider object.
Sources: internal/provider/provider.go:27-51
Provider Schema
The provider's configuration options are defined in the Schema field of the schema.Provider struct. These options allow users to configure credentials, region, and other settings.
Sources: internal/provider/provider.go:54-188
Top-Level Configuration Attributes
The following table details the primary configuration arguments for the AWS provider.
| Attribute | Type | Description |
|---|---|---|
access_key | String | The access key for API calls. |
secret_key | String | The secret key for API calls. |
region | String | The region where AWS operations will take place. |
profile | String | The profile for API operations. |
shared_credentials_file | String | The path to the shared credentials file. |
token | String | The session token for API calls. |
max_retries | Integer | The maximum number of times an API call is retried. |
insecure | Boolean | Explicitly allow the provider to perform "insecure" SSL requests. |
skip_credentials_validation | Boolean | Skip the credentials validation via STS GetCallerIdentity. |
skip_get_ec2_platforms | Boolean | Skip getting EC2 platforms. |
skip_region_validation | Boolean | Skip validation of the region name. |
skip_requesting_account_id | Boolean | Skip requesting the account ID. |
skip_metadata_api_check | Boolean | Skip the AWS Metadata API check. |
s3_force_path_style | Boolean | Set this to true to force the request to use path-style addressing. |
Sources: internal/provider/provider.go:54-188
Endpoints Configuration
The endpoints block allows for overriding the default AWS service endpoints, which is useful for testing with local alternatives like LocalStack or for using services in custom partitions.
Sources: internal/provider/provider.go:137-143
Assume Role Configuration
The assume_role block enables the provider to assume an IAM role before making API calls.
Sources: internal/provider/provider.go:122-128
Connection and Client Management
The provider manages AWS service clients through a central AWSClient struct. The Configure function, assigned to ConfigureFunc, is responsible for processing the user's configuration and initializing this client manager.
Sources: internal/provider/provider.go:190-211, internal/conns/conns.go
Client Acquisition Flow
When a resource needs to make an API call, it requests a service-specific client from the central connection manager.
The following sequence diagram illustrates how a service client (e.g., for EC2) is obtained.
This diagram shows the process of a resource obtaining a configured AWS service client via the provider's internal connection management system.
Sources: internal/conns/conns.go, internal/provider/provider.go:190-211
Service Structure
The provider is organized into packages, with each AWS service (e.g., IAM, S3, Config Service) residing in its own directory under internal/service/. This modular design is a core architectural principle of the provider. Each service package is responsible for its own resources and data sources.
Sources: internal/service/iam/README.md, internal/service/configservice/README.md, internal/service/s3/README.md
The diagram below illustrates this modular structure.
This graph shows the central provider linking to various independent service packages.
Sources: internal/service/iam/README.md, internal/service/configservice/README.md, internal/service/s3/README.md