Add S3 State Locking Input #39
Conversation
WalkthroughIntroduces s3_state_lock_enabled to enable S3-based state locking and conditionally disable DynamoDB resources. Refactors logic to compute local.dynamodb_enabled and updates references across IAM, outputs, and module invocation. Updates README to document the new input. No exported/public APIs changed beyond variable addition. Changes
Sequence Diagram(s)sequenceDiagram
participant User as Caller
participant Module as tfstate_backend (root)
participant IAM as IAM Policies
participant DDB as DynamoDB Table
participant S3 as S3 Locking
User->>Module: set s3_state_lock_enabled, dynamodb_enabled
Module->>Module: compute local.dynamodb_enabled = s3_lock ? false : dynamodb_enabled
Module-->>IAM: apply policies if local.dynamodb_enabled
alt S3 lock enabled
Module--X DDB: skip creation
Module->>S3: use S3 for state locking
else DynamoDB enabled
Module->>DDB: create table for locking
end
Module-->>User: outputs gated by local.dynamodb_enabled
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Assessment against linked issues
Possibly related PRs
Suggested labels
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
/terratest |
|
Important Do not edit the Please update the Could you fix it @milldr? 🙏 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
src/README.md (1)
193-193: Document OpenTofu compatibility and behavior changes when S3 locking is enabledThe input is clear. Please add a short “Note” in the README (outside the terraform-docs table) stating:
- S3 state locking requires OpenTofu >= 1.10.1 (HashiCorp Terraform CLI does not support S3 lockfiles).
- When
s3_state_lock_enabled = true, no DynamoDB resources or IAM permissions for DynamoDB are created, and DynamoDB-related outputs will be empty.This will reduce confusion for users toggling between Terraform and OpenTofu and clarify the IAM/output implications.
I can propose a small note snippet and where to place it if helpful.
src/variables.tf (1)
54-58: Input addition looks good; consider adding a validation to avoid confusing configurationsThe variable is well-described. Since
var.s3_state_lock_enabled = trueoverridesvar.dynamodb_enabled, consider surfacing that to users with a validation to prevent inadvertently setting both to true.Follow-up (applies outside the changed lines): add a validation block to
variable "dynamodb_enabled":variable "dynamodb_enabled" { type = bool default = true description = "Whether to create the DynamoDB table." validation { condition = !(var.dynamodb_enabled && var.s3_state_lock_enabled) error_message = "dynamodb_enabled cannot be true when s3_state_lock_enabled is true. Either disable DynamoDB or disable S3 state locking." } }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these settings in your CodeRabbit configuration.
📒 Files selected for processing (5)
src/README.md(1 hunks)src/iam.tf(1 hunks)src/main.tf(1 hunks)src/outputs.tf(1 hunks)src/variables.tf(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (4)
src/iam.tf (1)
72-72: Correct gating for DynamoDB IAM permissionsSwitching the guard to
local.dynamodb_enabledaligns IAM policy with the new logic that disables DDB when S3 locking is enabled. The dynamic block prevents referencing the DDB ARN when disabled. LGTM.src/main.tf (2)
4-6: Good: single source of truth for DynamoDB enablementThe local expression cleanly enforces “S3 lockfile overrides DDB.” This centralizes the branching and avoids diverging checks across files.
12-20: No action required — module v1.6.0 supportss3_state_lock_enabledVerified: cloudposse/terraform-aws-tfstate-backend added the
s3_state_lock_enabledinput in v1.6.0 (PR #192), default = false — so passing that argument is supported.
- Files to note: src/main.tf (lines 12–20) — current use of
s3_state_lock_enabled = var.s3_state_lock_enabledis valid if the module is pinned to v1.6.0 or later.- Action only if necessary: if the module is pinned to an older version, bump the module version to >= v1.6.0.
src/outputs.tf (1)
18-18: Outputs correctly gated on the computed localSwitching the DynamoDB-related outputs to depend on
local.dynamodb_enabledkeeps outputs consistent with the IAM logic and the module inputs. This prevents attempts to read DDB attributes when S3 locking is enabled.Also applies to: 23-23, 28-28
|
These changes were released in v1.537.2. |
what
This pull request introduces support for using S3-based state locking as an alternative to DynamoDB for Terraform state management. It adds a new variable to control this behavior and ensures that DynamoDB resources are not created when S3 state locking is enabled. The changes also make sure that documentation and outputs reflect the new logic.
Support for S3 State Locking:
s3_state_lock_enabledto allow switching between DynamoDB and S3 for state locking, with documentation updates insrc/README.mdand variable definition insrc/variables.tf. [1] [2]src/main.tfto disable DynamoDB automatically whens3_state_lock_enabledis true, and passed this value to thetfstate_backendmodule.Conditional Resource and Output Handling:
src/iam.tfto use the new local variable for enabling DynamoDB, ensuring the correct resource is referenced.src/outputs.tfto use the local DynamoDB enabled flag, so DynamoDB outputs are empty when S3 state locking is used.why
references
var.dynamodb_enabled#33Summary by CodeRabbit