1---
2layout: "language"
3page_title: "Backend Type: consul"
4sidebar_current: "docs-backends-types-standard-consul"
5description: |-
6  Terraform can store state in Consul.
7---
8
9# consul
10
11**Kind: Standard (with locking)**
12
13Stores the state in the [Consul](https://www.consul.io/) KV store at a given path.
14
15This backend supports [state locking](/docs/language/state/locking.html).
16
17## Example Configuration
18
19```hcl
20terraform {
21  backend "consul" {
22    address = "consul.example.com"
23    scheme  = "https"
24    path    = "full/path"
25  }
26}
27```
28
29Note that for the access credentials we recommend using a
30[partial configuration](/docs/language/settings/backends/configuration.html#partial-configuration).
31
32## Data Source Configuration
33
34```hcl
35data "terraform_remote_state" "foo" {
36  backend = "consul"
37  config = {
38    path = "full/path"
39  }
40}
41```
42
43## Configuration variables
44
45The following configuration options / environment variables are supported:
46
47 * `path` - (Required) Path in the Consul KV store
48 * `access_token` / `CONSUL_HTTP_TOKEN` - (Required) Access token
49 * `address` / `CONSUL_HTTP_ADDR` - (Optional) DNS name and port of your Consul endpoint specified in the
50   format `dnsname:port`. Defaults to the local agent HTTP listener.
51 * `scheme` - (Optional) Specifies what protocol to use when talking to the given
52   `address`, either `http` or `https`. SSL support can also be triggered
53   by setting then environment variable `CONSUL_HTTP_SSL` to `true`.
54 * `datacenter` - (Optional) The datacenter to use. Defaults to that of the agent.
55 * `http_auth` / `CONSUL_HTTP_AUTH` - (Optional) HTTP Basic Authentication credentials to be used when
56   communicating with Consul, in the format of either `user` or `user:pass`.
57 * `gzip` - (Optional) `true` to compress the state data using gzip, or `false` (the default) to leave it uncompressed.
58 * `lock` - (Optional) `false` to disable locking. This defaults to true, but will require session permissions with Consul and at least kv write permissions on `$path/.lock` to perform locking.
59 * `ca_file` / `CONSUL_CACERT` - (Optional) A path to a PEM-encoded certificate authority used to verify the remote agent's certificate.
60 * `cert_file` / `CONSUL_CLIENT_CERT` - (Optional) A path to a PEM-encoded certificate provided to the remote agent; requires use of `key_file`.
61 * `key_file` / `CONSUL_CLIENT_KEY` - (Optional) A path to a PEM-encoded private key, required if `cert_file` is specified.
62