1---
2layout: "language"
3page_title: "Backend Type: oss"
4sidebar_current: "docs-backends-types-standard-oss"
5description: |-
6  Terraform can store state remotely in OSS and lock that state with OSS.
7---
8
9# OSS
10
11**Kind: Standard (with locking via TableStore)**
12
13Stores the state as a given key in a given bucket on Stores
14[Alibaba Cloud OSS](https://www.alibabacloud.com/help/product/31815.htm).
15This backend also supports state locking and consistency checking via
16[Alibaba Cloud Table Store](https://www.alibabacloud.com/help/doc-detail/27280.htm), which can be enabled by setting
17the `tablestore_table` field to an existing TableStore table name.
18
19-> **Note:** The OSS backend is available from terraform version 0.12.2.
20
21## Example Configuration
22
23```hcl
24terraform {
25  backend "oss" {
26    bucket = "bucket-for-terraform-state"
27    prefix   = "path/mystate"
28    key   = "version-1.tfstate"
29    region = "cn-beijing"
30    tablestore_endpoint = "https://terraform-remote.cn-hangzhou.ots.aliyuncs.com"
31    tablestore_table = "statelock"
32  }
33}
34```
35
36This assumes we have a [OSS Bucket](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/oss_bucket) created called `bucket-for-terraform-state`,
37a [OTS Instance](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ots_instance) called `terraform-remote` and
38a [OTS TableStore](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ots_table) called `statelock`. The
39Terraform state will be written into the file `path/mystate/version-1.tfstate`. The `TableStore` must have a primary key named `LockID` of type `String`.
40
41
42## Data Source Configuration
43
44To make use of the OSS remote state in another configuration, use the
45[`terraform_remote_state` data
46source](/docs/language/state/remote-state-data.html).
47
48```hcl
49terraform {
50  backend "oss" {
51    bucket = "remote-state-dns"
52    prefix = "mystate/state"
53    key    = "terraform.tfstate"
54    region = "cn-beijing"
55  }
56}
57```
58
59The `terraform_remote_state` data source will return all of the root outputs
60defined in the referenced remote state, an example output might look like:
61
62```
63data "terraform_remote_state" "network" {
64    backend   = "oss"
65    config    = {
66        bucket = "remote-state-dns"
67        key    = "terraform.tfstate"
68        prefix = "mystate/state"
69        region = "cn-beijing"
70    }
71    outputs   = {}
72    workspace = "default"
73}
74```
75
76## Configuration variables
77
78The following configuration options or environment variables are supported:
79
80 * `access_key` - (Optional) Alibaba Cloud access key. It supports environment variables `ALICLOUD_ACCESS_KEY` and  `ALICLOUD_ACCESS_KEY_ID`.
81 * `secret_key` - (Optional) Alibaba Cloud secret access key. It supports environment variables `ALICLOUD_SECRET_KEY` and  `ALICLOUD_ACCESS_KEY_SECRET`.
82 * `security_token` - (Optional) STS access token. It supports environment variable `ALICLOUD_SECURITY_TOKEN`.
83 * `ecs_role_name` - (Optional, Available in 0.12.14+) The RAM Role Name attached on a ECS instance for API operations. You can retrieve this from the 'Access Control' section of the Alibaba Cloud console.
84 * `region` - (Optional) The region of the OSS bucket. It supports environment variables `ALICLOUD_REGION` and `ALICLOUD_DEFAULT_REGION`.
85 * `endpoint` - (Optional) A custom endpoint for the OSS API. It supports environment variables `ALICLOUD_OSS_ENDPOINT` and `OSS_ENDPOINT`.
86 * `bucket` - (Required) The name of the OSS bucket.
87 * `prefix` - (Opeional) The path directory of the state file will be stored. Default to "env:".
88 * `key` - (Optional) The name of the state file. Defaults to `terraform.tfstate`.
89 * `tablestore_endpoint` / `ALICLOUD_TABLESTORE_ENDPOINT` - (Optional) A custom endpoint for the TableStore API.
90 * `tablestore_table` - (Optional) A TableStore table for state locking and consistency. The table must have a primary key named `LockID` of type `String`.
91 * `sts_endpoint` - (Optional, Available in 1.0.11+) Custom endpoint for the AliCloud Security Token Service (STS) API. It supports environment variable `ALICLOUD_STS_ENDPOINT`.
92 * `encrypt` - (Optional) Whether to enable server side
93   encryption of the state file. If it is true, OSS will use 'AES256' encryption algorithm to encrypt state file.
94 * `acl` - (Optional) [Object
95   ACL](https://www.alibabacloud.com/help/doc-detail/52284.htm)
96   to be applied to the state file.
97 * `shared_credentials_file` - (Optional, Available in 0.12.8+) This is the path to the shared credentials file. It can also be sourced from the `ALICLOUD_SHARED_CREDENTIALS_FILE` environment variable. If this is not set and a profile is specified, `~/.aliyun/config.json` will be used.
98 * `profile` - (Optional, Available in 0.12.8+)  This is the Alibaba Cloud profile name as set in the shared credentials file. It can also be sourced from the `ALICLOUD_PROFILE` environment variable.
99 * `assume_role` - (Optional, Available in 0.12.6+) If provided with a role ARN, will attempt to assume this role using the supplied credentials.
100
101The nested `assume_role` block supports the following:
102
103* `role_arn` - (Required) The ARN of the role to assume. If ARN is set to an empty string, it does not perform role switching. It supports environment variable `ALICLOUD_ASSUME_ROLE_ARN`.
104  Terraform executes configuration on account with provided credentials.
105
106* `policy` - (Optional) A more restrictive policy to apply to the temporary credentials. This gives you a way to further restrict the permissions for the resulting temporary
107  security credentials. You cannot use this policy to grant permissions which exceed those of the role that is being assumed.
108
109* `session_name` - (Optional) The session name to use when assuming the role. If omitted, 'terraform' is passed to the AssumeRole call as session name. It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_NAME`.
110
111* `session_expiration` - (Optional) The time after which the established session for assuming role expires. Valid value range: [900-3600] seconds. Default to 3600 (in this case Alibaba Cloud use own default value). It supports environment variable `ALICLOUD_ASSUME_ROLE_SESSION_EXPIRATION`.
112
113-> **Note:** If you want to store state in the custom OSS endpoint, you can specify a environment variable `OSS_ENDPOINT`, like "oss-cn-beijing-internal.aliyuncs.com"
114