Terraform

Defined insandbox.hcl

The terraform resource allows you to provision infrastructure using Terraform configurations within your lab environment. It executes Terraform commands in a containerized environment and can pass variables and capture outputs for use by other resources.

Use Cases

As a lab author, you can use terraform resources to:

• Lab Environment Setup: Provision cloud infrastructure required for your lab scenarios using Terraform configurations
• Real Infrastructure Integration: Connect your lab to actual cloud resources when simulated environments aren’t sufficient
• Dynamic Configuration: Generate configuration files for other lab resources based on Terraform-provisioned infrastructure

Terraform resources allow lab authors to integrate real cloud infrastructure provisioning into their lab setup workflows.

HCL Syntax

Basic Syntax

resource "terraform" "example" {
  source = "./terraform"
}

Full Syntax

resource "terraform" "example" {
  source           = "./terraform"
  version          = "1.9.8"
  working_directory = "/terraform"

  # Environment variables
  environment = {
    AWS_REGION = "us-east-1"
    TF_LOG     = "INFO"
  }

  # Terraform variables
  variables = {
    instance_count = 2
    vpc_cidr       = "10.0.0.0/16"
  }

  # Network configuration
  network {
    id = resource.network.main.meta.id
    ip_address = "10.0.0.5"
    aliases = ["terraform"]
  }

  # Volume mounts
  volume {
    source      = "./terraform-modules"
    destination = "/modules"
    type        = "bind"
    read_only   = true
  }
}

Fields

Field	Type	Required	Description
source	string	✓	Path to the directory containing .tf files. Relative paths are relative to the HCL file.
version	string	—	Version of Terraform to use for execution. Defaults to 1.9.8 Default1.9.8 ConstraintsVersion must be in semantic version format (e.g., 1.9.8)
working_directory	string	—	Subdirectory within the source to execute Terraform commands. Defaults to root of source. Default./
environment	map(string)	—	Environment variables available during Terraform execution (e.g., AWS credentials, TF_VAR_* variables)
variables	map(string)	—	Input variables to pass to Terraform (-var flags). Variable names should not include 'TF_VAR_' prefix.
network	block	—	Networks to connect the Terraform execution container torepeatable
volume	block	—	Volumes to mount in the Terraform execution container (source directory is automatically mounted)repeatable

Network

terraform→Network

Networks to attach Terraform container to

Field	Type	Required	Description
id	string	✓	ID of the network to attach the container
ip_address	string	—	Static IP address to assign container for the network, the ip address must be within range defined by the network subnet. If this parameter is omitted an IP address will be automatically assigned.
aliases	list(string)	—	Aliases allow alternate names to specified for the container

Volume

terraform→Volume

Additional volumes to mount

Field	Type	Required	Description
source	string	✓	The source volume to mount in the container, can be specified as a relative `./` or absolute path `/usr/local/bin`. Relative paths are relative to the file declaring the container.
destination	string	✓	The destination in the container to mount the volume to, must be an absolute path
type	string	—	The type of the mount, can be one of the following values: - bind: bind the source path to the destination path in the container - volume: source is a Docker volume - tmpfs: create a temporary filesystem Allowedbind volume tmpfs Defaultbind
read_only	bool	—	Whether or not the volume is read only
bind_propagation	string	—	Configures bind propagation for Docker volume mounts, only applies to bind mounts, can be one of the following values: - shared - slave - private - rslave - rprivate For more information please see the Docker documentation. Allowedshared private slave rslave rprivate Defaultshared
bind_propagation_non_recursive	bool	—	Configures recursiveness of the bind mount. By default Docker mounts with the equivalent of `mount --rbind` meaning that mounts below the the source directory are visible in the container. For instance running `docker run --rm --mount type=bind,src=/,target=/host,readonly` busybox will make `/run` of the host available as `/host/run` in the container. To make matters even worse it will be writable (since only the toplevel bind is set readonly, not the children). If `bind_propagation_non_recursive` is set to true then the container will only see an empty `/host/run`, meaning the `tmpfs` which is typically mounted to `/run` on the host is not propagated into the container.
selinux_relabel	string	—	Configures Selinux relabeling for the container (usually specified as :z or :Z) and can be one of the following values: - shared (Equivalent to :z) - private (Equivalent to :Z) Allowed shared private

Computed Attributes

These attributes are set by the system and are read-only.

Attribute	Type	Description
network[].name	string	Name will equal the name of the network as created by jumppad
network[].assigned_address	string	AssignedAddress will equal if IPAddress is set, else it will be the value automatically assigned from the network
output	string	Terraform output values
source_checksum	string	Checksum of the source directory
apply_output	string	Output from terraform apply command

Examples

Basic Terraform Configuration

resource "terraform" "aws_vpc" {
  source = "./infrastructure"

  variables = {
    region = "us-west-2"
    environment = "lab"
  }
}

Advanced Configuration with Custom Version

resource "terraform" "kubernetes" {
  source  = "./k8s-terraform"
  version = "1.8.0"

  environment = {
    KUBE_CONFIG_PATH = "/root/.kube/config"
  }

  variables = {
    cluster_name = "lab-cluster"
    node_count   = 3
  }

  volume {
    source      = "./kubeconfig"
    destination = "/root/.kube"
    type        = "bind"
  }
}

Using Terraform Outputs in Other Resources

resource "terraform" "infrastructure" {
  source = "./terraform"

  variables = {
    vpc_cidr = "10.0.0.0/16"
  }
}

## Reference Terraform outputs
resource "container" "app" {
  image {
    name = "myapp:latest"
  }

  environment = {
    VPC_ID = resource.terraform.infrastructure.output.vpc_id
  }
}

Best Practices

1. State Management: Use remote state backends for production-like scenarios
2. Version Pinning: Specify exact Terraform versions for consistency across environments
3. Variable Organization: Use structured variable files and clear naming conventions
4. Output Usage: Define meaningful outputs for integration with other lab resources
5. Resource Tagging: Include proper tags for cost tracking and resource management
6. Network Isolation: Use dedicated networks for multi-tier application demonstrations
7. Volume Mounts: Mount configuration files and modules as read-only when possible
8. Environment Variables: Use environment variables for sensitive configuration like API keys