Configure Terraform deployment

Before onboarding, configure the prerequisites, authentication, account type, products, and Terraform providers.

Prerequisites

You need:

• Terraform 1.5 or later

• AWS provider 6.x

• Zesty provider 0.3.x

• AWS credentials with permission to create the resources required by the selected configuration

• A Zesty API token provided by Zesty

• Access to an existing EKS cluster if you plan to install Kompass

For exact provider constraints, see the module's versions.tf.

Important

• Do not manage the same AWS account with Terraform and the Zesty UI or CloudFormation at the same time.

• If you onboard an account with this Terraform module, use the same Terraform state and module block for future onboarding changes.

• If the account is currently managed through the Zesty UI, CloudFormation, or an older Zesty Terraform module, contact Customer Support before moving it to this module.

• Changing the module source does not automatically transfer existing resources to a new Terraform state. Migration might require an approved import or state-move procedure.

Configure authentication

Terraform requires two independent credentials:

1. AWS credentials for the AWS account that you are onboarding.

2. A Zesty API token for the zesty provider.

Configure the Zesty API token

For CI/CD, store ZESTY_API_TOKEN as a protected environment secret in your CI/CD or Terraform execution platform. Configure the runner to inject it into every plan, apply, and destroy operation.

Configure the provider as follows:

provider "zesty" {}

For a local run, set the token in your current shell:

export ZESTY_API_TOKEN="<your-zesty-api-token>"

Do not put the token directly in source control.

Use AWS Secrets Manager

With Terraform 1.10 or later, you can retrieve the Zesty API token from AWS Secrets Manager without writing the token to state or plan files:

ephemeral "aws_secretsmanager_secret_version" "zesty" {
  secret_id = "zesty/api-token"
}

provider "zesty" {
  token = ephemeral.aws_secretsmanager_secret_version.zesty.secret_string
}

The AWS identity running Terraform must have secretsmanager:GetSecretValue permission for the secret.

Choose the AWS account type

Set account_type for every module block.

Do not use standalone as the value of account_type.

For a standalone account, use:

account_type              = "management"
enable_organization_trust = false

Choose the products to enable

Product blocks are presence-based:

• Omit the block to leave the product disabled.

• Use cm = {} to enable Commitment Manager.

• Use kompass = {} to enable Kompass account onboarding.

• Omit both product blocks for base read-only onboarding.

cm.enabled and kompass.enabled remain supported for backward compatibility. For new configurations, use block presence.

Note Base read-only onboarding is not a Commitment Manager mode. It connects the account with baseline read permissions without enabling Commitment Manager automation or Kompass.

Configure the Terraform providers

Use Terraform 1.5 or later with the AWS 6.x provider and Zesty 0.3.x provider:

terraform {
  required_version = ">= 1.5"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }

    zesty = {
      source  = "zesty-co/zesty"
      version = "~> 0.3.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

provider "zesty" {}

After configuring the providers and one of the module configurations below, run:

terraform init
terraform plan
terraform apply