---
title: "Configure Terraform deployment"
slug: "configure-terraform-deployment"
updated: 2026-11-05T09:45:55Z
published: 2026-11-05T09:45:55Z
canonical: "docs.zesty.co/configure-terraform-deployment"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zesty.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Terraform deployment

Before onboarding, configure the prerequisites, authentication, account type, products, and Terraform providers.

### Prerequisites

You need:

- Terraform 1.5 or later
- AWS provider 6.x
- Zesty provider 0.3.x
- AWS credentials with permission to create the resources required by the selected configuration
- A Zesty API token provided by Zesty
- Access to an existing EKS cluster if you plan to install Compute Optimization

For exact provider constraints, see the module's [versions.tf](https://github.com/zesty-co/terraform-aws-zesty-account/blob/main/versions.tf).

> [!NOTE]
> Important
> 
> - Do not manage the same AWS account with Terraform and the Zesty UI or CloudFormation at the same time.
> - If you onboard an account with this Terraform module, use the same Terraform state and module block for future onboarding changes.
> - If the account is currently managed through the Zesty UI, CloudFormation, or an older Zesty Terraform module, contact [Customer Support](https://zesty.co/contact-us/?support) before moving it to this module.
> - Changing the module source does not automatically transfer existing resources to a new Terraform state. Migration might require an approved import or state-move procedure.

### Configure authentication

Terraform requires two independent credentials:

1. AWS credentials for the AWS account that you are onboarding.
2. A Zesty API token for the zesty provider.

#### Configure the Zesty API token

For CI/CD, store `ZESTY_API_TOKEN` as a protected environment secret in your CI/CD or Terraform execution platform. Configure the runner to inject it into every `plan`, `apply`, and `destroy `operation.

Configure the provider as follows:

`provider "zesty" {}`

For a local run, set the token in your current shell:

`export ZESTY_API_TOKEN="<your-zesty-api-token>"`

Do not put the token directly in source control.

#### Use AWS Secrets Manager

With Terraform 1.10 or later, you can retrieve the Zesty API token from AWS Secrets Manager without writing the token to state or plan files:

```plaintext
ephemeral "aws_secretsmanager_secret_version" "zesty" {
  secret_id = "zesty/api-token"
}

provider "zesty" {
  token = ephemeral.aws_secretsmanager_secret_version.zesty.secret_string
}
```

The AWS identity running Terraform must have `secretsmanager:GetSecretValue` permission for the secret.

### Choose the AWS account type

Set `account_type` for every module block.

| AWS account | `account_type` | Notes |
| --- | --- | --- |
| AWS Organizations management or payer account | `management` | Owns consolidated billing. Supports Commitment Manager, Compute Optimization, and base read-only onboarding. |
| AWS Organizations linked or member account | `linked` | Commonly contains EKS clusters. Supports Compute Optimization and base read-only onboarding. |
| Standalone AWS account | `management` | Owns its billing data, so it uses the management-account path. Keep organization trust disabled. |

Do not use `standalone `as the value of `account_type`.

For a standalone account, use:

```plaintext
account_type              = "management"
enable_organization_trust = false
```

### Choose the products to enable

Product blocks are presence-based:

- Omit the block to leave the product disabled.
- Use `cm = {}` to enable Commitment Manager.
- Use `kompass = {}` to enable Compute Optimization account onboarding.
- Omit both product blocks for base read-only onboarding.

`cm.enabled` and `kompass.enabled` remain supported for backward compatibility. For new configurations, use block presence.

| Configuration | Management account | Linked account | CUR | Athena/Glue |
| --- | --- | --- | --- | --- |
| No product blocks | Supported | Supported | Created or referenced for management; not required for linked | No |
| `cm = {}` | Supported | Not supported | Required | No |
| `kompass = {}` | Supported | Supported | Required for management; not required for linked | Management only |
| `cm = {} and kompass = {}` | Supported | Not supported | Required | Yes |

**Note** Base read-only onboarding is not a Commitment Manager mode. It connects the account with baseline read permissions without enabling Commitment Manager automation or Compute Optimization.

### Configure the Terraform providers

Use Terraform 1.5 or later with the AWS 6.x provider and Zesty 0.3.x provider:

```plaintext
terraform {
  required_version = ">= 1.5"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }

    zesty = {
      source  = "zesty-co/zesty"
      version = "~> 0.3.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

provider "zesty" {}
```

After configuring the providers and one of the module configurations below, run:

```plaintext
terraform init
terraform plan
terraform apply
```