8.2 Remote State File

00:01

really covered the state file and what it does and represents.

00:04

But we've always talked about it residing locally on the system that you're using to manage these terror form deployments. So I want you to open up directory 05 and, um, we're gonna get into creating a storage container that can be used. Tau host

00:23

this state file,

00:24

but in a remote storage to common location that the other folks on my team can also access, it's going to be a very common in good practice, right? If you can imagine, you have multiple environments that you're defining this infrastructure for. So you're using the infrastructure to finding a development environment

00:43

que environment stage, environment,

00:45

production environment. So one practices these common and shared state files, which your team's going to be accessing, creating a separate state file for each one of those environments.

00:59

The value of behind that is

01:02

you can set up permissions around accessing those state files different, and by that nature, you really enforcing who can actually make modifications to the production environment,

01:14

the development and so on and so forth. So so that's a very good practice when you're managing remote state files is separating access, control and permissions by the environment they represent, based on the policies you have within your team and organization of the remote state files. Also

01:30

going to be helpful when more than one of us is defining this terra form state. And we're collaborating

01:37

on that because it also brings to the table the concept of locking. So no two of us are port for forming a terra form deployment process at the same time to based on the same state file, because that could create a lot of corruptions. Right? So it's a very simplistic locking mechanism.

01:56

So go ahead again and open up 0.5 s o. We want to set up an area in Azar that can host this state file this capability that we're doing it in as er here you can use an S three bucket and Amazon. You can use comparable blob storage in Google Cloud.

02:15

So there's quite a few different

02:17

supported back ends to have this this information on a common area that that your entire team, this is sharing,

02:28

you can see here are terra form file is is defining a very simplistic storage account. It's also defining a storage container within that, that this is going to be the actual blob where the state files are going to be defined. So let's jump

02:46

over to that directory.

02:50

Um, keep in mind, we're going into the bootstrap subdirectory. Go ahead and run your terra form apply process. Actually ran it shortly before this. Just testing some things out and make sure you

03:08

are able to get the terra form storage accounts created. And so in my situation, you can see it's refreshing the state, right, Cause in this circumstance, I have the state file, which is defining the storage is, is local to my machines that we did talk about why, and the circumstances in which Terra formed by default is gonna synchronize the local state file.

03:29

Once you've completed your deployment, there are few outputs thicket printed out to the bottom.

03:35

Um, and I defined in the outputs of the Terra form. These are gonna be very important to set us up for the next step, where we're gonna deploy the Terra form files located directly beneath the 05 directory. And we're gonna

03:53

do this

03:54

using a remote storage back end. So

04:00

copy these copy paste them off to the side or just leave them there visible, inaccessible in your terminal because we're going to need these in short order. So

04:12

in the root directory of this, this repositories, you'll notice there's a resource is and then I have a few environment scripts that I've set

04:20

or haven't said, but I've commented it out. What I want you to do is update the value of the arm access key. This is a specific environment variable when you're working with azar that it wants to see. Because this is a special key that allows us the user we have to access this storage. Ah, location,

04:40

the actual environment, variable names. When you're

04:43

using s three bucket as your remote storage back in for your state file, they're going to be a little bit different. But you can look those all up. In fact, just hopping over to the terra form site. Here, you can see the remote state directory, and what we want to do here

05:00

is find out. What are all the different providers

05:04

that it has. Here we go. So these air called back ends, right? And so what we're going to be using it is the user r m back ends of sea. So back ends, Okay,

05:18

Working as a team. Remote operations. That's so great. Here we go back in types. So we're going to use this is there are m You could use our factory that there's a whole listing there that you can definitely check out and then the enhanced back ends. That's if you are working with, like, the terra form cloud product.

05:39

Um, in the remote circumstance, if you want to use the remote one with care from cloud product. So

05:44

there's some additional functionality that those also give you. But in this circumstance, we're going to use the user R m back, back end. And we've already gone ahead, and we've set that up ourselves

05:55

by creating the blob storage account using terra form.

06:00

And so let's we're also going to set this environment variable here, So I'm going thio, just make a quick we're gonna back up here, Then I'm gonna make a quick call to that particular shell script to ensure that this environment variable gets

06:17

set in my circumstance. So resource is

06:21

setting and be. And if you're if you're using windows, I have Ah, power shell script also here. And so the same processes and then apply. You're just gonna cut and paste the access key into this environment. Variable. So I've gone ahead and executed that,

06:38

um a little little side note. I added a variety of other environment variables in here, which these will be helpful in other circumstances. Not necessarily for this. This activity one is TF log.

06:53

If you're ever caught in the need of debugging, what the heck is terra form thinking

06:58

If you enable this variable this environment variable to trace d bugger info terra form when it's running, it's gonna spit out a lot more information to you, so that could be very helpful.

07:11

The this is a environment variable specific to using a tzar, and it's saying this is the subscription idea and you would make the value the idea of the subscription similar with the tenant i d. The client ideas and client secrets. These air all environment variables,

07:28

when you're not lugging in, is an individual in running terra form.

07:31

But you you want to say to have a continuous integration job running that's deploying to terra form. If that job thief and these environment variables air set while that jobs executing the azar r M processed the provider within terra form,

07:46

it's gonna look at those environment variables. And it's gonna use those credentials when communicating with azar

07:51

to determine what are the rolls and who is the user that is performing the different deployment actions asked, as opposed to what we did was we did ese log in And then we went through the log in process Ah, little gooey, prompt upright And we went through that. They're so that's also why I have those. So when you get to that world,

08:09

you can use these as resource is to kind of jump start and get

08:15

other things going,

08:16

but heading back to the remote back end concept. So I have a very simple terra form file here, right? Just creating the resource group pretty much was the simplest thing that we made in the very first section of this model.

08:31

But right now, what we want to do is we want to set up the is er r m back in. So here you can see there are some great examples in the online documentation and, um,

08:43

what we're going to do is go ahead and we're gonna set up this and I've got a few little basics here. You could define the access key itself right here without doing the environment variable. You could define it in the actual terra form file that access keys, things of that nature.

09:01

Pretty

09:03

not. Not not the best idea to be honest, to be putting those in your terra form because it's assumed your terra form file is going to be something that you are capturing in some sort of version control system. So if you're storing the access keys

09:22

in material that in your version control system anybody who has access to the version control system can do the access keys.

09:28

So even in this circumstance, yes, we updated this shell script, but you wouldn't want to check it in with this access key unless you really understood. And we're confident that