Terraform in internet restricted networks on AWS

In a usual setting, Terraform pulls the provider binaries from the internet. But if you are in a restricted network without access to these binaries, Terraform would not work. I was faced with a similar situation at work but on GCP. But GCP handles internal API endpoint connectivity differently compared to AWS. So I decided to try the same on AWS. We’ll try to create a S3 bucket with Terraform with no internet access.
Terraform file we start with:

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
}
}
}
provider "aws" {
region = "us-east-1"
}
resource "aws_s3_bucket" "def_s3_bucket" {
bucket = "def=s3=bucket-f4w90u"
acl = "private"
tags = {
Name = "My bucket"
Environment = "Dev"
}
}

terraform init fails since it cannot connect to the remote server on the internet.

Download the AWS provider from here and copy it to the VM. Then place the file like below. Terraform looks in a few places for the plugins and this is one of the paths.

init now works but plan/apply will still fail as the required AWS APIs for STS and the resources (S3 in this case) we are trying to create are not reachable. STS is required as we are using IAM instance profile and the provider makes a get-caller-identity call. To overcome this create VPC endpoints for STS and S3 and update the provider config with the custom endpoint.

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
}
}
}
provider "aws" {
region = "us-east-1"
skip_get_ec2_platforms = true
skip_requesting_account_id = true
endpoints {
sts = "https://sts.us-east-1.amazonaws.com"
}
}
resource "aws_s3_bucket" "def_s3_bucket" {
bucket = "def=s3=bucket-f4w90u"
acl = "private"
tags = {
Name = "My bucket"
Environment = "Dev"
}
}

Also the AWS provider connects to their Checkpoint service for security which we’ll need to disable by exporting the environment variable export CHECKPOINT_DISABLE=1 . More on checkpoint service.

Plan and apply should work now

--

--

--

I work with cloud, containers, linux

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Iterable Batch Apex

A Guide on end-to-end Custom Software Development in 2021

Friday Night Tho

Typo3 antipatterns

AWK — The Unix/Linux Powerful tool.

Language Differences

Social Impact Software for elections, wages, and jobs

Power BI: Visualizing filter || evaluation context

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Adithya

Adithya

I work with cloud, containers, linux

More from Medium

How to Configure Terraform on Windows?

What is Terraform?

How To Pass The Terraform Associate Exam

Automate Alibaba Cloud infra building with Terraform (step 1)