terraform-state

The terraform-state provider enables you to read outputs from Terraform state files stored in S3 or Terraform Cloud. By importing those outputs into your environment, you can seamlessly consume Terraform-managed infrastructure as inputs to your Pulumi programs — referencing values such as VPC IDs, subnet IDs, and cluster endpoints directly, without copying them by hand or rewriting your Terraform in Pulumi. This bridges the two tools, so you can adopt Pulumi incrementally alongside an existing Terraform footprint.

Imported outputs are available under the outputs key (for example, ${terraform.outputs.vpc_id}) and can be mapped to either of the following:

• pulumiConfig — to consume them as stack configuration (that is, as inputs to your Pulumi program).
• environmentVariables — to expose them as environment variables for the Pulumi CLI, a downstream Terraform run, or any other tooling.

Example

S3 backend

values:
  terraform:
    fn::open::terraform-state:
      backend:
        s3:
          login:
            fn::open::aws-login:
              oidc:
                roleArn: arn:aws:iam::123456789012:role/esc-oidc
                sessionName: pulumi-environments-session
          bucket: my-terraform-state-bucket
          key: path/to/terraform.tfstate
          region: us-west-2
  pulumiConfig:
    # Consume the Terraform outputs as Pulumi stack configuration (inputs to your program)
    vpcId: ${terraform.outputs.vpc_id}
    subnetIds: ${terraform.outputs.subnet_ids}
  environmentVariables:
    # Expose the outputs as TF_VAR_* environment variables to feed a downstream Terraform run
    TF_VAR_vpc_id: ${terraform.outputs.vpc_id}

Terraform Cloud backend

values:
  terraform:
    fn::open::terraform-state:
      backend:
        remote:
          organization: my-terraform-org
          workspace: my-workspace
          token:
            fn::secret: tfc-token-value
  pulumiConfig:
    # Consume the Terraform outputs as Pulumi stack configuration (inputs to your program)
    vpcId: ${terraform.outputs.vpc_id}
    subnetIds: ${terraform.outputs.subnet_ids}
  environmentVariables:
    # Expose the outputs as TF_VAR_* environment variables to feed a downstream Terraform run
    TF_VAR_vpc_id: ${terraform.outputs.vpc_id}

Schema reference

Reference schemas last updated on 2026-07-18, synced automatically from the Pulumi Cloud ESC API.

Inputs

• backend required
  Configuration for the Terraform state backend (S3 or remote).
• Exactly one of — option 1
• ↳ s3 TerraformS3Backend required
  AWS S3 backend configuration.
• ↳ bucket string required
  The S3 bucket name containing the state file.
• ↳ key string required
  The S3 object key for the state file.
• ↳ login AWSLogin required
  The credentials to use to get the state file.
• ↳ accessKeyId string required
  The AWS access key ID.
• ↳ secretAccessKey string required
  The AWS secret access key.
• ↳ sessionToken string optional
  The AWS session token, if any.
• ↳ region string required
  The AWS region where the bucket is located.
• Exactly one of — option 2
• ↳ remote TerraformRemoteBackend required
  Terraform Cloud/Enterprise backend configuration.
• ↳ hostname string optional
  The hostname of Terraform Cloud/Enterprise.
• ↳ organization string required
  The Terraform Cloud organization name.
• ↳ token string required
  The Terraform Cloud API token.
• ↳ workspace string required
  The workspace name.

Outputs

• outputs map[string]any required
  A map of all outputs from the Terraform state.