Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Terraform
  4. API Docs
  5. state
  6. getS3Reference
Viewing docs for Terraform v6.1.0
published on Monday, Jul 20, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-terraform

terraform.state.getS3Reference

terraform logo
Viewing docs for Terraform v6.1.0
published on Monday, Jul 20, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-terraform

    Access state from an AWS S3 bucket.

    Using getS3Reference

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getS3Reference(args: GetS3ReferenceArgs, opts?: InvokeOptions): Promise<GetS3ReferenceResult>
function getS3ReferenceOutput(args: GetS3ReferenceOutputArgs, opts?: InvokeOptions): Output<GetS3ReferenceResult>
    def get_s3_reference(access_key: Optional[str] = None,
                     assume_role_duration_seconds: Optional[int] = None,
                     assume_role_policy: Optional[str] = None,
                     assume_role_policy_arns: Optional[Sequence[str]] = None,
                     assume_role_tags: Optional[Mapping[str, str]] = None,
                     assume_role_transitive_tag_keys: Optional[Sequence[str]] = None,
                     bucket: Optional[str] = None,
                     encrypt: Optional[bool] = None,
                     endpoint: Optional[str] = None,
                     external_id: Optional[str] = None,
                     force_path_style: Optional[bool] = None,
                     iam_endpoint: Optional[str] = None,
                     key: Optional[str] = None,
                     kms_key_id: Optional[str] = None,
                     max_retries: Optional[int] = None,
                     profile: Optional[str] = None,
                     region: Optional[str] = None,
                     role_arn: Optional[str] = None,
                     secret_key: Optional[str] = None,
                     session_name: Optional[str] = None,
                     shared_credentials_file: Optional[str] = None,
                     skip_credentials_validation: Optional[bool] = None,
                     skip_metadata_api_check: Optional[bool] = None,
                     skip_region_validation: Optional[bool] = None,
                     sse_customer_key: Optional[str] = None,
                     sts_endpoint: Optional[str] = None,
                     token: Optional[str] = None,
                     workspace: Optional[str] = None,
                     workspace_key_prefix: Optional[str] = None,
                     opts: Optional[InvokeOptions] = None) -> GetS3ReferenceResult
def get_s3_reference_output(access_key: pulumi.Input[Optional[str]] = None,
                     assume_role_duration_seconds: pulumi.Input[Optional[int]] = None,
                     assume_role_policy: pulumi.Input[Optional[str]] = None,
                     assume_role_policy_arns: pulumi.Input[Optional[Sequence[pulumi.Input[str]]]] = None,
                     assume_role_tags: pulumi.Input[Optional[Mapping[str, pulumi.Input[str]]]] = None,
                     assume_role_transitive_tag_keys: pulumi.Input[Optional[Sequence[pulumi.Input[str]]]] = None,
                     bucket: pulumi.Input[Optional[str]] = None,
                     encrypt: pulumi.Input[Optional[bool]] = None,
                     endpoint: pulumi.Input[Optional[str]] = None,
                     external_id: pulumi.Input[Optional[str]] = None,
                     force_path_style: pulumi.Input[Optional[bool]] = None,
                     iam_endpoint: pulumi.Input[Optional[str]] = None,
                     key: pulumi.Input[Optional[str]] = None,
                     kms_key_id: pulumi.Input[Optional[str]] = None,
                     max_retries: pulumi.Input[Optional[int]] = None,
                     profile: pulumi.Input[Optional[str]] = None,
                     region: pulumi.Input[Optional[str]] = None,
                     role_arn: pulumi.Input[Optional[str]] = None,
                     secret_key: pulumi.Input[Optional[str]] = None,
                     session_name: pulumi.Input[Optional[str]] = None,
                     shared_credentials_file: pulumi.Input[Optional[str]] = None,
                     skip_credentials_validation: pulumi.Input[Optional[bool]] = None,
                     skip_metadata_api_check: pulumi.Input[Optional[bool]] = None,
                     skip_region_validation: pulumi.Input[Optional[bool]] = None,
                     sse_customer_key: pulumi.Input[Optional[str]] = None,
                     sts_endpoint: pulumi.Input[Optional[str]] = None,
                     token: pulumi.Input[Optional[str]] = None,
                     workspace: pulumi.Input[Optional[str]] = None,
                     workspace_key_prefix: pulumi.Input[Optional[str]] = None,
                     opts: Optional[InvokeOptions] = None) -> Output[GetS3ReferenceResult]
    func GetS3Reference(ctx *Context, args *GetS3ReferenceArgs, opts ...InvokeOption) (*GetS3ReferenceResult, error)
func GetS3ReferenceOutput(ctx *Context, args *GetS3ReferenceOutputArgs, opts ...InvokeOption) GetS3ReferenceResultOutput

    > Note: This function is named GetS3Reference in the Go SDK.

    public static class GetS3Reference 
{
    public static Task<GetS3ReferenceResult> InvokeAsync(GetS3ReferenceArgs args, InvokeOptions? opts = null)
    public static Output<GetS3ReferenceResult> Invoke(GetS3ReferenceInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetS3ReferenceResult> getS3Reference(GetS3ReferenceArgs args, InvokeOptions options)
public static Output<GetS3ReferenceResult> getS3Reference(GetS3ReferenceArgs args, InvokeOptions options)

    fn::invoke:
  function: terraform:state:getS3Reference
  arguments:
    # arguments dictionary
    data "terraform_state_get_s3_reference" "name" {
    # arguments
}

    The following arguments are supported:

    Bucket string
    The name of the S3 bucket.
    Key string
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    AccessKey string
    AWS access key.
    AssumeRoleDurationSeconds int
    The duration, in seconds, of the assume role session.
    AssumeRolePolicy string
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    AssumeRolePolicyArns List<string>
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    AssumeRoleTags Dictionary<string, string>
    Assume role session tags.
    AssumeRoleTransitiveTagKeys List<string>
    Assume role session tag keys to pass to any subsequent sessions.
    Encrypt bool
    Whether to enable server side encryption of the state file.
    Endpoint string
    A custom endpoint for the S3 API.
    ExternalId string
    The external ID to use when assuming the role.
    ForcePathStyle bool
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    IamEndpoint string
    A custom endpoint for the IAM API.
    KmsKeyId string
    The ARN of a KMS Key to use for encrypting the state.
    MaxRetries int
    The maximum number of times an AWS API request is retried on retryable failure.
    Profile string
    AWS profile name as set in the shared credentials file.
    Region string
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    RoleArn string
    The ARN of an IAM Role to be assumed in order to read the state.
    SecretKey string
    AWS secret key.
    SessionName string
    The session name to use when assuming the role.
    SharedCredentialsFile string
    Path to a shared credentials file.
    SkipCredentialsValidation bool
    Skip the credentials validation via the STS API.
    SkipMetadataApiCheck bool
    Skip the AWS Metadata API check.
    SkipRegionValidation bool
    Skip static validation of region name.
    SseCustomerKey string
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    StsEndpoint string
    A custom endpoint for the STS API.
    Token string
    AWS session token.
    Workspace string
    The Terraform workspace to read state from.
    WorkspaceKeyPrefix string
    The prefix applied to the non-default state path inside the bucket.
    Bucket string
    The name of the S3 bucket.
    Key string
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    AccessKey string
    AWS access key.
    AssumeRoleDurationSeconds int
    The duration, in seconds, of the assume role session.
    AssumeRolePolicy string
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    AssumeRolePolicyArns []string
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    AssumeRoleTags map[string]string
    Assume role session tags.
    AssumeRoleTransitiveTagKeys []string
    Assume role session tag keys to pass to any subsequent sessions.
    Encrypt bool
    Whether to enable server side encryption of the state file.
    Endpoint string
    A custom endpoint for the S3 API.
    ExternalId string
    The external ID to use when assuming the role.
    ForcePathStyle bool
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    IamEndpoint string
    A custom endpoint for the IAM API.
    KmsKeyId string
    The ARN of a KMS Key to use for encrypting the state.
    MaxRetries int
    The maximum number of times an AWS API request is retried on retryable failure.
    Profile string
    AWS profile name as set in the shared credentials file.
    Region string
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    RoleArn string
    The ARN of an IAM Role to be assumed in order to read the state.
    SecretKey string
    AWS secret key.
    SessionName string
    The session name to use when assuming the role.
    SharedCredentialsFile string
    Path to a shared credentials file.
    SkipCredentialsValidation bool
    Skip the credentials validation via the STS API.
    SkipMetadataApiCheck bool
    Skip the AWS Metadata API check.
    SkipRegionValidation bool
    Skip static validation of region name.
    SseCustomerKey string
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    StsEndpoint string
    A custom endpoint for the STS API.
    Token string
    AWS session token.
    Workspace string
    The Terraform workspace to read state from.
    WorkspaceKeyPrefix string
    The prefix applied to the non-default state path inside the bucket.
    bucket string
    The name of the S3 bucket.
    key string
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    access_key string
    AWS access key.
    assume_role_duration_seconds number
    The duration, in seconds, of the assume role session.
    assume_role_policy string
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    assume_role_policy_arns list(string)
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    assume_role_tags map(string)
    Assume role session tags.
    assume_role_transitive_tag_keys list(string)
    Assume role session tag keys to pass to any subsequent sessions.
    encrypt bool
    Whether to enable server side encryption of the state file.
    endpoint string
    A custom endpoint for the S3 API.
    external_id string
    The external ID to use when assuming the role.
    force_path_style bool
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    iam_endpoint string
    A custom endpoint for the IAM API.
    kms_key_id string
    The ARN of a KMS Key to use for encrypting the state.
    max_retries number
    The maximum number of times an AWS API request is retried on retryable failure.
    profile string
    AWS profile name as set in the shared credentials file.
    region string
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    role_arn string
    The ARN of an IAM Role to be assumed in order to read the state.
    secret_key string
    AWS secret key.
    session_name string
    The session name to use when assuming the role.
    shared_credentials_file string
    Path to a shared credentials file.
    skip_credentials_validation bool
    Skip the credentials validation via the STS API.
    skip_metadata_api_check bool
    Skip the AWS Metadata API check.
    skip_region_validation bool
    Skip static validation of region name.
    sse_customer_key string
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    sts_endpoint string
    A custom endpoint for the STS API.
    token string
    AWS session token.
    workspace string
    The Terraform workspace to read state from.
    workspace_key_prefix string
    The prefix applied to the non-default state path inside the bucket.
    bucket String
    The name of the S3 bucket.
    key String
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    accessKey String
    AWS access key.
    assumeRoleDurationSeconds Integer
    The duration, in seconds, of the assume role session.
    assumeRolePolicy String
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    assumeRolePolicyArns List<String>
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    assumeRoleTags Map<String,String>
    Assume role session tags.
    assumeRoleTransitiveTagKeys List<String>
    Assume role session tag keys to pass to any subsequent sessions.
    encrypt Boolean
    Whether to enable server side encryption of the state file.
    endpoint String
    A custom endpoint for the S3 API.
    externalId String
    The external ID to use when assuming the role.
    forcePathStyle Boolean
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    iamEndpoint String
    A custom endpoint for the IAM API.
    kmsKeyId String
    The ARN of a KMS Key to use for encrypting the state.
    maxRetries Integer
    The maximum number of times an AWS API request is retried on retryable failure.
    profile String
    AWS profile name as set in the shared credentials file.
    region String
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    roleArn String
    The ARN of an IAM Role to be assumed in order to read the state.
    secretKey String
    AWS secret key.
    sessionName String
    The session name to use when assuming the role.
    sharedCredentialsFile String
    Path to a shared credentials file.
    skipCredentialsValidation Boolean
    Skip the credentials validation via the STS API.
    skipMetadataApiCheck Boolean
    Skip the AWS Metadata API check.
    skipRegionValidation Boolean
    Skip static validation of region name.
    sseCustomerKey String
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    stsEndpoint String
    A custom endpoint for the STS API.
    token String
    AWS session token.
    workspace String
    The Terraform workspace to read state from.
    workspaceKeyPrefix String
    The prefix applied to the non-default state path inside the bucket.
    bucket string
    The name of the S3 bucket.
    key string
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    accessKey string
    AWS access key.
    assumeRoleDurationSeconds number
    The duration, in seconds, of the assume role session.
    assumeRolePolicy string
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    assumeRolePolicyArns string[]
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    assumeRoleTags {[key: string]: string}
    Assume role session tags.
    assumeRoleTransitiveTagKeys string[]
    Assume role session tag keys to pass to any subsequent sessions.
    encrypt boolean
    Whether to enable server side encryption of the state file.
    endpoint string
    A custom endpoint for the S3 API.
    externalId string
    The external ID to use when assuming the role.
    forcePathStyle boolean
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    iamEndpoint string
    A custom endpoint for the IAM API.
    kmsKeyId string
    The ARN of a KMS Key to use for encrypting the state.
    maxRetries number
    The maximum number of times an AWS API request is retried on retryable failure.
    profile string
    AWS profile name as set in the shared credentials file.
    region string
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    roleArn string
    The ARN of an IAM Role to be assumed in order to read the state.
    secretKey string
    AWS secret key.
    sessionName string
    The session name to use when assuming the role.
    sharedCredentialsFile string
    Path to a shared credentials file.
    skipCredentialsValidation boolean
    Skip the credentials validation via the STS API.
    skipMetadataApiCheck boolean
    Skip the AWS Metadata API check.
    skipRegionValidation boolean
    Skip static validation of region name.
    sseCustomerKey string
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    stsEndpoint string
    A custom endpoint for the STS API.
    token string
    AWS session token.
    workspace string
    The Terraform workspace to read state from.
    workspaceKeyPrefix string
    The prefix applied to the non-default state path inside the bucket.
    bucket str
    The name of the S3 bucket.
    key str
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    access_key str
    AWS access key.
    assume_role_duration_seconds int
    The duration, in seconds, of the assume role session.
    assume_role_policy str
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    assume_role_policy_arns Sequence[str]
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    assume_role_tags Mapping[str, str]
    Assume role session tags.
    assume_role_transitive_tag_keys Sequence[str]
    Assume role session tag keys to pass to any subsequent sessions.
    encrypt bool
    Whether to enable server side encryption of the state file.
    endpoint str
    A custom endpoint for the S3 API.
    external_id str
    The external ID to use when assuming the role.
    force_path_style bool
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    iam_endpoint str
    A custom endpoint for the IAM API.
    kms_key_id str
    The ARN of a KMS Key to use for encrypting the state.
    max_retries int
    The maximum number of times an AWS API request is retried on retryable failure.
    profile str
    AWS profile name as set in the shared credentials file.
    region str
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    role_arn str
    The ARN of an IAM Role to be assumed in order to read the state.
    secret_key str
    AWS secret key.
    session_name str
    The session name to use when assuming the role.
    shared_credentials_file str
    Path to a shared credentials file.
    skip_credentials_validation bool
    Skip the credentials validation via the STS API.
    skip_metadata_api_check bool
    Skip the AWS Metadata API check.
    skip_region_validation bool
    Skip static validation of region name.
    sse_customer_key str
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    sts_endpoint str
    A custom endpoint for the STS API.
    token str
    AWS session token.
    workspace str
    The Terraform workspace to read state from.
    workspace_key_prefix str
    The prefix applied to the non-default state path inside the bucket.
    bucket String
    The name of the S3 bucket.
    key String
    The path to the state file inside the bucket. When using a non-default workspace, the state path is /workspace_key_prefix/workspace_name/key.
    accessKey String
    AWS access key.
    assumeRoleDurationSeconds Number
    The duration, in seconds, of the assume role session.
    assumeRolePolicy String
    IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
    assumeRolePolicyArns List<String>
    Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
    assumeRoleTags Map<String>
    Assume role session tags.
    assumeRoleTransitiveTagKeys List<String>
    Assume role session tag keys to pass to any subsequent sessions.
    encrypt Boolean
    Whether to enable server side encryption of the state file.
    endpoint String
    A custom endpoint for the S3 API.
    externalId String
    The external ID to use when assuming the role.
    forcePathStyle Boolean
    Force s3 to use path-style addressing instead of virtual hosted-bucket addressing. Required by most S3-compatible stores.
    iamEndpoint String
    A custom endpoint for the IAM API.
    kmsKeyId String
    The ARN of a KMS Key to use for encrypting the state.
    maxRetries Number
    The maximum number of times an AWS API request is retried on retryable failure.
    profile String
    AWS profile name as set in the shared credentials file.
    region String
    AWS region of the S3 bucket. Falls back to the AWS_REGION or AWS_DEFAULT_REGION environment variables when unset.
    roleArn String
    The ARN of an IAM Role to be assumed in order to read the state.
    secretKey String
    AWS secret key.
    sessionName String
    The session name to use when assuming the role.
    sharedCredentialsFile String
    Path to a shared credentials file.
    skipCredentialsValidation Boolean
    Skip the credentials validation via the STS API.
    skipMetadataApiCheck Boolean
    Skip the AWS Metadata API check.
    skipRegionValidation Boolean
    Skip static validation of region name.
    sseCustomerKey String
    The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).
    stsEndpoint String
    A custom endpoint for the STS API.
    token String
    AWS session token.
    workspace String
    The Terraform workspace to read state from.
    workspaceKeyPrefix String
    The prefix applied to the non-default state path inside the bucket.

    getS3Reference Result

    The following output properties are available:

    Outputs Dictionary<string, object>
    The outputs displayed from Terraform state.
    Outputs map[string]interface{}
    The outputs displayed from Terraform state.
    outputs map(any)
    The outputs displayed from Terraform state.
    outputs Map<String,Object>
    The outputs displayed from Terraform state.
    outputs {[key: string]: any}
    The outputs displayed from Terraform state.
    outputs Mapping[str, Any]
    The outputs displayed from Terraform state.
    outputs Map<Any>
    The outputs displayed from Terraform state.

    Package Details

    Repository
    terraform pulumi/pulumi-terraform
    License
    Apache-2.0
    terraform logo
    Viewing docs for Terraform v6.1.0
    published on Monday, Jul 20, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-terraform

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial