Terraform provider

The Archil Terraform provider enables you to manage Archil resources using Infrastructure as Code. It supports creating and managing disks, API tokens, and disk user authorizations.

Installation

Add the provider to your required_providers block:

terraform {
  required_providers {
    archil = {
      source = "archil-data/archil"
    }
  }
}

Then run terraform init to install the provider.

Provider configuration

provider "archil" {
  api_key = var.archil_api_key
  region  = "aws-us-east-1"
}

Arguments

Argument	Description	Required
`api_key`	API key for authentication. Can also be set via `ARCHIL_API_KEY` environment variable. Accepts the key with or without the `key-` prefix.	Yes
`region`	Archil region: `aws-us-east-1`, `aws-us-west-2`, `aws-eu-west-1`, `gcp-us-central1`, or `gcp-us-west1`. Can also be set via `ARCHIL_REGION`. Default: `aws-us-east-1`. See Region Availability for details.	No
`endpoint`	Override the API endpoint URL. Can also be set via `ARCHIL_ENDPOINT`.	No

Store your API key securely. Use a terraform.tfvars file (and add it to .gitignore) or an environment variable rather than hardcoding the key in your configuration.

Resources

archil_disk

Creates and manages an Archil disk. A storage mount is optional.

resource "archil_disk" "default" {
  name = "my-disk"
}

# Synchronize with your own S3 bucket
resource "archil_disk" "with_obj_store" {
  name = "my-disk"

  mount {
    type        = "s3"
    bucket_name = "my-s3-bucket"
  }
}

Arguments

Argument	Description	Required
`name`	Disk name (1-100 chars, alphanumeric, dashes, underscores).	Yes
`mount`	Storage mount configuration block.	No

Mount block arguments

Argument	Description	Required
`type`	Mount type: `s3`, `gcs`, `r2`, `s3-compatible`, or `azure-blob`.	Yes
`bucket_name`	Bucket name.	When `type = "s3"`, `"gcs"`, `"r2"`, or `"s3-compatible"`
`bucket_endpoint`	Storage endpoint URL (auto-populated for S3).	When `type = "r2"` or `"s3-compatible"`
`bucket_prefix`	Prefix within the bucket.	No
`bucket_region`	Bucket region (e.g., `us-east-1`). Auto-detected when omitted.	No
`access_key_id`	Access key ID (sensitive).	When `type = "gcs"`, `"r2"`, or `"s3-compatible"`
`secret_access_key`	Secret access key (sensitive).	When `type = "gcs"`, `"r2"`, or `"s3-compatible"`
`session_token`	Session token for temporary credentials (sensitive).	No
`session_id`	Session identifier for IAM role-based auth. Auto-generated when no access keys are provided; readable after apply as `mount[0].session_id` for use in bucket policies (see S3 bucket resource policy).	No
`container_name`	Azure blob container name.	When `type = "azure-blob"`
`endpoint`	Azure blob endpoint URL.	No
`storage_account_name`	Azure storage account name.	No
`tenant_id`	Azure AD tenant ID.	When `type = "azure-blob"`
`client_id`	Azure AD client ID.	When `type = "azure-blob"`
`client_secret`	Azure AD client secret (sensitive).	When `type = "azure-blob"`

All disk attributes require replacement — changing any attribute will destroy and recreate the disk.

Attributes

Attribute	Description
`id`	Disk ID (e.g., `dsk-0123456789abcdef`).
`status`	Disk status (e.g., `available`).
`organization`	Owning organization.
`provider_name`	Cloud provider (e.g., `aws`).
`region`	Disk region (e.g., `aws-us-east-1`).
`created_at`	Creation timestamp.
`data_size`	Total data size in bytes.
`token`	Auto-generated mount token (sensitive, only available at creation). Use it to mount the disk without creating a separate disk user.
`token_identifier`	Identifier of the auto-generated token user, for managing or removing it.

S3 bucket resource policy

When an s3 mount has no access keys, Archil is authorized through a bucket resource policy. A policy attached to your bucket grants access to Archil’s IAM role, and an archilSessionId condition scopes that grant to this one disk.

resource "archil_disk" "app" {
  name = "my-app-disk"

  mount {
    type        = "s3"
    bucket_name = aws_s3_bucket.data.id
  }
}

resource "aws_s3_bucket_policy" "archil_access" {
  bucket = aws_s3_bucket.data.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "AllowArchilAccess"
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::904233114299:role/archil-s3.prod.us-east-1" }
      Action    = ["s3:GetBucketLocation", "s3:ListBucket", "s3:GetObject",
                   "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"]
      Resource  = [aws_s3_bucket.data.arn, "${aws_s3_bucket.data.arn}/*"]
      Condition = {
        StringEquals = {
          "aws:PrincipalTag/archilSessionId" = archil_disk.app.mount[0].session_id
        }
      }
    }]
  })
}

The Principal ARN varies by Archil region, see S3 Object Storage for the full table and policy details. If your bucket’s policy is managed outside this configuration, either export the policy with an output and apply it separately or set session_id explicitly in the mount block.

archil_api_token

Creates and manages an Archil API token for programmatic access.

resource "archil_api_token" "ci" {
  name        = "ci-token"
  description = "Token for CI/CD pipelines"
}

Arguments

Argument	Description	Required
`name`	Token name (1-100 chars).	Yes
`description`	Token description (max 500 chars).	No

Attributes

Attribute	Description
`id`	Token ID (hash).
`token`	Full token value (sensitive, only available at creation).
`token_suffix`	Last 4 characters of the token.
`created_at`	Creation timestamp.

archil_disk_user

Adds an authorized user to an Archil disk. Supports token-based and AWS STS authentication. For token users the server generates a cryptographically secure mount token and returns it in the token attribute.

resource "archil_disk_user" "token_user" {
  disk_id  = archil_disk.default.id
  type     = "token"
  nickname = "ci-pipeline"
}

resource "archil_disk_user" "iam_user" {
  disk_id   = archil_disk.default.id
  type      = "awssts"
  principal = "arn:aws:iam::123456789012:role/MyRole"
}

Arguments

Argument	Description	Required
`disk_id`	ID of the disk to add the user to.	Yes
`type`	User type: `token` or `awssts`.	Yes
`principal`	IAM ARN.	When `type = "awssts"`
`nickname`	Nickname for the user.	When `type = "token"`
`ttl`	Time-to-live as a Go duration string (e.g., `"1h"`, `"30m"`, `"24h"`; max `"8760h"`). Mutually exclusive with `expires_at`.	No
`expires_at`	Absolute expiration as an RFC3339 timestamp (e.g., `"2027-01-01T00:00:00Z"`). Mutually exclusive with `ttl`.	No
`one_use`	When `true`, the credential works for a single mount authentication only.	No
`read_only`	When `true`, mounts authenticated with this credential reject writes with `EROFS`.	No

Attributes

Attribute	Description
`token`	Server-generated mount token (sensitive, only available at creation).
`token_suffix`	Last 4 characters of the token.
`identifier`	Stable identifier for this user, used for removal.
`expires_at`	Expiration time (computed from `ttl` when set).
`consumed_at`	When a one-use credential was consumed.
`status`	Current lifecycle status of the credential.
`created_at`	Creation timestamp.

Data sources

archil_disk

Look up an existing Archil disk by ID or name.

# By name
data "archil_disk" "by_name" {
  name = "my-disk"
}

# By ID
data "archil_disk" "by_id" {
  id = "dsk-0123456789abcdef"
}

Arguments

Exactly one of id or name must be set.

Argument	Description
`id`	Disk ID to look up.
`name`	Disk name to look up.

Attributes

Attribute	Description
`id`	Disk ID.
`name`	Disk name.
`status`	Disk status.
`organization`	Owning organization.
`provider_name`	Cloud provider.
`region`	Disk region.
`created_at`	Creation timestamp.
`data_size`	Total data size in bytes.

Full example

This example creates a disk with an S3 mount authorized by static credentials, a disk user, and an API token. As with the provider’s api_key, pass real credentials in through variables rather than hardcoding them:

terraform {
  required_providers {
    archil = {
      source = "archil-data/archil"
    }
  }
}

provider "archil" {
  api_key = var.archil_api_key
  region  = "aws-us-east-1"
}

variable "archil_api_key" {
  type      = string
  sensitive = true
}

resource "archil_disk" "app" {
  name = "my-app-disk"

  mount {
    type              = "s3"
    bucket_name       = "my-app-bucket"
    access_key_id     = "AKIAIOSFODNN7EXAMPLE"
    secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  }
}

resource "archil_disk_user" "app" {
  disk_id  = archil_disk.app.id
  type     = "token"
  nickname = "app-servers"
}

resource "archil_api_token" "ci" {
  name        = "ci-token"
  description = "Token for CI/CD pipelines"
}

data "archil_disk" "app" {
  name       = archil_disk.app.name
  depends_on = [archil_disk.app]
}

output "disk_id" {
  value = archil_disk.app.id
}

output "mount_token" {
  value     = archil_disk_user.app.token
  sensitive = true
}

Mount the disk with the generated token:

export ARCHIL_MOUNT_TOKEN=$(terraform output -raw mount_token)
sudo --preserve-env=ARCHIL_MOUNT_TOKEN archil mount my-app-disk /mnt/data --region aws-us-east-1

Import

Disks can be imported using their ID:

terraform import archil_disk.default dsk-0123456789abcdef

API tokens are imported with the token value:

terraform import archil_api_token.ci key-YOUR-TOKEN-VALUE

Getting started

Compute

Concepts

Data Sources

Details

Administration

Protocols

Reference

Legal

Terraform provider

Installation

Provider configuration

Arguments

Resources

archil_disk

Arguments

Mount block arguments

Attributes

S3 bucket resource policy

archil_api_token

Arguments

Attributes

archil_disk_user

Arguments

Attributes

Data sources

archil_disk

Arguments

Attributes

Full example

Import

​Installation

​Provider configuration

​Arguments

​Resources

​archil_disk

​Arguments

​Mount block arguments

​Attributes

​S3 bucket resource policy

​archil_api_token

​Arguments

​Attributes

​archil_disk_user

​Arguments

​Attributes

​Data sources

​archil_disk

​Arguments

​Attributes

​Full example

​Import

Installation

Provider configuration

Arguments

Resources

archil_disk

Arguments

Mount block arguments

Attributes

S3 bucket resource policy

archil_api_token

Arguments

Attributes

archil_disk_user

Arguments

Attributes

Data sources

archil_disk

Arguments

Attributes

Full example

Import