Buckets with Terraform

chili speaks the native S3 API, so Terraform’s existing AWS provider manages the storage. You point the provider at the chili endpoint, and buckets, versioning and Object Lock become reproducible code.

Prerequisites

• Terraform 1.5 or newer
• chili access keys (access key and secret)
• the keys as environment variables, not in code

1. Configure the provider

The skip_* options disable the AWS-specific metadata checks, and s3_use_path_style ensures the right addressing:

provider "aws" {
  region                      = "ch-east"
  access_key                  = var.chili_access_key
  secret_key                  = var.chili_secret_key
  skip_credentials_validation = true
  skip_requesting_account_id  = true
  skip_metadata_api_check     = true
  s3_use_path_style           = true
 
  endpoints {
    s3 = "https://<ENDPOINT>"
  }
}
 
variable "chili_access_key" { sensitive = true }
variable "chili_secret_key" { sensitive = true }

Pass the keys via environment variables so they never land in the repository:

export TF_VAR_chili_access_key="AKIA..."
export TF_VAR_chili_secret_key="..."

2. Bucket as code

resource "aws_s3_bucket" "backup" {
  bucket              = "my-backup"
  object_lock_enabled = true
}

object_lock_enabled has to be set at creation; it cannot be enabled afterwards.

3. Versioning and Object Lock

Object Lock requires versioning to be enabled:

resource "aws_s3_bucket_versioning" "backup" {
  bucket = aws_s3_bucket.backup.id
  versioning_configuration {
    status = "Enabled"
  }
}
 
resource "aws_s3_bucket_object_lock_configuration" "backup" {
  bucket = aws_s3_bucket.backup.id
  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 30
    }
  }
}

In compliance mode no one can lift the lock before it expires, not even the account owner. That is the choice for regulatory retention.

4. State and good practice

• Keep the Terraform state remote, for example in a dedicated chili bucket, not local and not in the repo.
• Provide keys only via environment variables or a secret store.
• Run terraform plan before terraform apply.

The result: a versioned, immutable bucket in Switzerland, in Zurich or Geneva and geo-redundant on request, reproducible from code.