Terraform
Read Terraform and OpenTofu state via CLI and marshal into swamp data.
Shells out to terraform show -json (or tofu show -json) to read state
from any configured backend, then writes swamp resources keyed by Terraform
resource address for CEL consumption in workflows and reports. Attributes
and outputs that Terraform marks sensitive are masked as ***SENSITIVE***.
Supports workspace selection and binary switching between Terraform and OpenTofu via global arguments.
Quick Start
swamp extension pull @webframp/terraform
swamp model create @webframp/terraform tf-infra \
--global-arg workDir=/path/to/terraform/repo2026.10.21.1
Fixed: read_state wrote every resource attribute verbatim, so database
passwords, private keys and other attributes Terraform marks sensitive landed in
swamp data in plaintext. It now applies the state's sensitive_values and
replaces each sensitive attribute (or whole sensitive block) with
***SENSITIVE***, matching how get_outputs already treats sensitive outputs.
Changed: tf_resource data written by read_state no longer contains the
values of sensitive attributes. Workflows or reports that read those values from
swamp data now see ***SENSITIVE***. A wholly sensitive map, list or block (for
example tags built with merge() over a sensitive variable) becomes the string
***SENSITIVE***, not a map or list, so consumers that iterate it must check
its type. Non-sensitive attributes are unchanged.
Added: read_state logs a warning naming every resource whose state lacks
sensitive_values. Terraform before 0.15 does not record it, so those resources
are written unmasked.
Upgrade note: Pull @webframp/aws/terraform-drift 2026.10.21.1 alongside
this version; earlier drift reports misread masked attributes as drift. No
schema change. Existing tf_resource data written by earlier versions still
holds plaintext sensitive attributes; re-run read_state to overwrite it, and
delete older data versions if they must not be retained.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| workDir | string | Path to the initialized Terraform/OpenTofu working directory |
| workspace? | string | Terraform workspace name |
| binary? | string | CLI binary to use: 'terraform' or 'tofu' |
Resources
2026.10.14.1
Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.
Upgrade note: Metadata only. No code, schema, or behavioral changes.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.3
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.1
Fixed: Added missing description field to upgrade entry for version
2026.08.24.2. The omission caused swamp extension pull to fail with a catalog
validation error ("upgrades.N.description: Invalid input: expected string,
received undefined").
2026.08.24.3
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.2
Added Troubleshooting section documenting no CLI timeout, empty-state handling, binary validation gap, workDir validation timing, sequential resource writes, and TF_WORKSPACE behavior.
2026.08.21.2
Changed: CLI failures from runTfCommand now say what was being run and
where. Previously, if terraform/tofu couldn't be spawned at all (not
installed, not on PATH), the raw OS error propagated alone with no
indication of the command or working directory involved. A non-zero exit now
reports the exit code alongside stderr, and unparseable JSON output from
show -json is now reported as a JSON-parse failure naming the command and
working directory, instead of a bare SyntaxError.
2026.08.21.1
Changed: Tightened workDir on the global-args schema to require a
non-empty string. It's a required filesystem path the CLI shells out
against — an empty value never resolved to a usable Terraform/OpenTofu
working directory, so this catches misconfiguration at model-create time.
2026.08.20.1
Upgrade note: Bumped zod from 4.3.6 to 4.4.3. No behavioral changes — dependency version alignment only.
2026.08.21.1
Changed: Tightened workDir on the global-args schema to require a
non-empty string. It's a required filesystem path the CLI shells out
against — an empty value never resolved to a usable Terraform/OpenTofu
working directory, so this catches misconfiguration at model-create time.
2026.08.20.1
Upgrade note: Bumped zod from 4.3.6 to 4.4.3. No behavioral changes — dependency version alignment only.
2026.08.20.1
Upgrade note: Bumped zod from 4.3.6 to 4.4.3. No behavioral changes — dependency version alignment only.
2026.07.18.1
Added: An upgrades array entry (no-op) to terraform.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.16.1
Changed: README and LICENSE reformatted (deno fmt) in PR #134; this is the first version bump to publish that formatting to the registry. No functional or behavioral change.
2026.07.16.1
Changed: README and LICENSE reformatted (deno fmt) in PR #134; this is the first version bump to publish that formatting to the registry. No functional or behavioral change.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned