DocsManagement API

Terraform

Manage INFRO projects, gateway keys, routes and budgets from Terraform: provider setup, a per-tenant example, drift, conflicts and import.

INFRO is in private early access. Running these examples requires an early-access account, an active trial or subscription entitlement, and your own provider connection. Self-serve purchasing is not generally open. See Early access.

Built, not yet available. The management API is built and not deployed: /manage/v1 does not answer requests yet, and nothing on this page can be used today. These pages describe the contract it ships with.

The Terraform provider is not published to the Terraform Registry yet. Its source is kept in the INFRO repository under sdks/terraform. Until it is published, the resource and attribute names on this page describe the provider as it is being built and may change before its first release.

The INFRO Terraform provider is built on the management API. Each INFRO resource type is a Terraform resource, the organization, provider kinds and models are data sources, and every rule of the API applies: the token's scopes, the organization's plan, and the version check on every change.

Provider configuration

main.tf

terraform {
  required_providers {
    infro = {
      source = "infroio/infro"
    }
  }
}

# Reads INFRO_MANAGEMENT_TOKEN and, optionally, INFRO_MANAGE_ENDPOINT.
provider "infro" {}

Environment variable	Purpose
`INFRO_MANAGEMENT_TOKEN`	A management token. Keep it in your CI secret store, not in a `.tf` file.
`INFRO_MANAGE_ENDPOINT`	Optional. Defaults to `https://api.infro.io/manage/v1`.

terraform plan needs read access to everything the configuration manages; *:read covers it. terraform apply needs the write scope for each family it changes.

Example: one project, key and budget per tenant

A common setup gives each of your customers (tenants) its own project and gateway key, with a monthly spend limit on the key and a budget for the teammate who owns that tenant.

tenants.tf

variable "tenants" {
  type = map(object({
    monthly_limit = number
    owner_member  = string # member id of the teammate who owns the tenant
  }))
}

resource "infro_project" "tenant" {
  for_each = var.tenants
  name     = "tenant-${each.key}"
}

resource "infro_gateway_key" "tenant" {
  for_each    = var.tenants
  label       = "${each.key} production"
  project_id  = infro_project.tenant[each.key].id
  environment = "production"

  credit_limit = {
    amount = each.value.monthly_limit
    period = "monthly"
  }
}

resource "infro_member_budget" "tenant_owner" {
  for_each  = var.tenants
  member_id = each.value.owner_member

  spend_limit = {
    monthly  = each.value.monthly_limit * 2
    behavior = "alert"
  }
}

output "tenant_keys" {
  value     = { for k, key in infro_gateway_key.tenant : k => key.secret }
  sensitive = true
}

A gateway key's secret is in the Terraform state. The API returns it only once, when the key is created, so Terraform keeps it in state to give it to you. Store state encrypted and restrict who can read it, as you would for any state holding credentials.

Drift and conflicts

Terraform sends the version it last read with every change. If someone changed the resource in the console since then, the API refuses the change with 409 version_conflict instead of overwriting their edit, and the apply stops for that resource. Run terraform plan again: it reads the current state, shows you what changed, and the next apply works from it.

Resources Terraform writes are marked managed_by: terraform, so people editing them in the console can see that an apply may change them back.

Import

Every resource can be imported by its management API id. Guardrail policies use their attachment id, and cost center rules their lineage id.

Import existing resources

terraform import infro_route.chat rt_01J9Z6
terraform import infro_guardrail_policy.support project:prj_01J9Z4

What the provider does not manage

Anything the management API does not cover: SSO and SCIM configuration, the admin credentials used for cost reconciliation, OpenTelemetry export, and members and invitations. Your identity provider and the console remain the place for those. The management API's own tokens are also not a Terraform resource, because a token cannot create a token.