$npx -y skills add rudderlabs/rudder-agent-skills --skill rudder-terraform-workflowManages RudderStack resources via the terraform-provider-rudderstack. Use when configuring the provider, authoring HCL for sources, destinations, connections, running init/plan/apply, importing existing resources, or organizing multi-workspace Terraform modules.
| 1 | # RudderStack Terraform Workflow |
| 2 | |
| 3 | The [`rudderlabs/rudderstack`](https://github.com/rudderlabs/terraform-provider-rudderstack) Terraform provider manages a RudderStack workspace as infrastructure-as-code: sources, destinations, and connections. |
| 4 | |
| 5 | ## When to use |
| 6 | |
| 7 | The user is authoring HCL for RudderStack, running `terraform plan/apply` against a workspace, migrating from UI-managed to Terraform-managed resources, importing existing resources, or organizing multi-env setups. |
| 8 | |
| 9 | ## Preflight |
| 10 | |
| 11 | - [ ] Terraform ≥ 1.0 installed |
| 12 | - [ ] Access token available as env var `RUDDERSTACK_ACCESS_TOKEN` (preferred) or in the provider block |
| 13 | - [ ] Optional: override API base URL with `RUDDERSTACK_API_URL` (default: `https://api.rudderstack.com`) |
| 14 | - [ ] Confirm with the user whether the target workspace is dev/staging/prod before any `terraform apply` |
| 15 | |
| 16 | ## Provider setup |
| 17 | |
| 18 | ```hcl |
| 19 | terraform { |
| 20 | required_providers { |
| 21 | rudderstack = { |
| 22 | source = "rudderlabs/rudderstack" |
| 23 | version = "~> 4.4" |
| 24 | } |
| 25 | } |
| 26 | } |
| 27 | |
| 28 | provider "rudderstack" { |
| 29 | # access_token = "..." # or set RUDDERSTACK_ACCESS_TOKEN env var |
| 30 | # api_url = "https://api.rudderstack.com" |
| 31 | } |
| 32 | ``` |
| 33 | |
| 34 | ## Resource catalog |
| 35 | |
| 36 | | Category | Count | Examples | |
| 37 | |----------|-------|----------| |
| 38 | | **Connection** | 1 | `rudderstack_connection` — links source to destination | |
| 39 | | **Sources** | ~50 | SDK sources (JS, Android, iOS, Python, Go, etc.), webhooks, SaaS integrations | |
| 40 | | **Destinations** | ~46 | Warehouses, analytics, marketing, ad platforms, infrastructure | |
| 41 | |
| 42 | ### Source types |
| 43 | |
| 44 | - **SDK sources** (no config): JavaScript, Android, iOS, Python, Node.js, Go, Ruby, PHP, .NET, Flutter, Rust, Kotlin, Swift, Unity |
| 45 | - **Webhook sources** (no config): HTTP, Shopify Webhook |
| 46 | - **SaaS integrations**: Auth0, Braze, Slack, Segment, PagerDuty, Looker, Customer.io, Iterable, etc. |
| 47 | |
| 48 | ### Destination types |
| 49 | |
| 50 | - **Warehouses**: BigQuery, Redshift, Snowflake, PostgreSQL, S3, GCS |
| 51 | - **Analytics**: Google Analytics 4, Amplitude, Mixpanel, Posthog, Adobe Analytics |
| 52 | - **Marketing**: Braze, Marketo, Intercom, Customer.io, HubSpot, Salesforce |
| 53 | - **Ad platforms**: Google Ads, Facebook Pixel, TikTok Ads, LinkedIn Ads |
| 54 | - **Infrastructure**: Kafka, Kinesis, Redis, Webhook/HTTP |
| 55 | |
| 56 | No data sources are currently exposed — the provider is resource-centric. |
| 57 | |
| 58 | ## Minimal working example |
| 59 | |
| 60 | ```hcl |
| 61 | terraform { |
| 62 | required_providers { |
| 63 | rudderstack = { |
| 64 | source = "rudderlabs/rudderstack" |
| 65 | version = "~> 4.4" |
| 66 | } |
| 67 | } |
| 68 | } |
| 69 | |
| 70 | provider "rudderstack" {} # uses RUDDERSTACK_ACCESS_TOKEN from env |
| 71 | |
| 72 | resource "rudderstack_source_javascript" "web" { |
| 73 | name = "my-web-app" |
| 74 | } |
| 75 | |
| 76 | resource "rudderstack_destination_webhook" "logs" { |
| 77 | name = "event-logger" |
| 78 | |
| 79 | config { |
| 80 | webhook_url = "https://logs.example.com/events" |
| 81 | webhook_method = "POST" |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | resource "rudderstack_connection" "main" { |
| 86 | source_id = rudderstack_source_javascript.web.id |
| 87 | destination_id = rudderstack_destination_webhook.logs.id |
| 88 | } |
| 89 | ``` |
| 90 | |
| 91 | ## Standard cycle |
| 92 | |
| 93 | ```bash |
| 94 | terraform init # fetches the provider |
| 95 | terraform fmt # canonicalize HCL |
| 96 | terraform validate # schema check |
| 97 | terraform plan # preview; review diff with the user |
| 98 | terraform apply # apply to the workspace |
| 99 | ``` |
| 100 | |
| 101 | ## Importing existing resources |
| 102 | |
| 103 | The provider includes bootstrap scripts to generate Terraform code from existing RudderStack resources: |
| 104 | |
| 105 | ```bash |
| 106 | # Generate Terraform configuration |
| 107 | RUDDERSTACK_ACCESS_TOKEN=token ./scripts/bootstrap-terraform.sh > rudderstack.tf |
| 108 | |
| 109 | # Generate import commands |
| 110 | RUDDERSTACK_ACCESS_TOKEN=token ./scripts/bootstrap-terraform-import.sh |
| 111 | |
| 112 | # Import resource state |
| 113 | terraform import rudderstack_source_javascript.web <source-id> |
| 114 | terraform import rudderstack_destination_redshift.warehouse <destination-id> |
| 115 | ``` |
| 116 | |
| 117 | **Note:** Sensitive credentials (API keys, secrets) are not exposed via the API and must be added manually after import. |
| 118 | |
| 119 | ## Warehouse destination features |
| 120 | |
| 121 | ### Sync scheduling |
| 122 | |
| 123 | Warehouse destinations (BigQuery, Redshift, Snowflake) support sync scheduling: |
| 124 | |
| 125 | ```hcl |
| 126 | resource "rudderstack_destination_bigquery" "warehouse" { |
| 127 | name = "my-bigquery" |
| 128 | |
| 129 | config { |
| 130 | project = "gcp-project-id" |
| 131 | bucket_name = "gcs-bucket" |
| 132 | credentials = base64encode(file("service-account.json")) |
| 133 | location = "us-east1" |
| 134 | prefix = "rudder_" |
| 135 | |
| 136 | sync { |
| 137 | frequency = "30" # minutes |
| 138 | start_at = "10:00" |
| 139 | exclude_window_start_time = "11:00" |
| 140 | exclude_window_end_time = "12:00" |
| 141 | } |
| 142 | } |
| 143 | } |
| 144 | ``` |
| 145 | |
| 146 | ### Connection mode |
| 147 | |
| 148 | Some destinations support `connection_mode` for web integrations: |
| 149 | |
| 150 | ```hcl |
| 151 | config { |
| 152 | # ... destination config .. |