041 - Token-authenticated Terraform stack module

August 24, 2026

Terraform stack modules

This feature is behind a feature flag. Reach out to our team if you would like it enabled for your organization.

Terraform has proven to be a powerful way to manage an install stack, but we felt the experience could be improved upon. There were 3 key areas we wanted to improve on:

Obviate the need for your customer to manage a large, complex tfvars file.
Stop relying on the phone home ID to secure the phone home request.
Make it easier for your customer to apply updates.

To that end, we are publishing new stack modules to the Terraform registry. These modules read the stack config directly from the control plane, so your customer no longer needs to paste in a tfvars file. Each stack is given a service account that can authenticate using a token. The phone_home_id no longer needs to be updated on every reprovision. Additionally, your customer can more easily control versioning via semver.

provider "stack" {}

module "aws_stack" {
  source  = "nuonco/stack/aws"
  version = "~> 0.2"

  install_id = "<install-id>"

  inputs = {
    instance_type = "t3a.medium"
  }

  secrets = {
    license_key = { value = var.license_key }
  }
}

Once installed, your customers simply need to run terraform apply to install a new version of the stack. If new inputs or secrets are required, an actionable terraform error will be displayed. For example, if a new app version requires a_new_input, the customer will see this error until they set it.

╷
│ Error: Resource precondition failed
│
│   on .terraform/modules/aws_stack/phone_home.tf line 100, in resource "stack_phone_home" "this":
│  100:       condition     = length(local.missing_required_inputs) == 0
│     ├────────────────
│     │ local.missing_required_inputs is tuple with 1 element
│
│ the app requires a value for these inputs: a_new_input.
╵

To manage updates to the stack module itself, recommend setting a semver constraint on the minor version. That way your customer only needs to run terraform init -upgrade to receive patch updates. Minor and major versions can be received by updating the module version.

module "aws_stack" {
  source  = "nuonco/stack/aws"
  version = "~> 0.2"
  version = "~> 0.3"

  install_id = "<install-id>"

  inputs = {
    instance_type = "t3a.medium"
  }

  secrets = {
    license_key = { value = var.license_key }
  }
}

For more details, see the Provision Stack with a Terraform Module guide.

​Terraform stack modules

Terraform stack modules