OVH Terraform Provider

The ovh_domain_zone_record resource allows you to manage individual DNS records within an OVHcloud domain zone.

Important Warnings:

• Avoid mixing Web Console and Terraform: Using the Change in text format feature in the OVHcloud web console will update the record IDs. This causes Terraform to encounter record has been deleted errors because the IDs no longer match. If this happens, you must terraform import the records using their new IDs and stop using the web console for these records.
• Do not use with ovh_domain_zone_import: You should not use ovh_domain_zone_record and ovh_domain_zone_import together, as the latter manages the entire DNS zone at once and will conflict with individual record management.

# Add a record to a sub-domain
resource "ovh_domain_zone_record" "test" {
  zone      = "testdemo.ovh"
  subdomain = "test"
  fieldtype = "A"
  ttl       = 3600
  target    = "0.0.0.0"
}

The conditions block allows you to restrict permissions based on specific contexts. Conditions can be nested up to 3 levels deep.

Operators

• operator (Required): Defines how to combine conditions. Valid values: AND, OR, NOT, or MATCH.
• MATCH: A terminal operator that compares values. It cannot have sub-conditions.

Supported Keys in values

When using the MATCH operator, you can match against:

• Resource tags: resource.Tag(tag_name) (e.g., resource.Tag(environment))
• Date/time: date(timezone).WeekDay or date(timezone).WeekDay.In (e.g., date(Europe/Paris).WeekDay.In)
• Request attributes: request.IP

Example: IP and Tag Restriction

resource "ovh_iam_policy" "ip_restricted_prod_access" {
  name        = "ip_restricted_prod_access"
  identities  = [ovh_me_identity_group.my_group.urn]
  resources   = ["urn:v1:eu:resource:vps:*"]
  allow       = ["vps:apiovh:*"]

  conditions {
    operator = "MATCH"
    values = {
      "resource.Tag(environment)" = "prod"
      "request.IP"              = "192.72.0.1"
    }
  }
}

resource "ovh_iam_policy" "ip_restricted_prod_access" {
  name        = "ip_restricted_prod_access"
  description = "Allow access only from a specific IP to resources tagged prod"
  identities  = [ovh_me_identity_group.my_group.urn]
  resources   = ["urn:v1:eu:resource:vps:*"]

  allow = [
    "vps:apiovh:*",
  ]

  conditions {
    operator = "MATCH"
    values = {
      "resource.Tag(environment)" = "prod"
      "request.IP"                = "192.72.0.1"
    }
  }
}

Object Lock provides Write-Once-Read-Many (WORM) functionality, preventing objects from being deleted or overwritten for a specified retention period.

Critical Warnings:

• Cannot be disabled: Object Lock cannot be disabled once enabled on a bucket.
• Replacement on change: Removing the object_lock configuration block or changing object_lock.status between disabled and enabled will cause Terraform to destroy and recreate the bucket, resulting in permanent deletion of all objects. Object Lock must be enabled at the time of bucket creation.

Retention Rules:

• mode:
  • governance: Users with special permissions can override or remove retention.
  • compliance: No user, including the root user, can override or remove retention until the period expires.
• period: The retention period in ISO 8601 duration format (e.g., P30D for 30 days, P1W for 1 week). The provider handles normalization (e.g., P7D to P1W) automatically to prevent drift.

resource "ovh_cloud_project_storage" "storage_with_lock" {
  service_name = "<public cloud project ID>"
  region_name  = "GRA"
  name         = "my-locked-storage"

  object_lock = {
    status = "enabled"
    rule = {
      mode   = "governance"
      period = "P30D" # 30 days retention
    }
  }
}

Use the ovh_cloud_project_storage_object_bucket_lifecycle_configuration resource to manage S3™ compatible lifecycle rules for an OVHcloud Object Storage bucket. These rules allow you to automatically expire objects, transition them to cheaper storage classes, or clean up incomplete multipart uploads based on criteria like age, prefix, tags, or object size.

Important Behaviors:

• API Pattern: This resource uses a PUT/DELETE API. There is no separate create vs update endpoint; both actions call PUT. Destroying the resource calls DELETE, which removes the entire lifecycle configuration from the bucket.
• Replacement: Changing any of the identity attributes (service_name, region_name, or container_name) will require a resource replacement.

resource "ovh_cloud_project_storage_object_bucket_lifecycle_configuration" "lifecycle" {
  service_name   = "<public cloud project ID>"
  region_name    = "GRA"
  container_name = "my-bucket"

  rules = [
    {
      id     = "expire-old-objects"
      status = "enabled"
      expiration = {
        days = 365
      }
    }
  ]
}

The current_state attribute provides the actual observed state of the instance as reported by the compute backend. This is useful for verifying the real-time status of an instance, which may differ from the requested specification during transitions.

Key sub-attributes of current_state include:

• power_state: The observed administrative power state (e.g., ACTIVE, SHUTOFF, SHELVED).
• flavor: Details of the observed flavor, including vcpus, ram, disk, swap, and ephemeral sizes.
• image: Details of the observed boot image, including id, name, size, and status.
• networks: Observed network interfaces. Each entry contains an addresses list containing FIXED, FLOATING, or ADDITIONAL IP addresses.
• volumes: Observed block volumes currently attached, including id, name, and size.
• shares: Observed file storage share attachments (only available via the singular data source, not the list data source). Includes id, access_level, and access_to (the target IP).
• resource_status: The readiness of the instance in the system (e.g., CREATING, READY, ERROR).

You can encrypt volumes using either OVH managed keys (OMK) or Customer managed keys (CMK).

OVH Managed Keys (OMK)

To use OMK, set encrypted = true within the encryption block and omit the kms block.

Customer Managed Keys (CMK)

To use CMK, provide the kms block containing the domain_id and service_key_id. Note that CMK is only available in supported 3AZ regions.

Warning: Changing the encryption configuration recreates the resource.

# Encrypted volume with a customer managed key (CMK)
resource "ovh_cloud_project_volume" "encrypted_volume" {
   region_name  = "xxx"
   service_name = "yyyyy"
   description  = "Terraform encrypted volume"
   name         = "encryptedVolume"
   size         = 15
   type         = "classic"

   encryption = {
     encrypted = true
     kms = {
       domain_id      = "<okms domain id>"
       service_key_id = "<okms service key id>"
     }
   }
}

# Encrypted volume with OVH managed keys (OMK)
resource "ovh_cloud_project_volume" "encrypted_volume_omk" {
   region_name  = "xxx"
   service_name = "yyyyy"
   name         = "encryptedVolume"
   size         = 15
   type         = "classic"

   encryption = {
     encrypted = true
   }
}