Native Variable Support in S3 Backend Configuration

[aymene01]

Terraform Version

v1.10.5

Use Cases

When managing multiple environments and components in a large infrastructure, we often need to reuse the same backend configuration pattern with different values (environment, product, component names). Currently, this requires either:

• Duplicating backend configurations
• Using separate backend.hcl files
• Creating complex workarounds with templates

Current Limitations

The backend block does not support variables or locals:

terraform {
 backend "s3" {
   bucket         = local.backend.bucket # Not allowed
   key            = var.state_key        # Not allowed
   region         = var.aws_region       # Not allowed
   # ...
 }
}

Attempted Solutions

# modules/remote-state/outputs.tf
output "config" {
  description = "Remote state configuration"
  value = {
    bucket         = "acme-${var.environment}-tfstates"
    key            = "${var.product}/${var.component}.tfstate"
    region         = var.region
    encrypt        = true
    dynamodb_table = "acme-${var.environment}-terraform-state-lock"
    assume_role = {
      role_arn = var.environment == "prod" ? 
        "arn:aws:iam::987654321098:role/TerraformProd" : 
        "arn:aws:iam::123456789012:role/TerraformNonProd"
    }
  }
}

# main.tf
terraform {
  backend "s3" {}
}

module "remote_state" {
  source = "../remote-state"
  
  environment = var.environment  # dev/staging/prod
  product     = "payment-service"
  component   = "transactions"
  region      = "eu-west-1"
}

data "terraform_remote_state" "state" {
  backend = "s3"
  config  = module.remote_state.config
}

Proposal

Allow variable and local usage in backend configurations, similar to other Terraform blocks:

terraform {
 backend "s3" {
   bucket          = "${var.environment}-tfstates"
   key             = "${var.product}/${var.component}.tfstate"
   region          = var.aws_region
   encrypt         = true
   dynamodb_table  = "${var.environment}-terraform-state-lock"
   assume_role {
     role_arn      = var.backend_role_arn
   }
 }
}

No response