Terraform

The Altertable Terraform provider manages Altertable resources from configuration: environments, storage buckets, catalogs, service accounts, lakehouse credentials, and role grants. Use it to review platform changes as plans, keep environments reproducible, and provision access for automation alongside the rest of your infrastructure. It works with Terraform 1.0+ and OpenTofu.

Setup

Add the provider to required_providers and configure it with a management API key:

Copy
1
2
3
4
5
6
7
8
9
10
11
12
terraform {
  required_version = ">= 1.0"
  required_providers {
    altertable = {
      source = "altertable-ai/altertable"
    }
  }
}

provider "altertable" {
  api_key = var.altertable_management_api_key
}

Issue a management API key from Organization settings → Management API keys, then pass it as api_key or set the ALTERTABLE_API_KEY environment variable.

Resources

Data sources exist for buckets, catalogs, credentials, environments, and service accounts, plus altertable_user to look up a user by email and altertable_whoami for the identity behind the configured key. Users themselves are managed outside Terraform: invite team members from the app, then reference them with the altertable_user data source.

Full argument reference for every resource and data source lives on the Terraform Registry.

Example

A complete setup: an environment with a native and an external catalog, and a service account with scoped roles and a lakehouse credential for CI.

Copy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
resource "altertable_environment" "production" {
  name           = "Production"
  cloud_provider = "aws"
  cloud_provider_region = "us-east-1"
}

resource "altertable_catalog" "warehouse" {
  environment_id = altertable_environment.production.id
  engine         = "altertable"
  name           = "Warehouse"
}

resource "altertable_catalog" "analytics" {
  environment_id = altertable_environment.production.id
  engine         = "postgres"
  name           = "Analytics"

  postgres_config = {
    host     = "db.example.com"
    port     = 5432
    database = "analytics"
    username = "altertable"
    password = var.pg_password
  }
}

resource "altertable_service_account" "ci" {
  label = "CI Deploy"
}

resource "altertable_role_set" "ci" {
  service_account_id = altertable_service_account.ci.id

  roles = [
    { role = "organization:member" },
    { role = "environment:writer", resource_id = altertable_environment.production.id },
  ]
}

resource "altertable_credential" "ci" {
  principal_type = "service_account"
  principal_id   = altertable_service_account.ci.id
  environment_id = altertable_environment.production.id
  label          = "CI"
}

output "ci_password" {
  value     = altertable_credential.ci.password
  sensitive = true
}

A role set declares the complete set of grants for a single principal: one altertable_role_set per user or service account, mixing organization-wide roles with roles scoped to a resource_id. See Access control for the available roles.

Import existing resources

Bring resources created in the app under Terraform with import blocks (Terraform 1.12+) and resource identities:

Copy
1
2
3
4
5
6
import {
  to = altertable_environment.production
  identity = {
    id = "7d3e1b9a-2c4f-4a6b-9e8d-5f0a1b2c3d4e"
  }
}

Environments, buckets, catalogs, service accounts, and credentials support identity import. Nested resources use composite identities — a catalog, for example, is identified by its environment_id and id.

Source code

The provider is published on the Terraform Registry, and its source code is available at github.com/altertable-ai/terraform-provider-altertable.