Terraform Consul Backend and Provider

terraform {
  backend "consul" {
    address = "consul.example.com:8500"
    scheme  = "https"
    path    = "terraform/myapp/state"
  }
}

terraform {
  backend "consul" {
    address      = "consul.example.com:8500"
    scheme       = "https"
    path         = "terraform/${var.project}/${var.environment}"
    access_token = var.consul_token  # Or CONSUL_HTTP_TOKEN env var
    lock         = true
    gzip         = true  # Compress state
  }
}

export CONSUL_HTTP_ADDR="consul.example.com:8500"
export CONSUL_HTTP_TOKEN="your-acl-token"
export CONSUL_HTTP_SSL=true

# Minimal config with env vars
terraform {
  backend "consul" {
    path = "terraform/myapp/production"
  }
}

provider "consul" {
  address    = "consul.example.com:8500"
  scheme     = "https"
  token      = var.consul_token
  datacenter = "dc1"
}

# Write configuration values
resource "consul_keys" "app_config" {
  key {
    path  = "config/myapp/database_url"
    value = "postgres://${aws_db_instance.main.address}:5432/myapp"
  }
 
  key {
    path  = "config/myapp/redis_url"
    value = "redis://${aws_elasticache_replication_group.main.primary_endpoint_address}:6379"
  }
 
  key {
    path  = "config/myapp/environment"
    value = var.environment
  }
}
 
# Read configuration values
data "consul_keys" "shared" {
  key {
    name = "vpc_id"
    path = "terraform/networking/vpc_id"
  }
 
  key {
    name    = "domain"
    path    = "config/shared/domain"
    default = "example.com"
  }
}
 
resource "aws_instance" "web" {
  subnet_id = data.consul_keys.shared.var.vpc_id
  # ...
}

resource "consul_service" "web" {
  name    = "web"
  node    = "web-server-1"
  port    = 8080
  address = aws_instance.web.private_ip
 
  tags = ["production", "v2"]
 
  check {
    check_id = "web-health"
    name     = "HTTP Health Check"
    http     = "http://${aws_instance.web.private_ip}:8080/health"
    interval = "10s"
    timeout  = "5s"
  }
}

data "consul_service" "database" {
  name = "postgres"
  tag  = "primary"
}
 
# Use discovered service address
locals {
  db_address = data.consul_service.database.service[0].address
  db_port    = data.consul_service.database.service[0].port
}

resource "consul_acl_policy" "app" {
  name  = "app-policy"
  rules = <<-RULES
    key_prefix "config/myapp/" {
      policy = "read"
    }
    service "web" {
      policy = "write"
    }
    node_prefix "" {
      policy = "read"
    }
  RULES
}
 
resource "consul_acl_token" "app" {
  description = "App service token"
  policies    = [consul_acl_policy.app.name]
}

resource "consul_config_entry" "web_to_db" {
  kind = "service-intentions"
  name = "postgres"
 
  config_json = jsonencode({
    Sources = [{
      Name       = "web"
      Action     = "allow"
      Precedence = 9
      Type       = "consul"
    }]
  })
}