cli

func DeactivateAccessKey ¶

func DeactivateAccessKey(accessKey string) string

DeactivateAccessKey neutralizes a real-looking AWS access key id so a live credential is never baked into the generated override file nor sent to LocalStack (where it could be captured by analytics by accident).

AWS access key ids begin with an "A" (e.g. "AKIA…" for long-term keys, "ASIA…" for temporary session keys). Replacing that leading "A" with "L" renders the key inert while leaving obviously-mock values (e.g. "test", or a 12-digit account id) untouched. This mirrors tflocal's deactivate_access_key safeguard — see https://docs.localstack.cloud/references/credentials/.

func EndpointKeys ¶

func EndpointKeys(ctx context.Context, tfBin, workdir string) ([]string, error)

EndpointKeys returns the AWS service endpoint keys to write into the generated `endpoints {}` block, discovered from the installed provider schema via `<tfBin> providers schema -json`. It supports the AWS provider 4.0+.

There is no fallback list. If the schema cannot be retrieved (provider not installed, e.g. before `terraform init`) it returns ErrInitRequired; if the schema is present but exposes no endpoint keys it returns a plain error. In both cases the caller must fail rather than generate an override.

func HasS3Backend ¶ added in v0.14.0

func HasS3Backend(workdir string, logger log.Logger) bool

HasS3Backend reports whether the working directory declares a `terraform { backend "s3" {} }` block. It is what flips `init` onto the proxied path (require emulator, generate backend override, provision).

func IsUnproxied ¶

func IsUnproxied(args []string) bool

IsUnproxied reports whether the terraform invocation described by args is one of the unconditionally unproxied subcommands (fmt/validate/version). The subcommand is the first argument that is not a flag (terraform's global options, e.g. -chdir, precede the subcommand).

func RequiresEmulator ¶ added in v0.14.0

func RequiresEmulator(args []string, workdir string, logger log.Logger) bool

RequiresEmulator reports whether the invocation needs a running LocalStack emulator (and thus the endpoint-resolution path in cmd). fmt/validate/version never do. init needs one only when the working directory declares an S3 backend (it must then redirect the backend and provision its resources); without a backend, init passes through to bootstrap the provider. Every other subcommand (plan/apply/destroy/…) is proxied and needs the emulator.

func ResolveChdir ¶ added in v0.14.0

func ResolveChdir(getwd, chdir string) string

ResolveChdir resolves terraform's -chdir=DIR value into an absolute-ish working directory: an absolute DIR is used as-is, a relative DIR is joined to the process working directory (matching how terraform interprets it).

func Run ¶

func Run(ctx context.Context, endpointURL, region, account, chdir string, sink output.Sink, logger log.Logger, args []string) error

Run proxies a terraform invocation against LocalStack. The path taken depends on the subcommand and on whether the working directory declares an S3 backend:

• fmt/validate/version: run terraform directly; no override, no endpoint.
• init without an S3 backend: pass through directly so it can install the provider (the override's endpoint keys are discovered from the provider schema, which does not exist until init has run).
• init with an S3 backend: generate a backend-only override (no provider blocks, since the schema is not yet available), provision the state bucket and lock table, then run init.
• plan/apply/…: discover the provider endpoint keys from the schema and generate a full override (provider blocks + backend + remote-state), provision the backend when present, then run terraform.

In every proxied case the generated override is removed afterward.

endpointURL is the resolved LocalStack endpoint (http://host:port); it may be empty for the unproxied and backend-less init paths. region and account are encoded into each generated block. chdir is terraform's -chdir=DIR value ("" when absent); when set, lstk anchors all of its directory-relative work (schema discovery, override generation, cleanup) to that directory rather than the process working directory, mirroring the switch terraform itself makes.