Raff Terraform Provider

_{Updated May 10, 2026} The Raff Terraform Provider lets you define your Raff infrastructure as code — versioned in git, reviewed in PRs, applied with terraform apply. The provider talks to the same public API as the dashboard and the CLI; the difference is the workflow: declarative state instead of imperative commands. For one-off operations and shell-driven workflows, use the CLI. For everything that should be reproducible and code-reviewable — production VMs, project structure, customer multi-tenancy — use Terraform.

View on Terraform Registry

registry.terraform.io/providers/RaffTechnologies/raff/latest — auto-generated schema docs for every resource and data source, plus version history.

Resources

Compute

Resource	What it manages
`raff_vm`	A virtual machine — OS template, plan, networking, backup schedule, tags
`raff_volume`	A block storage volume (NVMe SSD), attachable to a VM
`raff_snapshot`	Point-in-time snapshot of a VM disk or volume
`raff_backup`	One-shot VM backup
`raff_backup_schedule`	Recurring backup policy with retention

Networking

Resource	What it manages
`raff_vpc`	Virtual private cloud — RFC 1918 / RFC 6598, /16–/28
`raff_ip`	Reserved floating IP (IPv4 or IPv6)
`raff_security_group`	Firewall ruleset attached to VM NICs

Team & access control

Resource	What it manages
`raff_project`	A project — the access-control container
`raff_member`	Account-level member (invite by email or add an existing user / API key)
`raff_project_member`	Project-scoped member
`raff_role`	Custom IAM role with a permission set
`raff_ssh_key`	Registered SSH public key
`raff_api_key`	API key (secret returned once at create — lock down state)

Data sources

Every resource has a singular (by ID) and plural (list) data source — see the Data sources section at the bottom of each resource page. Catalog/lookup data sources (regions, OS templates, pricing) live on the Catalog data sources page.

Quick start

terraform {
  required_providers {
    raff = {
      source  = "RaffTechnologies/raff"
      version = "~> 0.1"
    }
  }
}

provider "raff" {
  api_key    = var.raff_api_key  # or set RAFF_API_KEY env var
  project_id = var.raff_project_id
}

resource "raff_project" "prod" {
  name           = "production"
  description    = "Production workloads"
  default_region = "us-east"
}

resource "raff_ssh_key" "alice" {
  name       = "alice@laptop"
  public_key = file("~/.ssh/id_ed25519.pub")
}

resource "raff_vm" "web" {
  name        = "web-01"
  template_id = "<ubuntu-template-uuid>"
  pricing_id  = 9                          # Standard 2 vCPU / 4 GiB / 50 GiB
  region      = "us-east"
  ssh_keys    = [raff_ssh_key.alice.id]
  tags        = ["web", "prod"]
}

terraform init
terraform plan
terraform apply

Authentication

The provider takes an API key via either the api_key block argument or the RAFF_API_KEY environment variable. Same precedence as the CLI: block argument > env var.

export RAFF_API_KEY="raff_<your-key>"
export RAFF_PROJECT_ID="<your-default-project-id>"

terraform apply

API keys carry their own role assignment. To run Terraform with narrower scope than your user account, generate a Custom-role API key with only the permissions Terraform needs.

Provider configuration block

provider "raff" {
  api_key    = "raff_<your-key>"   # required (or via env)
  api_url    = "https://api.rafftechnologies.com"  # optional override
  project_id = "<default-project-uuid>"            # optional default
}

Argument	Required	Description
`api_key`	Yes (or `RAFF_API_KEY` env)	API key with the role you want Terraform to use
`api_url`	No	Override the API base URL — defaults to production
`project_id`	No (or `RAFF_PROJECT_ID` env)	Default project for resources that don’t set `project_id` themselves

What’s covered

The provider tracks the customer-facing public API. Every resource group exposed by the API has a Terraform resource and matching data sources today: compute, storage, networking, identity. Kubernetes and Object Storage are still rolling out at the API level and will land in the provider once those endpoints stabilize.

Versioning and upgrades

The provider follows semantic versioning. Major-version bumps may include breaking changes to resource schemas; minor and patch versions are backward-compatible additions and bug fixes. Pin a specific version in your required_providers block to control upgrades:

terraform {
  required_providers {
    raff = {
      source  = "RaffTechnologies/raff"
      version = "~> 0.1"
    }
  }
}

Where to go next

Install the provider

Registry installation, local development, and version pinning.

raff_vm

Manage Virtual Machines.

raff_volume

Block storage volumes.

raff_vpc

Private networks.

Catalog data sources

Regions, templates, pricing.

Terraform Registry

Auto-generated schema docs.

CLI

Imperative alternative for non-IaC workflows.

View on Terraform Registry

​Resources

​Compute

​Networking

​Team & access control

​Data sources

​Quick start

​Authentication

​Provider configuration block

​What’s covered

​Versioning and upgrades

​Where to go next