> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Raff Terraform Provider
> Provision and manage Raff resources declaratively with HashiCorp Terraform. 14 resources spanning compute, storage, networking, and IAM, plus 25+ data sources for discovery and pricing.
Updated May 10, 2026
The **Raff Terraform Provider** lets you define your Raff infrastructure as code — versioned in git, reviewed in PRs, applied with `terraform apply`. The provider talks to the same public API as the dashboard and the [CLI](/reference/cli/introduction); the difference is the workflow: declarative state instead of imperative commands.
For one-off operations and shell-driven workflows, use the [CLI](/reference/cli/introduction). For everything that should be reproducible and code-reviewable — production VMs, project structure, customer multi-tenancy — use Terraform.
registry.terraform.io/providers/RaffTechnologies/raff/latest — auto-generated schema docs for every resource and data source, plus version history.
## Resources
### Compute
| Resource | What it manages |
| ------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| [`raff_vm`](/reference/terraform/raff_vm) | A virtual machine — OS template, plan, networking, backup schedule, tags |
| [`raff_volume`](/reference/terraform/raff_volume) | A block storage volume (NVMe SSD), attachable to a VM |
| [`raff_snapshot`](/reference/terraform/raff_snapshot) | Point-in-time snapshot of a VM disk or volume |
| [`raff_backup`](/reference/terraform/raff_backup) | One-shot VM backup |
| [`raff_backup_schedule`](/reference/terraform/raff_backup_schedule) | Recurring backup policy with retention |
### Networking
| Resource | What it manages |
| ----------------------------------------------------------------- | ---------------------------------------------------- |
| [`raff_vpc`](/reference/terraform/raff_vpc) | Virtual private cloud — RFC 1918 / RFC 6598, /16–/28 |
| [`raff_ip`](/reference/terraform/raff_ip) | Reserved floating IP (IPv4 or IPv6) |
| [`raff_security_group`](/reference/terraform/raff_security_group) | Firewall ruleset attached to VM NICs |
### Team & access control
| Resource | What it manages |
| ----------------------------------------------------------------- | ------------------------------------------------------------------------ |
| [`raff_project`](/reference/terraform/raff_project) | A project — the access-control container |
| [`raff_member`](/reference/terraform/raff_member) | Account-level member (invite by email or add an existing user / API key) |
| [`raff_project_member`](/reference/terraform/raff_project_member) | Project-scoped member |
| [`raff_role`](/reference/terraform/raff_role) | Custom IAM role with a permission set |
| [`raff_ssh_key`](/reference/terraform/raff_ssh_key) | Registered SSH public key |
| [`raff_api_key`](/reference/terraform/raff_api_key) | API key (secret returned once at create — lock down state) |
### Data sources
Every resource has a singular (by ID) and plural (list) data source — see the **Data sources** section at the bottom of each resource page. Catalog/lookup data sources (regions, OS templates, pricing) live on the [Catalog data sources](/reference/terraform/data-sources) page.
## Quick start
```hcl theme={null}
terraform {
required_providers {
raff = {
source = "RaffTechnologies/raff"
version = "~> 0.1"
}
}
}
provider "raff" {
api_key = var.raff_api_key # or set RAFF_API_KEY env var
project_id = var.raff_project_id
}
resource "raff_project" "prod" {
name = "production"
description = "Production workloads"
default_region = "us-east"
}
resource "raff_ssh_key" "alice" {
name = "alice@laptop"
public_key = file("~/.ssh/id_ed25519.pub")
}
resource "raff_vm" "web" {
name = "web-01"
template_id = ""
pricing_id = 9 # Standard 2 vCPU / 4 GiB / 50 GiB
region = "us-east"
ssh_keys = [raff_ssh_key.alice.id]
tags = ["web", "prod"]
}
```
```bash theme={null}
terraform init
terraform plan
terraform apply
```
## Authentication
The provider takes an API key via either the `api_key` block argument or the `RAFF_API_KEY` environment variable. Same precedence as the [CLI](/reference/cli/configure#authentication-precedence): block argument > env var.
```bash theme={null}
export RAFF_API_KEY="raff_"
export RAFF_PROJECT_ID=""
terraform apply
```
API keys carry their own role assignment. To run Terraform with narrower scope than your user account, [generate a Custom-role API key](/products/manage/team-projects/quickstart-guides/generate-api-key) with only the permissions Terraform needs.
## Provider configuration block
```hcl theme={null}
provider "raff" {
api_key = "raff_" # required (or via env)
api_url = "https://api.rafftechnologies.com" # optional override
project_id = "" # optional default
}
```
| Argument | Required | Description |
| ------------ | ----------------------------- | -------------------------------------------------------------------- |
| `api_key` | Yes (or `RAFF_API_KEY` env) | API key with the role you want Terraform to use |
| `api_url` | No | Override the API base URL — defaults to production |
| `project_id` | No (or `RAFF_PROJECT_ID` env) | Default project for resources that don't set `project_id` themselves |
## What's covered
The provider tracks the customer-facing public API. Every resource group exposed by the API has a Terraform resource and matching data sources today: compute, storage, networking, identity. Kubernetes and Object Storage are still rolling out at the API level and will land in the provider once those endpoints stabilize.
## Versioning and upgrades
The provider follows semantic versioning. Major-version bumps may include breaking changes to resource schemas; minor and patch versions are backward-compatible additions and bug fixes. Pin a specific version in your `required_providers` block to control upgrades:
```hcl theme={null}
terraform {
required_providers {
raff = {
source = "RaffTechnologies/raff"
version = "~> 0.1"
}
}
}
```
## Where to go next
Registry installation, local development, and version pinning.
Manage Virtual Machines.
Block storage volumes.
Private networks.
Regions, templates, pricing.
Auto-generated schema docs.
Imperative alternative for non-IaC workflows.