OCI Config Sync Tools

CLI tools to manage Terraform variables and OCI backend configuration using Bitwarden, 1Password, or LastPass as a secrets store.

Features

• Smart Variable Detection: Automatically parses _variables.tf to find variables
• OCI Backend Generation: Generates _backend.tf with OCI state backend configuration
• Vault Integration: Supports Bitwarden, 1Password, and LastPass
• Bidirectional Sync: Export from tfvars to vault, import from vault to tfvars
• Domain-based Profiles: Uses OCI CLI profiles like terraform_{domain}

Installation

Option 1: Clone and use directly

git clone https://github.com/BarraDev/oci-config-sync-tools.git
./oci-config-sync-tools/bin/oci-config-import --help

Option 2: As a Git submodule

cd your-terraform-project
git submodule add https://github.com/BarraDev/oci-config-sync-tools.git scripts/config-sync
./scripts/config-sync/bin/oci-config-import terraform/config

Option 3: Add to PATH

export PATH="$PATH:/path/to/oci-config-sync-tools/bin"

Usage

Import configuration from vault

# Generate terraform.tfvars and _backend.tf for a specific directory
oci-config-import terraform/config

# Specify domain explicitly
oci-config-import --domain example.com terraform/infra

# Preview what would be generated
oci-config-import --dry-run terraform/config

# Only include required variables (without defaults)
oci-config-import --required-only terraform/config

Export configuration to vault

# Export current tfvars and backend config to vault
oci-config-export terraform/config

# Create new vault item (fail if exists)
oci-config-export --create terraform/config

# Update existing item (fail if not exists)
oci-config-export --update terraform/config

Cleanup generated files

Safety: By default, oci-config-clean verifies vault backup before deletion.

# Remove generated tfvars and backend files (with vault verification)
oci-config-clean terraform/config

# Preview what would be removed (no vault verification needed)
oci-config-clean --dry-run terraform/config

# Clean all terraform directories in a project
oci-config-clean --all

# Skip vault verification (not recommended)
oci-config-clean --force terraform/config

How it works:

• Verifies that critical variables are backed up in vault
• Compares local values with vault to ensure backup is current
• Only removes files if vault backup is verified
• Use --force to bypass verification (e.g., if vault provider not installed)

Generated Files

terraform.tfvars

Variable values loaded from vault:

# Generated by oci-config-import on Sun Dec 21 2025
# Domain: example.com

compartment_id = "ocid1.compartment..."
region         = "sa-saopaulo-1"
domain         = "example.com"

_backend.tf

OCI backend configuration:

# Generated by oci-config-import on Sun Dec 21 2025
# Domain: example.com

terraform {
  backend "oci" {
    namespace           = "your-namespace"
    bucket              = "terraform-states"
    key                 = "config/terraform.tfstate"
    config_file_profile = "terraform_example_com"
  }
}

How It Works

Variable Detection

The script analyzes your _variables.tf file:

# Required variable (no default) - will be loaded from vault
variable "compartment_id" {
  type = string
}

# Optional variable (has default) - loaded if exists in vault
variable "region" {
  type    = string
  default = "sa-saopaulo-1"
}

By default, all variables are processed. Use --required-only to only include variables without defaults.

Vault Item Structure

Configuration is stored in a Secure Note named OCI Terraform - {domain}:

OCI Terraform - example.com
├── compartment_id: ocid1.compartment...
├── region: sa-saopaulo-1
├── oci_namespace: your-namespace
├── github_token: ghp_xxxxx (hidden)
└── ...

OCI CLI Profile

The generated _backend.tf uses a profile named terraform_{domain} (dots replaced with underscores). Ensure this profile exists in ~/.oci/config:

[terraform_example_com]
user=ocid1.user...
fingerprint=xx:xx:xx...
tenancy=ocid1.tenancy...
region=sa-saopaulo-1
key_file=~/.oci/keys/terraform-example.com.pem

Safety Features

Vault Backup Verification

The oci-config-clean command includes safety verification to prevent accidental data loss:

Critical Variables Verified:

• compartment_id - OCI compartment ID
• vault_id - Oracle Vault ID
• region - OCI region
• domain - Domain identifier

Verification Process:

1. Extracts domain from local terraform.tfvars
2. Connects to vault provider (Bitwarden/1Password/LastPass)
3. Retrieves vault item: "OCI Terraform - {domain}"
4. Compares critical variable values between local and vault
5. Only proceeds with deletion if all values match

Example Output:

[STEP] Verifying vault backup for domain: example.com
[INFO] ✓ Found vault item: OCI Terraform - example.com
[STEP] Verifying critical variables...
[INFO]   ✓ compartment_id: match
[INFO]   ✓ vault_id: match
[INFO]   ✓ region: match
[INFO]   ✓ domain: match
[INFO] ✓ All critical variables verified in vault
[INFO] ✓ Safe to remove terraform.tfvars

Bypass Verification:

Use --force when vault provider is not available:

oci-config-clean --force terraform/config

Requirements

• jq - JSON processor
• One of:
  • bw - Bitwarden CLI
  • op - 1Password CLI
  • lpass - LastPass CLI

Vault Provider Setup

Bitwarden

# Install
brew install bitwarden-cli  # macOS
npm install -g @bitwarden/cli  # Linux/Windows

# Login
bw login
bw unlock

1Password

# Install
brew install 1password-cli  # macOS

# Login (uses desktop app integration)
op signin

# Or use service account for CI/CD
export OP_SERVICE_ACCOUNT_TOKEN="your-token"

LastPass

# Install
brew install lastpass-cli  # macOS
sudo apt install lastpass-cli  # Debian/Ubuntu

# Login
lpass login your@email.com

Note: LastPass stores custom fields in the Notes section of Secure Notes.

Project Structure

oci-config-sync-tools/
├── bin/
│   ├── oci-config-import   # Import configuration from vault
│   ├── oci-config-export   # Export configuration to vault
│   └── oci-config-clean    # Remove generated files
├── lib/
│   ├── common.sh           # Shared utilities
│   ├── tfvars-parser.sh    # Parse _variables.tf
│   └── vault-providers/
│       ├── _interface.sh   # Provider abstraction
│       ├── bitwarden.sh    # Bitwarden implementation
│       ├── onepassword.sh  # 1Password implementation
│       └── lastpass.sh     # LastPass implementation
└── README.md

Example Workflow

# 1. Initial setup - export existing config to vault
cd terraform/config
cp _backend.tf.example _backend.tf  # fill with your namespace
# edit terraform.tfvars with your values
oci-config-export .

# 2. On a new machine - import from vault
oci-config-import terraform/config
oci-config-import terraform/infra

# 3. Run terraform
cd terraform/config
terraform init
terraform plan
terraform apply

# 4. Cleanup secrets from disk (automatically verifies vault backup)
oci-config-clean terraform/config
# Vault backup is verified before deletion - safe by default!

# 5. After updating config - sync back to vault
oci-config-export terraform/config

License

MIT