Skip to main content
Type: rvn-stack · Latest version: 1.4.0

​
Readme

Automate Terraform and OpenTofu workflows with git-driven deployments and managed state.

​
Overview

A Stack represents a single Terraform or OpenTofu project connected to a git repository. Ravion monitors your repository for changes and automatically executes infrastructure workflows when code is pushed or pull requests are opened. Stacks provide:
  • Automated plan/apply on git push to your primary branch or via pull requests, with independent controls for each
  • Manual execution for ad-hoc plans, applies, and destroys on the primary branch
  • Managed state backend (optional) for configurations that declare an empty cloud {} block

​
Use cases

​
Workflow types

​
Git-triggered workflows

Ravion responds to repository events based on two independent settings: A push to the primary branch includes the push created when a pull request is merged. Review pull request plan results in the Ravion run view; posting them back to the pull request as a comment and commit check is coming soon. Two common workflows:
  • Plan on the PR, apply from the primary branch (default): pull request runs are plan only; merging the PR pushes to the primary branch, which runs a fresh plan and applies after approval. Enable Auto-approve primary branch applies to skip approval for non-destructive plans.
  • Plan and apply from the PR branch, then merge: set pull requests to plan → approve → apply and set the primary branch to Nothing (or Plan only for a post-merge drift check) so the merge does not apply a second time.
Watch paths control which file changes trigger workflows. By default, any file change (**/*) triggers a run. Configure specific paths or patterns to limit triggers to relevant files.

​
Manual workflows

Execute workflows on-demand from the Ravion dashboard or API:

​
Pipeline integration

Stacks execute using your organization’s default pipelines. Pipelines are configured separately and define:
  • Execution steps (init, plan, apply)
  • Approval requirements (default pipelines require manual approval before apply)
  • Environment and runner settings
  • Pre/post hooks
When you create a Stack, it automatically inherits the default change pipeline (for plan/apply) and destroy pipeline. This ensures consistent workflow behavior across all stacks in your organization.

​
Configuration

​
State management

Terraform and OpenTofu track infrastructure in a state file. Ravion offers two options:
  • Managed state (default): Ravion stores and manages your state file. Add an empty cloud {} block to your Terraform configuration; Ravion supplies the workspace configuration at runtime.
  • Self-managed state: Disable the Ravion backend and configure your own (S3, GCS, Azure Storage, etc.) in your Terraform configuration.
For Ravion-managed state, include:

​
Terraform vs OpenTofu

OpenTofu is recommended. In 2023, HashiCorp changed Terraform’s license from open-source to BSL. The open-source Terraform versions are limited to < 1.6.0. OpenTofu is the community fork that continues active development under a true open-source license (MPL 2.0).

​
Learn more

Curated list of Terraform resources and learning material OpenTofu Terraform (limited to < 1.6.0)

​
Inputs reference

All inputs for rvn-stack version 1.4.0. Use the name shown for each field as the input key in module config.

​
Where to run Terraform plan & apply

​
string
required
AWS Account. Where to execute the Terraform plan & apply steps
  • Shown when: {"default_networking":true}
​
boolean
Use default VPC, subnet and security group.
  • Default: true
​
string
required
Region. Where to execute the Terraform plan & apply steps
  • Shown when: {"default_networking":true}
​
string
Execution environment. Specify the VPC, subnet, and security group for Pipeline Terraform runners. Defaults to the Environment’s default Execution Environment
  • Shown when: {"default_networking":false}

​
Source code

​
gitrepo
required
Git repository.
​
string
required
Primary branch.
  • Default: main
​
string
Base path. Folder containing your Terraform files (relative to repo root)
​
string_array
Watch paths. File paths glob patterns (e.g., src/**) that trigger a pipeline run when changed. Defaults to **
  • Default: ["<<module.input.base_path>>/**"]

​
Git workflow

​
string
required
On pull request (opened/updated). Review plan results in Ravion. Posting them to the pull request as a comment is coming soon.
  • Default: plan
  • Allowed values: none (Nothing), plan (Plan only), plan_and_apply (Plan → approve → apply from the PR branch)
​
string
required
On push to primary branch (incl. PR merge). If you apply from pull requests, choose Nothing so merging doesn’t apply a second time.
  • Default: plan_and_apply
  • Allowed values: none (Nothing), plan (Plan only (drift check, no apply)), plan_and_apply (Plan → approve → apply)
​
boolean
Auto-approve primary branch applies. Skip the approval step for primary branch runs whose plan has no destructive changes. Plans that destroy or replace resources always require approval.
  • Default: false
  • Shown when: {"primary_branch_runs":"plan_and_apply"}

​
Stack inputs

​
string_array
Terraform variable files. Relative paths from base path to .tfvars or .tfvars.json files (equivalent to -var-file flags)
​
object
Terraform variables. Variables passed to Terraform/OpenTofu (equivalent to -var flags)
​
object
Environment variables.

​
IaC tool

​
string
required
Tool. Terraform is no longer free open source. OpenTofu is the popular community fork with full Terraform compatibility.
  • Default: opentofu
  • Allowed values: opentofu (OpenTofu (Recommended)), terraform (Terraform (FOSS, limited < v1.6.0))
​
string
required
Terraform version.
  • Default: $values:first
  • Shown when: {"tool":"terraform"}
​
string
required
OpenTofu version.
  • Default: $values:first
  • Shown when: {"tool":"opentofu"}
​
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
  • Default: true
​
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
  • Default: true
​
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Use Ravion for your Terraform state. Use Ravion-managed state. Your Terraform configuration must include an empty terraform { cloud {} } block; Ravion supplies the workspace configuration. Disable to use your own backend, including S3 or Terraform Cloud.
  • Default: true
  • Immutable after creation
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
  • Shown when: {"use_ravion_state_backend":true}