[IACP-673] Add terraform upload command for IaC artifact ingestion by vishal-joshi-datadog · Pull Request #2129 · DataDog/datadog-ci

vishal-joshi-datadog · 2026-02-25T19:11:42Z

Summary

Implements new datadog-ci terraform upload command to upload Terraform plan and state JSON files to Datadog CI intake API for enhanced cloud-to-code mapping and policy evaluation.

Changes

Base command structure: Added packages/base/src/commands/terraform/ with CLI registration and command options
Plugin implementation: Created packages/plugin-terraform/ with full upload logic
Architecture: Follows existing plugin patterns (similar to coverage, sbom plugins)
Multipart upload: Event envelope + gzipped IaC file to /api/v2/ciiac endpoint
Auto-enrichment: Git/CI metadata, SHA256 hashing, file size calculation
Features: Dry-run mode, verbose logging, optional repo-id override, retry logic

Usage

# Upload Terraform plan
datadog-ci terraform upload plan ./terraform-plan.json

# Upload Terraform state
datadog-ci terraform upload state ./terraform.tfstate

# With flags
datadog-ci terraform upload plan ./plan.json --repo-id "github.com/org/repo" --dry-run --verbose

Key Features

Single file per invocation (users can loop for multiple files)
No client-side validation/filtering (per RFC requirements)
Automatic git metadata sync (with skip option)
Supports all Datadog sites via DD_SITE environment variable
Gzip compression and SHA256 hashing
Retry logic for transient failures

Technical Details

Event envelope includes: artifact type, hash, size, git/CI context, repo_id
Uses multipart/form-data with event JSON + iac_file gzipped content
Integration with existing git-metadata upload helper
TypeScript build and linting passing

Testing

TypeScript build passes
Linting passes
Unit tests
Integration tests

Documentation

Plugin README: packages/plugin-terraform/README.md
JIRA
RFC

🤖 Generated with Claude Code

Implements new `datadog-ci terraform upload` command to upload Terraform plan and state JSON files to Datadog CI intake API. Key features: - Upload Terraform plan or state files to /api/v2/ciiac endpoint - Automatic git/CI metadata enrichment - SHA256 hashing and gzip compression of artifacts - Retry logic for transient failures - Dry-run and verbose modes - Optional repo-id override Architecture: - Base command in packages/base/src/commands/terraform/ - Plugin implementation in packages/plugin-terraform/ - Follows existing plugin architecture patterns (similar to coverage, sbom) - Multipart/form-data upload with event envelope + gzipped file Technical details: - Single file per invocation (users can loop for multiple files) - No client-side validation/filtering (per RFC requirements) - Event envelope includes artifact type, hash, size, and git/CI context - Supports all Datadog sites via DD_SITE environment variable Implementation plan: tf_command_plan.md RFC: /Users/vishal.joshi/Downloads/iac_artifact_rfc.md

datadog-datadog-prod-us1 · 2026-02-25T19:18:51Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 62496c3 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

rtrieu

minor suggestion

rtrieu · 2026-02-25T19:24:26Z

packages/plugin-terraform/README.md

+
+## Development
+
+When developing software, you can try with the following command:


Suggested change

When developing software, you can try with the following command:

To test locally, run:

- Add api.test.ts with 7 tests covering multipart upload, gzip compression, and event envelope structure - Add utils.test.ts with 28 tests covering validation functions, hash computation, and repo ID resolution - Add upload.test.ts with 8 tests covering command execution, validation, and error handling - Add test fixtures for valid plan, valid state, and invalid JSON files - Mock git-related functions to prevent test timeouts All 43 tests passing

- Replace path with upath for Windows compatibility - Remove unused fs import - Add upath as devDependency

- Add --fips and --fips-ignore-error flags to base command - Import and call enableFips in plugin implementation - Add FIPS config from environment variables - Add terraform upload to required options in CLI tests - Add beforeEach to clear mock between tests - All FIPS tests passing ✓

ava-silver

overall lgtm, just a couple nits before I approve

ava-silver · 2026-02-26T16:47:29Z

packages/base/src/commands/terraform/upload.ts

+  // Artifact type: 'plan' or 'state'
+  protected artifactType = Option.String({required: true})


you can make validation (and typing!) easier by using typanion for validation, for example, isEnum can be used for enums here. An example of usage in this repo:

datadog-ci/packages/base/src/commands/lambda/cloudwatch.ts

Line 16 in 176ebd3

public action = Option.String({validator: t.isEnum(['disable', 'enable'] as const)})

ava-silver · 2026-02-26T17:00:21Z

packages/plugin-terraform/src/renderer.ts

+import chalk from 'chalk'
+
+import {TerraformArtifactPayload} from './interfaces'
+


mind at least using these constants in your renderers to keep the style consistent?

datadog-ci/packages/base/src/helpers/renderer.ts

Lines 6 to 12 in 176ebd3

export const dryRunTag = chalk.bold(chalk.cyan('[Dry Run]'))

export const errorTag = chalk.bold(chalk.red('[Error]'))

export const warningTag = chalk.bold(chalk.yellow('[Warning]'))

export const warningExclamationSignTag = chalk.bold(chalk.yellow('[!]'))

export const successCheckmarkTag = chalk.bold(chalk.green('✔'))

export const failCrossTag = chalk.bold(chalk.red('✖'))

and if it makes sense feel free to use the helpers in that module as you see fit

packages/plugin-terraform/README.md

ava-silver · 2026-02-26T17:03:59Z

packages/plugin-terraform/README.md

+for file in ./plans/*.json; do
+  datadog-ci terraform upload plan "$file"
+done


nit: maybe worth considering adding support directly into the cli for this -- doing this in series will end up being slow if the customer has a lot of plan files

Yes, we have multiple commands supporting glob patterns for multiple files (e.g. sourcemaps upload)

Drarig29

Can you follow https://github.com/DataDog/datadog-ci/blob/master/CONTRIBUTING.md#things-to-update since you are adding a new command scope?

Drarig29 · 2026-02-26T17:11:38Z

packages/plugin-terraform/README.md

+for file in ./plans/*.json; do
+  datadog-ci terraform upload plan "$file"
+done


Yes, we have multiple commands supporting glob patterns for multiple files (e.g. sourcemaps upload)

Co-authored-by: Ava Silver <ava.silver@datadoghq.com>

ava-silver

one optional suggestion, but lgtm!

packages/base/src/commands/terraform/upload.ts

vishal-joshi-datadog requested review from a team as code owners February 25, 2026 19:11

Don't include implementation plan md

f0c520a

rtrieu approved these changes Feb 25, 2026

View reviewed changes

vishal-joshi-datadog added 3 commits February 25, 2026 14:27

Run yarn lint:packages

b5fe18c

Merge origin/master into vj/IACP-673

a977efd

vishal-joshi-datadog force-pushed the vj/IACP-673 branch from ee1ea58 to a977efd Compare February 25, 2026 19:41

Re-apply suggestion

12fde51

vishal-joshi-datadog added the datadog-ci For PRs spanning multiple commands, and repo-wide changes label Feb 25, 2026

vishal-joshi-datadog added 2 commits February 25, 2026 14:48

[IACP-673] Fix ESLint errors in utils.test.ts

3f747f4

- Replace path with upath for Windows compatibility - Remove unused fs import - Add upath as devDependency

ava-silver reviewed Feb 26, 2026

View reviewed changes

Drarig29 reviewed Feb 26, 2026

View reviewed changes

vishal-joshi-datadog and others added 7 commits February 26, 2026 13:32

Updates based on PR feedback

7915f9c

Update README, CODEOWNERS, and label yamls

9d566f3

Lint fixes

90c733a

Run yarn format

c7c520e

Update packages/plugin-terraform/README.md

3f83f72

Co-authored-by: Ava Silver <ava.silver@datadoghq.com>

Remove redundant validation

f2e4c81

Remove test

76a74fa

ava-silver approved these changes Feb 27, 2026

View reviewed changes

packages/base/src/commands/terraform/upload.ts Outdated Show resolved Hide resolved

vishal-joshi-datadog added 4 commits February 27, 2026 10:40

Use as const and yarn format

98ff8c2

Remove test

16dae04

Lint fix

1bcfe3d

Fix tests

62496c3

qu-d approved these changes Feb 27, 2026

View reviewed changes

vishal-joshi-datadog merged commit a48b7d6 into master Feb 27, 2026
26 checks passed

vishal-joshi-datadog deleted the vj/IACP-673 branch February 27, 2026 18:33

vishal-joshi-datadog mentioned this pull request Mar 3, 2026

v5.9.0 #2141

Merged


		## Development

		When developing software, you can try with the following command:

	When developing software, you can try with the following command:
	To test locally, run:

		// Artifact type: 'plan' or 'state'
		protected artifactType = Option.String({required: true})

		import chalk from 'chalk'

		import {TerraformArtifactPayload} from './interfaces'

	export const dryRunTag = chalk.bold(chalk.cyan('[Dry Run]'))
	export const errorTag = chalk.bold(chalk.red('[Error]'))
	export const warningTag = chalk.bold(chalk.yellow('[Warning]'))

	export const warningExclamationSignTag = chalk.bold(chalk.yellow('[!]'))
	export const successCheckmarkTag = chalk.bold(chalk.green('✔'))
	export const failCrossTag = chalk.bold(chalk.red('✖'))

Conversation

vishal-joshi-datadog commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Usage

Key Features

Technical Details

Testing

Documentation

Uh oh!

datadog-datadog-prod-us1 bot commented Feb 25, 2026 • edited by datadog-official bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rtrieu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ava-silver left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Drarig29 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ava-silver left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

vishal-joshi-datadog commented Feb 25, 2026 •

edited

Loading

datadog-datadog-prod-us1 bot commented Feb 25, 2026 •

edited by datadog-official bot

Loading