Tailscale Terraform Provider

https://github.com/tailscale/terraform-provider-tailscale
Admin
The Tailscale Terraform Provider allows users to interact with the Tailscale API to manage resources...
Tokens:20,342
Snippets:204
Trust Score:10
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install and configure Tailscale provider with API key

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Install the Tailscale provider by adding this configuration and running `terraform init`. Set your API key in the `api_key` field or use the `TAILSCALE_API_KEY` environment variable.

```terraform
terraform {
  required_providers {
    tailscale = {
      source = "tailscale/tailscale"
      version = "~> 0.16" // Latest 0.16.x
    }
  }
}

provider "tailscale" {
  api_key = "tskey-api-..."
}
```

--------------------------------

### Example Usage: tailscale_service data source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/service.md

Defines a tailscale_service data source named 'example' that fetches a Service by its name. The name must be in the format 'svc:my-service'.

```terraform
data "tailscale_service" "example" {
  name = "svc:my-service"
}

```

--------------------------------

### Import a posture integration

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/posture_integration.md

Imports an existing posture integration using its ID. The example shows the terraform import command with the resource address and ID.

```shell
# Posture integration can be imported using the posture integration id, e.g.,
terraform import tailscale_posture_integration.sample_posture_integration 123456789
```

--------------------------------

### Run acceptance tests against local control server

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Run these commands to start a local control server with the terraform-acceptance-testing test scenario and then run the acceptance tests using the make rule testacc_local, which populates the necessary environment variables.

```shell
./tool/go run -tags tailscale_saas ./cmd/devcontrol --generate-test-devices=terraform-acceptance-testing &
make testacc_local
```

--------------------------------

### Import split DNS nameservers using terraform import

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_split_nameservers.md

Shows how to import an existing split DNS nameservers resource using the domain name as the import ID. The example imports the resource named sample_split_nameservers for example.com.

```shell
# Split DNS nameservers can be imported using the domain name, e.g.
terraform import tailscale_dns_split_nameservers.sample_split_nameservers example.com
```

--------------------------------

### Configure S3-compatible logstreaming endpoint

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/logstream_configuration.md

Example configuration for an S3-compatible logstreaming endpoint using access key authentication.

```terraform
resource "tailscale_logstream_configuration" "sample_logstream_configuration_s3_compatible" {
  log_type               = "configuration"
  destination_type       = "s3"
  url                    = "https://s3.example.com"
  s3_bucket              = "example-bucket"
  s3_region              = "us-west-2"
  s3_authentication_type = "accesskey"
  s3_access_key_id       = "some-access-key"
  s3_secret_access_key   = "some-secret-key"
}
```

--------------------------------

### Configure DNS preferences with magic DNS enabled

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_preferences.md

Creates a tailscale_dns_preferences resource with magic_dns set to true. This is the basic usage example for enabling magic DNS on your Tailscale network.

```terraform
resource "tailscale_dns_preferences" "sample_preferences" {
  magic_dns = true
}

```

--------------------------------

### Example Usage: tailscale_device_authorization

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_authorization.md

Creates a device authorization resource using a data source to find the device by name. The `device_id` attribute uses the preferred `node_id` attribute from the data source, and `authorized` is set to true.

```terraform
data "tailscale_device" "sample_device" {
  name = "device.example.com"
}

resource "tailscale_device_authorization" "sample_authorization" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id  = data.tailscale_device.sample_device.node_id
  authorized = true
}
```

--------------------------------

### Import a tailscale_federated_identity resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/federated_identity.md

Imports an existing federated identity into Terraform state using the terraform import command. The example uses the resource address tailscale_federated_identity.example and a sample client ID.

```shell
terraform import tailscale_federated_identity.example k1234511CNTRL-kZDRvszg8621CNTRL

```

--------------------------------

### Calculate IPv6 prefix with tailscale_4via6

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/4via6.md

Example usage of the tailscale_4via6 data source to map an IPv4 CIDR to an IPv6 prefix using a specific site ID.

```terraform
data "tailscale_4via6" "example" {
  site = 7
  cidr = "10.1.1.0/24"
}
```

--------------------------------

### Configure AWS S3 logstreaming endpoint

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/logstream_configuration.md

Example configuration for an AWS S3 logstreaming endpoint using role-based authentication.

```terraform
resource "tailscale_logstream_configuration" "sample_logstream_configuration_s3" {
  log_type               = "configuration"
  destination_type       = "s3"
  s3_bucket              = aws_s3_bucket.tailscale_logs.id
  s3_region              = "us-west-2"
  s3_authentication_type = "rolearn"
  s3_role_arn            = aws_iam_role.tailscale_logs_writer.arn
  s3_external_id         = tailscale_aws_external_id.prod.external_id
}
```

--------------------------------

### Configure non-S3 logstreaming endpoint

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/logstream_configuration.md

Example configuration for a non-S3 logstreaming endpoint using the Panther destination type.

```terraform
resource "tailscale_logstream_configuration" "sample_logstream_configuration" {
  log_type         = "configuration"
  destination_type = "panther"
  url              = "https://example.com"
  token            = "some-token"
}
```

--------------------------------

### Configure GCS logstreaming endpoint with workload identity

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/logstream_configuration.md

Example configuration for a GCS logstreaming endpoint using workload identity federation.

```terraform
resource "tailscale_logstream_configuration" "sample_logstream_configuration_gcs_wif" {
  log_type         = "configuration"
  destination_type = "gcs"
  gcs_bucket       = "example-gcs-bucket"
  gcs_credentials  = jsonencode({
    type = "external_account"
    audience = "//iam.googleapis.com/projects/12345678/locations/global/workloadIdentityPools/example-pool/providers/example-provider"
    subject_token_type = "urn:ietf:params:aws:token-type:aws4_request"
    service_account_impersonation_url = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/example@example.iam.gserviceaccount.com:generateAccessToken"
    token_url = "https://sts.googleapis.com/v1/token"
    credential_source = {
      environment_id = "aws1"
      region_url = "http://169.254.169.254/latest/meta-data/placement/availability-zone"
      url = "http://169.254.169.254/latest/meta-data/iam/security-credentials"
      regional_cred_verification_url = "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"
      imdsv2_session_token_url = "http://169.254.169.254/latest/api/token"
    }
  })
}
```

--------------------------------

### Look up a user by ID

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/user.md

Use this data source to retrieve details about a single user in a tailnet by specifying the user's ID. The example uses id = 32571345.

```terraform
data "tailscale_user" "32571345" {
  id = 32571345
}

```

--------------------------------

### Configure dev_overrides for local provider development

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Add this development override to your terraformrc file to use a local copy of the tailscale/tailscale provider instead of a published version. The direct {} block ensures other providers are still installed normally.

```hcl
provider_installation {
  # This disables the version and checksum verifications for this
  # provider and forces Terraform to look for the tailscale/tailscale
  # provider plugin in the given directory.
  dev_overrides {
    "tailscale/tailscale" = "/path/to/this/repo/on/disk"
  }
  # For all other providers, install them directly from their origin provider
  # registries as normal. If you omit this, Terraform will _only_ use
  # the dev_overrides block, and so no other providers will be available.
  direct {}
}
```

--------------------------------

### Import a tailscale_device_key resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_key.md

Shows how to import a device key using either the node ID (preferred) or the legacy ID.

```shell
# Device key can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_key.sample nodeidCNTRL
# Device key can be imported using the legacy ID, e.g.,
terraform import tailscale_device_key.sample 123456789
```

--------------------------------

### Generate documentation with go generate

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Run this command from the repository root to regenerate the provider documentation using terraform-plugin-docs. Review and commit the changes afterward.

```shell
go generate ./...
```

--------------------------------

### Import tailscale_device_subnet_routes resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_subnet_routes.md

Imports an existing `tailscale_device_subnet_routes` resource using either the node ID (preferred) or the legacy ID.

```shell
# Device subnet rules can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_subnet_routes.sample nodeidCNTRL
# Device subnet rules can be imported using the legacy ID, e.g.,
terraform import tailscale_device_subnet_routes.sample 123456789
```

--------------------------------

### Create a tailscale_oauth_client resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/oauth_client.md

Defines a basic OAuth client with a description, read-only scopes, and device tags.

```terraform
resource "tailscale_oauth_client" "sample_client" {
  description = "sample client"
  scopes      = ["all:read"]
  tags        = ["tag:test"]
}
```

--------------------------------

### Configure split DNS nameservers with Terraform

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_split_nameservers.md

Creates a tailscale_dns_split_nameservers resource for the domain foo.example.com, using the nameserver 1.1.1.1. The domain is required and changing it forces recreation.

```terraform
resource "tailscale_dns_split_nameservers" "sample_split_nameservers" {
  domain = "foo.example.com"

  nameservers = ["1.1.1.1"]
}
```

--------------------------------

### Import tailscale_dns_configuration resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_configuration.md

Imports an existing DNS configuration using the ID 'dns_configuration'. The comment notes that the ID doesn't matter.

```shell
# ID doesn't matter.
terraform import tailscale_dns_configuration.sample_configuration dns_configuration
```

--------------------------------

### Run a single acceptance test with TESTARGS

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Use this command to run a single acceptance test or pass other arguments to the go test command via TESTARGS.

```shell
TESTARGS='-run TestAccTailscaleACL' make testacc_local
```

--------------------------------

### Import device tags using terraform import

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_tags.md

Shows how to import an existing tailscale_device_tags resource using the terraform import command. Supports both the preferred node ID and the legacy ID.

```shell
# Device tags can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_tags.sample nodeidCNTRL
# Device tags can be imported using the legacy ID, e.g.,
terraform import tailscale_device_tags.sample 123456789
```

--------------------------------

### Create a posture integration with Falcon

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/posture_integration.md

Creates a tailscale_posture_integration resource for the Falcon provider. Requires posture_provider, cloud_id, client_id, and client_secret.

```terraform
resource "tailscale_posture_integration" "sample_posture_integration" {
  posture_provider = "falcon"
  cloud_id         = "us-1"
  client_id        = "clientid1"
  client_secret    = "test-secret1"
}
```

--------------------------------

### Import: tailscale_device_authorization

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_authorization.md

Shows how to import a device authorization using the terraform import command. The preferred method uses the node ID, while the legacy method uses the numeric ID.

```shell
# Device authorization can be imported using the node ID (preferred), e.g.,
terraform import tailscale_device_authorization.sample_authorization nodeidCNTRL
# Device authorization can be imported using the legacy ID, e.g.,
terraform import tailscale_device_authorization.sample_authorization 123456789
```

--------------------------------

### Import tailscale_dns_preferences resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_preferences.md

Shows how to import an existing DNS preferences resource using the terraform import command. The ID is 'dns_preferences' and the comment notes that the ID doesn't matter.

```shell
# ID doesn't matter.
terraform import tailscale_dns_preferences.sample_preferences dns_preferences

```

--------------------------------

### Import tailscale_webhook resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/webhook.md

Uses the terraform import command to bring an existing webhook into state using its ID.

```shell
# Webhooks can be imported using the endpoint id, e.g.,
terraform import tailscale_webhook.sample_webhook 123456789
```

--------------------------------

### Create tailscale_dns_configuration resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_configuration.md

Defines a complete DNS configuration with nameservers, split DNS, search paths, override_local_dns, and magic_dns. This resource conflicts with other DNS management resources and should not be used simultaneously.

```terraform
resource "tailscale_dns_configuration" "sample_configuration" {
    nameservers {
        address            = "8.8.8.8"
    }
    nameservers {
        address            = "1.1.1.1"
        use_with_exit_node = true
    }
    split_dns {
        domain             = "foo.example.com"
        nameservers {
            address            = "1.1.1.2"
            use_with_exit_node = true
        }
        nameservers {
            address            = "1.1.1.3"
        }
    }
    split_dns {
        domain             = "bar.example.com"
        nameservers {
            address            = "8.8.8.2"
            use_with_exit_node = true
        }
    }
    search_paths       = ["example.com", "anotherexample.com"]
    override_local_dns = true
    magic_dns = true
}
```

--------------------------------

### Import tailscale_logstream_configuration

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/logstream_configuration.md

Use the terraform import command with the resource name and the logstream configuration ID to import an existing configuration.

```shell
# Logstream configuration can be imported using the logstream configuration id, e.g.,
terraform import tailscale_logstream_configuration.sample_logstream_configuration 123456789
```

--------------------------------

### Import a tailscale_oauth_client resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/oauth_client.md

Uses the terraform import command to bring an existing OAuth client into state. Note that sensitive fields like the secret key are not retrieved during import.

```shell
# Note: Sensitive fields such as the secret key are not returned by the API and will be unset in the Terraform state after import.
terraform import tailscale_oauth_client.example k1234511CNTRL
```

--------------------------------

### Configure DNS search paths with tailscale_dns_search_paths

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_search_paths.md

Creates a tailscale_dns_search_paths resource that sets DNS search paths for the Tailscale network. The search_paths argument is a list of domain suffixes that devices on the network will use to resolve DNS names.

```terraform
resource "tailscale_dns_search_paths" "sample_search_paths" {
  search_paths = [
    "example.com"
  ]
}

```

--------------------------------

### Import tailscale_dns_nameservers resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_nameservers.md

Imports an existing DNS nameservers configuration into Terraform state. The ID is not used and can be any value.

```shell
# ID doesn't matter.
terraform import tailscale_dns_nameservers.sample dns_nameservers

```

--------------------------------

### Import tailscale_acl with terraform import

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/acl.md

Import an existing tailscale_acl resource. The ID doesn't matter; using 'acl' imports the current policy file.

```shell
# ID doesn't matter.
terraform import tailscale_acl.sample_acl acl
```

--------------------------------

### Configure DNS nameservers with tailscale_dns_nameservers

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_nameservers.md

Creates a Tailscale DNS nameservers resource that sets the DNS servers for the network. The nameservers attribute accepts IPv4 or IPv6 addresses.

```terraform
resource "tailscale_dns_nameservers" "sample_nameservers" {
  nameservers = [
    "8.8.8.8",
    "8.8.4.4"
  ]
}

```

--------------------------------

### Configure tailnet settings with tailscale_tailnet_settings

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/tailnet_settings.md

Creates a tailnet_settings resource with various settings enabled, including external ACL management, device approval, auto-updates, key duration, user approval, posture identity collection, and HTTPS provisioning.

```terraform
resource "tailscale_tailnet_settings" "sample_tailnet_settings" {
  acls_externally_managed_on                  = true
  acls_external_link                          = "https://github.com/octocat/Hello-World"
  devices_approval_on                         = true
  devices_auto_updates_on                     = true
  devices_key_duration_days                   = 5
  users_approval_on                           = true
  users_role_allowed_to_join_external_tailnet = "member"
  posture_identity_collection_on              = true
  https_enabled                               = true
}
```

--------------------------------

### Import tailscale_dns_search_paths resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/dns_search_paths.md

Imports an existing DNS search paths configuration into Terraform. The ID argument is not used and can be any value; the import command uses the resource address and the literal 'dns_search_paths' as the import ID.

```shell
# ID doesn't matter.
terraform import tailscale_dns_search_paths.sample dns_search_paths

```

--------------------------------

### Import a tailnet key

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/tailnet_key.md

Uses the terraform import command to bring an existing tailnet key into state using its ID. Note that the key attribute is not populated during import.

```shell
# Tailnet key can be imported using the key id, e.g.,
terraform import tailscale_tailnet_key.sample_key 123456789
```

--------------------------------

### Apply tags to a Tailscale device

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_tags.md

Creates a tailscale_device_tags resource that applies tags to a device. Uses the tailscale_device data source to reference the device by name, and prefers the stable node_id attribute over the legacy id field.

```terraform
data "tailscale_device" "sample_device" {
  name = "device.example.com"
}

resource "tailscale_device_tags" "sample_tags" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id = data.tailscale_device.sample_device.node_id
  tags      = ["room:bedroom"]
}
```

--------------------------------

### Configure subnet routes and exit node with tailscale_device_subnet_routes

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_subnet_routes.md

Configures subnet routes for a Tailscale device. The first resource enables specific subnet routes, and the second configures the device as an exit node by enabling default routes. Uses the `node_id` attribute from the `tailscale_device` data source.

```terraform
data "tailscale_device" "sample_device" {
  name = "device.example.com"
}

resource "tailscale_device_subnet_routes" "sample_routes" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id = data.tailscale_device.sample_device.node_id
  routes = [
    "10.0.1.0/24",
    "1.2.0.0/16",
    "2.0.0.0/24"
  ]
}

resource "tailscale_device_subnet_routes" "sample_exit_node" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id = data.tailscale_device.sample_device.node_id
  routes = [
    # Configure as an exit node
    "0.0.0.0/0",
    "::/0"
  ]
}
```

--------------------------------

### Create a Tailscale Service with tailscale_service resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/service.md

Defines a Tailscale Service named 'svc:my-service' with a comment, TCP port 443, and a tag. The name must begin with 'svc:' and ports support only 'tcp' protocol or 'do-not-validate'.

```terraform
resource "tailscale_service" "example" {
  name    = "svc:my-service"
  comment = "My service"
  ports   = ["tcp:443"]
  tags    = ["tag:web"]
}

```

--------------------------------

### Create a tailscale_federated_identity resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/federated_identity.md

Creates a federated identity resource with required fields (issuer, scopes, subject) and optional fields (description, tags, custom_claim_rules). The issuer must be a valid and publicly reachable https:// URL. Tags are mandatory if scopes include "devices:core" or "auth_keys".

```terraform
resource "tailscale_federated_identity" "example_federated_identity" {
  description = "Example federated identity"
  scopes      = ["auth_keys", "devices:core"]
  tags        = ["tag:test"]
  issuer      = "https://example.com"
  subject     = "example-sub-*"
  custom_claim_rules = {
    repo_name = "example-repo-name"
  }
}

```

--------------------------------

### Import tailscale_contacts resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/contacts.md

Imports an existing tailscale_contacts resource into Terraform state. The ID doesn't matter for the import command.

```shell
# ID doesn't matter.
terraform import tailscale_contacts.sample_contacts contacts
```

--------------------------------

### Query tailscale_devices with name_prefix and filter

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/devices.md

Defines a data source that retrieves devices from a tailnet, filtering by name prefix and device properties. The filter blocks use exact matches for values, such as isEphemeral and tags.

```terraform
data "tailscale_devices" "sample_devices" {
  name_prefix = "example-"

  filter {
    name = "isEphemeral"
    values = ["true"]
  }
  filter {
    name = "tags"
    values = ["tag:server", "tag:test"]
  }
}

```

--------------------------------

### Configure Tailscale provider with OAuth client

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/index.md

Configures the Tailscale provider with OAuth client credentials. The required_providers block specifies the provider source and version. Replace the placeholder version and credential values with your own.

```terraform
terraform {
  required_providers {
    tailscale = {
      source  = "tailscale/tailscale"
      version = "<version>"
    }
  }
}

provider "tailscale" {
  oauth_client_id      = "my_client_id"
  oauth_client_secret  = "my_client_secret"
  tailnet              = "example.com"
}

```

--------------------------------

### Import tailnet settings with terraform import

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/tailnet_settings.md

Imports an existing tailnet settings resource using the terraform import command. The ID is not used; the import ID is always 'tailnet_settings'.

```shell
# ID doesn't matter.
terraform import tailscale_tailnet_settings.sample_preferences tailnet_settings
```

--------------------------------

### Create a tailnet key with Terraform

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/tailnet_key.md

Defines a tailnet key resource with specific settings for reusability, ephemerality, authorization, and expiration.

```terraform
resource "tailscale_tailnet_key" "sample_key" {
  reusable      = true
  ephemeral     = false
  preauthorized = true
  expiry        = 3600
  description   = "Sample key"
}
```

--------------------------------

### tailscale_devices Data Source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/devices.md

The devices data source describes a list of devices in a tailnet. It supports optional filters to narrow down the list based on device properties and name prefix.

```APIDOC
## tailscale_devices (Data Source)

### Description
The devices data source describes a list of devices in a tailnet.

### Example Usage
terraform
data "tailscale_devices" "sample_devices" {
  name_prefix = "example-"

  filter {
    name = "isEphemeral"
    values = ["true"]
  }
  filter {
    name = "tags"
    values = ["tag:server", "tag:test"]
  }
}


### Schema

#### Optional
- `filter` (Block Set) - Filters the device list to elements devices whose fields match the provided values. (see [below for nested schema](#nestedblock--filter))
- `name_prefix` (String) - Filters the device list to elements whose name has the provided prefix

#### Read-Only
- `devices` (Block List) - The list of devices in the tailnet (see [below for nested schema](#nestedblock--devices))
- `id` (String) - The ID of this resource.

### Nested Schema for `filter`

Required:
- `name` (String) - The name must be a top-level device property, e.g. isEphemeral, tags, hostname, etc.
- `values` (Set of String) - The list of values to filter for. Values are matched as exact matches.

### Nested Schema for `devices`

Read-Only:
- `addresses` (List of String) - The list of device's IPs
- `authorized` (Boolean) - Whether the device is authorized to access the tailnet
- `blocks_incoming_connections` (Boolean) - Whether the device blocks incoming connections
- `client_version` (String) - The Tailscale client version running on the device
- `created` (String) - The creation time of the device
- `expires` (String) - The expiry time of the device's key
- `hostname` (String) - The short hostname of the device
- `id` (String) - The ID of this resource.
- `is_external` (Boolean) - Whether the device is marked as external
- `key_expiry_disabled` (Boolean) - Whether the device's key expiry is disabled
- `last_seen` (String) - The last seen time of the device
- `machine_key` (String) - The machine key of the device
- `name` (String) - The full name of the device (e.g. `hostname.domain.ts.net`)
- `node_id` (String) - The preferred indentifier for a device.
- `node_key` (String) - The node key of the device
- `os` (String) - The operating system of the device
- `tags` (Set of String) - The tags applied to the device
- `tailnet_lock_error` (String) - The tailnet lock error for the device, if any
- `tailnet_lock_key` (String) - The tailnet lock key for the device, if any
- `update_available` (Boolean) - Whether an update is available for the device
- `user` (String) - The user associated with the device
```

--------------------------------

### Create a tailscale_device_key resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/device_key.md

Defines a device_key resource that disables key expiry for a device. Uses the node_id attribute from a tailscale_device data source.

```terraform
data "tailscale_device" "example_device" {
  name = "device.example.com"
}

resource "tailscale_device_key" "example_key" {
  # Prefer the new, stable `node_id` attribute; the legacy `.id` field still works.
  device_id           = data.tailscale_device.example_device.node_id
  key_expiry_disabled = true
}
```

--------------------------------

### Look up Tailscale devices by name or hostname

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/device.md

Defines two tailscale_device data sources: one using the full device name and another using the short hostname. The wait_for attribute causes the provider to retry every second until the duration is reached.

```terraform
data "tailscale_device" "sample_device" {
  name     = "device1.example.ts.net"
  wait_for = "60s"
}

data "tailscale_device" "sample_device2" {
  hostname = "device2"
  wait_for = "60s"
}

```

--------------------------------

### Configure Tailscale provider with custom base_url

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Override the default API endpoint (`https://api.tailscale.com`) by setting `base_url` in the provider block, useful for custom coordination/control servers.

```terraform
provider "tailscale" {
  api_key = "tskey-api-..."
  base_url = "https://api.us.tailscale.com"
}
```

--------------------------------

### Configure Tailscale contacts resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/contacts.md

Creates a tailscale_contacts resource with account, support, and security email addresses. The resource is used to configure contact details for your Tailscale network.

```terraform
resource "tailscale_contacts" "sample_contacts" {
  account {
    email = "account@example.com"
  }

  support {
    email = "support@example.com"
  }

  security {
    email = "security@example.com"
  }
}
```

--------------------------------

### tailscale_4via6 Data Source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/4via6.md

This data source calculates an IPv6 prefix for a given site ID and IPv4 CIDR. It is used in Terraform configurations to obtain the mapped IPv6 address.

```APIDOC
## tailscale_4via6 (Data Source)

### Description
The 4via6 data source calculates an IPv6 prefix for a given site ID and IPv4 CIDR. See Tailscale documentation for 4via6 subnets for more details.

### Example Usage
```terraform
data "tailscale_4via6" "example" {
  site = 7
  cidr = "10.1.1.0/24"
}
```

### Schema

#### Required
- `cidr` (String) The IPv4 CIDR to map
- `site` (Number) Site ID (between 0 and 65535)

#### Read-Only
- `id` (String) The ID of this resource.
- `ipv6` (String) The 4via6 mapped address
```

--------------------------------

### Authenticate with API key

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/index.md

Authenticates using an API key by setting the api_key argument. API keys do not support granular access scopes.

```terraform
provider "tailscale" {
  api_key = "my_api_key"
  tailnet = "example.com"
}

```

--------------------------------

### Authenticate with OAuth client

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/index.md

Authenticates using an OAuth client by setting oauth_client_id and oauth_client_secret. This method is recommended for granular access scopes.

```terraform
provider "tailscale" {
  oauth_client_id     = "my_client_id"
  oauth_client_secret = "my_client_secret"
  tailnet             = "example.com"
}

```

--------------------------------

### Authenticate with automatic OIDC discovery

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/index.md

Authenticates using automatic OIDC token discovery in supported runtimes (GitHub Actions, AWS, GCP). Requires the runtime to have valid credentials and, for GitHub Actions, the workflow must declare permissions: id-token: write.

```terraform
provider "tailscale" {
  oauth_client_id = "my_client_id"
  audience        = "my_audience"
  tailnet         = "example.com"
}

```

--------------------------------

### Configure tailscale_webhook resource

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/webhook.md

Defines a webhook endpoint for specific network events using a designated provider type.

```terraform
resource "tailscale_webhook" "sample_webhook" {
  endpoint_url  = "https://example.com/webhook/endpoint"
  provider_type = "slack"
  subscriptions = ["nodeCreated", "userDeleted"]
}
```

--------------------------------

### tailscale_acl Data Source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/acl.md

Fetches the Tailscale policy file for a tailnet. The data source returns the entire policy file as HuJSON and JSON strings.

```APIDOC
## tailscale_acl (Data Source)

### Description
Returns the Tailscale policy file for a tailnet. This data source fetches the entire policy file, not just the ACLs section.

### Example Usage
```terraform
data "tailscale_acl" "example" {}
```

### Schema

#### Read-Only
- `hujson` (String) The contents of the policy file as a HuJSON string.
- `id` (String) The ID of this resource.
- `json` (String) The contents of the policy file as a JSON string.
```

--------------------------------

### Fetch tailscale_acl data source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/acl.md

Fetches the entire Tailscale policy file for the tailnet. The data source exposes the policy file contents as both HuJSON and JSON strings.

```hcl
data "tailscale_acl" "example" {}
```

--------------------------------

### Replace provider in Terraform state

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/README.md

Run this command to update an existing Terraform deployment that uses the original davidsbond/tailscale provider to the new tailscale/tailscale provider.

```shell
terraform state replace-provider registry.terraform.io/davidsbond/tailscale registry.terraform.io/tailscale/tailscale
```

--------------------------------

### Define tailscale_acl as JSON using jsonencode

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/acl.md

Creates a tailscale_acl resource with a policy in JSON format using the jsonencode function. Commas after the last array item and object members are preserved by jsonencode.

```terraform
resource "tailscale_acl" "as_json" {
  acl = jsonencode({
    grants = [
      {
        // Allow all users access to all ports.
        src = ["*"],
        dst = ["*"],
        ip  = ["*"],
      },
    ],
  })
}
```

--------------------------------

### tailscale_service Data Source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/service.md

This data source describes a single Service in a tailnet. It requires the service name and returns read-only attributes such as addresses, ports, tags, and comment.

```APIDOC
## tailscale_service (Data Source)

### Description
The Service data source describes a single Service in a tailnet. See https://tailscale.com/docs/features/tailscale-services for more information.

### Example Usage
terraform
data "tailscale_service" "example" {
  name = "svc:my-service"
}


### Schema

#### Required
- `name` (String) The name of the Service (e.g. `svc:my-service`).

#### Read-Only
- `addrs` (List of String) The IP addresses assigned to the Service.
- `comment` (String) A comment describing the Service.
- `id` (String) The Service name, e.g. 'svc:my-service'.
- `ports` (List of String) The ports that the Service listens on.
- `tags` (Set of String) The ACL tags applied to the Service.
```

--------------------------------

### Define tailscale_acl as HuJSON

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/acl.md

Creates a tailscale_acl resource with a policy in HuJSON format using a heredoc string. Comments are preserved when the policy is applied.

```terraform
resource "tailscale_acl" "as_hujson" {
  acl = <<EOF
  {
    // Comments in HuJSON policy are preserved when the policy is applied.
    "grants": [
      {
        // Allow all users access to all ports.
        "src": ["*"],
        "dst": ["*"],
        "ip": ["*"],
      },
    ],
  }
  EOF
}
```

--------------------------------

### Define tailscale_users data source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/users.md

Defines a data source that retrieves all users in the tailnet. The data source can be filtered using the optional `role` and `type` arguments.

```terraform
data "tailscale_users" "all-users" {}
```

--------------------------------

### Create AWS External ID and configure S3 logstream

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/resources/aws_external_id.md

Creates a Tailscale AWS External ID and uses it to configure a logstream to S3, along with the AWS IAM role and policies needed for Tailscale to assume the role. The external ID and Tailscale's AWS account ID are referenced in the trust policy condition.

```terraform
resource "tailscale_aws_external_id" "prod" {}

resource "tailscale_logstream_configuration" "configuration_logs" {
  log_type               = "configuration"
  destination_type       = "s3"
  s3_bucket              = aws_s3_bucket.tailscale_logs.id
  s3_region              = "us-west-2"
  s3_authentication_type = "rolearn"
  s3_role_arn            = aws_iam_role.logs_writer.arn
  s3_external_id         = tailscale_aws_external_id.prod.external_id
}

resource "aws_iam_role" "logs_writer" {
  name               = "logs-writer"
  assume_role_policy = data.aws_iam_policy_document.tailscale_assume_role.json
}

resource "aws_iam_role_policy" "logs_writer" {
  role   = aws_iam_role.logs_writer.id
  policy = data.aws_iam_policy_document.logs_writer.json
}

data "aws_iam_policy_document" "tailscale_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [tailscale_aws_external_id.prod.tailscale_aws_account_id]
    }
    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [tailscale_aws_external_id.prod.external_id]
    }
  }
}

data "aws_iam_policy_document" "logs_writer" {
  statement {
    effect = "Allow"
    actions = ["s3:*"]
    resources = [
      "arn:aws:s3:::example-bucket",
      "arn:aws:s3:::example-bucket/*"
    ]
  }
}
```

--------------------------------

### tailscale_user Data Source

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/data-sources/user.md

Retrieves information about a single user in a tailnet. Use either the id or login_name attribute to specify the user.

```APIDOC
## tailscale_user (Data Source)

### Description
The user data source describes a single user in a tailnet.

### Example Usage
```terraform
data "tailscale_user" "32571345" {
  id = 32571345
}
```

### Schema

#### Optional
- `id` (String) The unique identifier for the user.
- `login_name` (String) The emailish login name of the user.

#### Read-Only
- `created` (String) The time the user joined their tailnet.
- `currently_connected` (Boolean) true when the user has a node currently connected to the control server.
- `device_count` (Number) Number of devices the user owns.
- `display_name` (String) The name of the user.
- `last_seen` (String) The later of either: a) The last time any of the user's nodes were connected to the network or b) The last time the user authenticated to any tailscale service, including the admin panel.
- `profile_pic_url` (String) The profile pic URL for the user.
- `role` (String) The role of the user.
- `status` (String) The status of the user.
- `tailnet_id` (String) The tailnet that owns the user.
- `type` (String) The type of relation this user has to the tailnet associated with the request.
```

--------------------------------

### Authenticate with federated identity

Source: https://github.com/tailscale/terraform-provider-tailscale/blob/main/docs/index.md

Authenticates using workload identity federation by setting oauth_client_id and identity_token. The identity_token must be a JWT from a compatible issuer.

```terraform
provider "tailscale" {
  oauth_client_id = "my_client_id"
  identity_token  = "my_identity_token"
  tailnet         = "example.com"
}

```
Tokens:
Raw