ChangeVault Docs

Automatically log infrastructure changes to ChangeVault after every Terraform apply.

Overview

Use a null_resource with a local-exec provisioner to call the ChangeVault API after each terraform apply. Because triggers = { always_run = timestamp() } is set, the resource runs on every apply.

Setup

1. Add the API key variable

# variables.tf
variable "changevault_api_key" {
  description = "ChangeVault API key"
  type        = string
  sensitive   = true
}

Store the value in terraform.tfvars (and add it to .gitignore) or pass it via the -var flag or a secrets manager.

# terraform.tfvars
changevault_api_key = "cvk_prod_••••••••"

2. Add the logging resource

resource "null_resource" "changevault_log" {
  triggers = {
    always_run = timestamp()
  }

  provisioner "local-exec" {
    command = <<-EOT
      curl -sS -X POST https://app.changevault.dev/api/changes \
        -H "x-api-key: ${var.changevault_api_key}" \
        -H "Content-Type: application/json" \
        -d '{
          "title": "Terraform apply: ${terraform.workspace}",
          "risk_level": "low",
          "status": "completed",
          "tags": ["terraform", "${terraform.workspace}"]
        }'
    EOT
  }
}

Full example

terraform {
  required_providers {
    null = {
      source  = "hashicorp/null"
      version = "~> 3.0"
    }
  }
}

variable "changevault_api_key" {
  description = "ChangeVault API key"
  type        = string
  sensitive   = true
}

variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "prod"
}

# ... your actual infrastructure resources ...

resource "null_resource" "changevault_log" {
  triggers = {
    always_run = timestamp()
  }

  provisioner "local-exec" {
    command = <<-EOT
      curl -sS -X POST https://app.changevault.dev/api/changes \
        -H "x-api-key: ${var.changevault_api_key}" \
        -H "Content-Type: application/json" \
        -d '{
          "title": "Terraform apply: ${var.environment}",
          "description": "Workspace: ${terraform.workspace}",
          "risk_level": "medium",
          "status": "completed",
          "tags": ["terraform", "${var.environment}"]
        }'
    EOT
  }

  depends_on = [
    # list your main resources here so logging runs last
  ]
}

Tips

Add a depends_on list referencing your main resources to ensure logging runs after all resources are created or updated.
Use terraform.workspace to automatically include the workspace name (e.g. prod, staging).
Store changevault_api_key in Terraform Cloud workspace variables or HashiCorp Vault rather than in terraform.tfvars.

API access requires the Pro plan or higher.