Everything you need to know about using Terraform or OpenTofu with Slack

Most DevOps teams already live in Slack, so it makes sense to push operational events there too. Whether that's an alarm firing in New Relic or a Terraform apply that just failed, Slack is where people will see it. This post walks through the different ways Slack and Terraform fit together.

The general idea is ChatOps: using a chat tool like Slack or MS Teams to run operational work through external integrations. Instead of hunting for status in five different consoles, the relevant information lands in a channel where the team can read it and respond together.

One of the most common cases is wiring Slack up to Terraform so you get a message when specific run events happen. Automated notifications based on Terraform runs keep everyone in the loop and tend to speed up deployments.

Why Send Terraform Events to Slack?

Here are a few reasons why you may want to integrate Terraform with Slack:

1. Reduce Context Switching - If your development teams already work in Slack to review Terraform code and pull requests, then why change where they are working? Slack notifications give you real-time updates on key events during the Terraform provisioning process, so everyone hears about changes, successes, or issues right away.
2. Reduce Noise - Slack notifications are only good if they are useful and you are alerted to take action when actually needed. Most teams will likely want a Slack notification when a Terraform apply fails, but not for every Terraform event.
3. Approving or Denying Terraform Applies - This is similar to context switching, but being able to approve a Terraform apply directly from Slack makes the team more efficient. When you can get a notification that an approval is needed, read the plan output, and act on it all in one place, you cut down on context switching and the whole team can see what's going on. Not all methods we talk about below give you the ability to do an approval directly from Slack, but the Scalr option does.

Setting up a Slack Webhook

If you are setting up an integration with Slack that does not use a supported Slack app, you'll likely need to create your own app in Slack. To do that, you'll need to go to api.slack.com, click on "Your Apps", and then create a new app from scratch. For the features and functionality, you'll likely only need to enable "Incoming Webhooks", which will provide you with a webhook URL and a sample curl request:

curl -X POST -H 'Content-type: application/json' --data '{"text":"Hello, World!"}' YOUR_WEBHOOK_URL_HERE

This webhook URL is what your custom integrations will call to create the Slack message when triggered.

Two Ways to Integrate Terraform with Slack

Use Terraform Local Exec

The most basic way to integrate Terraform with Slack, without a third party tool, would be to use the Terraform local-exec functionality. Using the local-exec option in Terraform allows you to call the Slack webhook URL from within your Terraform configuration to send a message.

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "curl -X POST -H 'Content-type: application/json' --data "{'text':'The run has completed'}" YOUR_WEBHOOK_URL_HERE"
  }
}

This works, but it's not a good fit at scale, since the code has to be added to every Terraform workspace or configuration file that runs. It's better suited to a one-off use case.

See more on creating Slack webhooks here.

The Scalr Integration with Slack

The Scalr app in the Slack app directory sends a Slack notification when Terraform run events happen and allows users to approve runs directly from Slack. This scales well because you set it up outside of the Terraform configuration files. A Scalr admin creates the integration with Slack and defines which Scalr environments and workspaces should trigger a Slack message to a specific Slack channel. Since the setup lives outside the Terraform configuration files, end users don't have to remember to do it when they set up a Terraform workspace.

Scalr also provides more granularity by allowing users to choose which Terraform run events trigger a Slack notification:

Run Mode:

• All Runs - The Slack notifications will be sent for a Terraform plan or a Terraform apply run.
• Plan & Apply Runs - The Slack notifications will be sent for a Terraform apply run.
• Plan Only Runs - The Slack notifications will be sent for a Terraform plan run.

Events:

• Approval Required - An approval from a user is required before the Terraform apply can run.
• Run Finished Successfully - The Terraform plan or Terraform apply finished successfully.
• Run Errored - The Terraform plan or Terraform apply resulted in an error.
• Drift Detected - Scalr executed a drift run and found that the workspace had drift.

Lastly, the Scalr app for Slack also allows for approvals directly from Slack. Slack users will be sent all of the information they need to make a decision about whether or not they want to approve the Terraform run:

• Terraform plan output
• Open Policy Agent results
• Cost estimation

Once the Slack user is ready to approve, they can give an approval reason which is then sent back to Scalr and can be seen prior to the Terraform apply event happening. Actions triggered from Slack still require the underlying Scalr IAM permission for that action (for example, runs:create to start a plan or apply); Slack does not bypass Scalr's permission model. The authorization flow simply links your Slack identity to your Scalr identity so Scalr can check that you hold the right permissions before executing the action.

See more in the Scalr documentation here.

Other Slack - Terraform Relevant Information

Is there a Slack Terraform Provider?

The main focus of this blog was around integrating Slack notifications with Terraform, but you can also manage Slack itself with Terraform. Slack doesn't maintain its own Terraform provider, but there's a trusted Terraform provider for Slack resources. At the time of writing this blog, this Terraform provider for Slack has over 1.2M downloads with 13 contributors based on information pulled from library.tf.

This provider gives you the ability to manage the slack_usergroup and slack_conversation resources.

What Slack Terraform Modules Exist?

While there are not any modules to actually manage Slack resources, the most popular module involving Slack is the "terraform aws notify slack" module, which is used to integrate AWS SNS, specifically an SNS topic, with Slack channels.

At the time of this blog, the module has been downloaded over 2M times and has 43 contributors according to library.tf.

Summary

There are several ways to use Terraform and Slack together. You can manage Slack itself with the community Slack provider, connect an SNS topic to a Slack channel through Terraform, or use a platform like Scalr to push Terraform run events into a channel. For a lot of DevOps teams working with infrastructure as code, Slack has become the place where this kind of operational work happens.