---
title: Terraform Statefile Integration
description: >-
  Read Terraform state files from your cloud storage to build an accurate
  cloud-to-code mapping.
breadcrumbs: Docs > Integrations > Terraform Statefile Integration
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Terraform Statefile Integration
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Connect the Terraform Statefile integration to Datadog to:

- Automatically map cloud resources back to the Terraform modules, repositories, and teams that created them.
- Attribute cost, security findings, and other telemetry to the code that owns the underlying resources.
- Surface infrastructure-as-code context on pull requests that change resources Datadog is already monitoring.

A Terraform **state file** is the record Terraform keeps of the infrastructure it manages, including the identifiers, attributes, and module structure that tie each resource back to your code. Datadog reads your state files from cloud storage and uses them to build this cloud-to-code mapping, with no changes required to your Terraform workflow.

Datadog processes your state files to build the mapping and deletes them shortly after ingestion. State files are not retained.

## Setup{% #setup %}

### Configuration{% #configuration %}

1. From the Terraform Statefile integration tile, click **Install**.

1. Connect an AWS account: choose one already connected to Datadog, or connect a new one using CloudFormation, Terraform, or manual IAM setup.

1. Connect a source code provider (GitHub, GitLab, Azure DevOps, or Bitbucket), if you haven't already. This is required to build the cloud-to-code mapping.

1. Select the S3 buckets that hold your Terraform state files.

1. Grant Datadog scoped read access to those buckets, using whichever method fits your workflow:

   - **CloudFormation**: Apply a one-click stack that grants access to your existing Datadog AWS integration role.
   - **Terraform**: Apply a generated `aws_iam_role_policy` resource as code.
   - **Manual**: Attach the generated IAM policy yourself.

Access is scoped to `s3:GetObject` and `s3:ListBucket` on the buckets you selected. Nothing else in your AWS account is touched.

### Validation{% #validation %}

Return to the integration tile's **Configure** tab at any time to view ingestion status per AWS account and region, or to remove a tracked bucket. Removing a bucket stops ingestion and deregisters the sync; it does not change anything in your AWS account.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

The Terraform Statefile integration does not include any metrics.

### Service Checks{% #service-checks %}

The Terraform Statefile integration does not include any service checks.

### Events{% #events %}

The Terraform Statefile integration does not include any events.

## Support{% #support %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).