Resource Orchestration Service (ROS) allows you to use Terraform templates to manage resources. You can use Terraform templates to orchestrate Alibaba Cloud, AWS, and Azure resources, specify resource parameters, and configure dependencies between resources.

Template structure

ROSTemplateFormatVersion: '2015-09-01'
Transform: 'Aliyun::Terraform-v0.15'
Workspace: |-
    module "my_vpc" {
      source      = "./modules/vpc"
    resource "alicloud_vswitch" "vsw" {
      vpc_id            = "${module.my_vpc.vpc_id}"
      cidr_block        = ""
      availability_zone = "cn-shanghai-b"
    output "vsw_id" {
      value = "${}"
  modules/vpc/ |-
    resource "alicloud_vpc" "vpc" {
      name       = "tf_test"
      cidr_block = ""
    output "vpc_id" {
      value = "${}"

Template description

The outermost layer of a Terraform template can contain only the ROSTemplateFormatVersion, Transform, Workspace, and Description parameters. The following table describes these parameters.

Parameter Required Description
ROSTemplateFormatVersion Yes The template version supported by ROS. Set the value to 2015-09-01.
Transform Yes The Terraform version supported by ROS. Valid values:
  • Aliyun::Terraform-v0.12
  • Aliyun::Terraform-v0.15
  • When a new version of Terraform is released, ROS includes the version number as a Transform parameter value.
  • Changes to Terraform patch versions do not affect the values of the Transform parameter.
  • You can specify the Transform parameter when you create a Terraform template. However, you cannot change the value of the Transform parameter after the Terraform template is created.
Workspace Yes The key-value pairs of all modules in a Terraform workspace. In a key-value pair, the key is the file path of a module, and the value is the content of the module file.
Description No The template description.

For more information about Terraform template syntax, see Terraform Language Documentation.

Template constraints

The Workspace parameter contains the paths and contents of files within the following constraints:

  • The Workspace parameter cannot be empty. It can contain up to 50 key-value pairs.
  • File path
    • A file path can be up to 1,024 character in length, and the name of a folder or file in a path can be up to 255 characters in length.
    • A file path must be a relative path. It cannot start with a forward slash (/) and must end with .tf.
    • A file path can contain letters, digits, and special characters. Special characters include ! "#$%&'()*+,-./:;<=>?@ [ \ ] ^ _ ` { | } ~.
    • The maximum depth of a path is 5. For example, the depth of is 1, and the depth of modules/vpc/ is 3.
    • The value between two forward slashes (/) cannot be empty, .,or ...
  • File content
    • Provisioners and backends are not allowed. For more information, see Provisioners and Backends.
    • Module sources are allowed, but can only be a relative reference in a workspace. For more information, see Module Sources. A module source must start with ./. The value between two forward slashes (/) cannot be empty, .,or ...
    • Providers are allowed, but a provider can be set only to alicloud, aws, or azurerm. For more information, see Providers.
    • Resources and data sources that are contained in the alicloud, aws, and azurerm providers are allowed. The terraform_remote_state data source is not allowed. For more information, see terraform_remote_state.
    • The abspath, dirname, pathexpand, file, fileexists, fileset, filebase64, and templatefile functions are not allowed.