> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuon.co/llms.txt
> Use this file to discover all available pages before exploring further.

# 041 - Token-authenticated Terraform stack module

> Provision AWS install stacks from the public nuonco/stack/aws Terraform module with an API token — no tfvars files to hand off.

*August 24, 2026*

## Terraform stack modules

<Note>This feature is behind a feature flag. Reach out to our team if you would like it enabled for your organization.</Note>

Terraform has proven to be a powerful way to manage an install stack, but we felt the experience could be improved upon.
There were 3 key areas we wanted to improve on:

* Obviate the need for your customer to manage a large, complex `tfvars` file.
* Stop relying on the phone home ID to secure the phone home request.
* Make it easier for your customer to apply updates.

To that end, we are publishing new stack modules to the Terraform registry.
These modules read the stack config directly from the control plane, so your customer no longer needs to paste in a `tfvars` file.
Each stack is given a service account that can authenticate using a token.
The `phone_home_id` no longer needs to be updated on every reprovision.
Additionally, your customer can more easily control versioning via semver.

```hcl theme={null}
provider "stack" {}

module "aws_stack" {
  source  = "nuonco/stack/aws"
  version = "~> 0.2"

  install_id = "<install-id>"

  inputs = {
    instance_type = "t3a.medium"
  }

  secrets = {
    license_key = { value = var.license_key }
  }
}
```

Once installed, your customers simply need to run `terraform apply` to install a new version of the stack.
If new inputs or secrets are required, an actionable terraform error will be displayed.
For example, if a new app version requires `a_new_input`, the customer will see this error until they set it.

```sh theme={null}
╷
│ Error: Resource precondition failed
│
│   on .terraform/modules/aws_stack/phone_home.tf line 100, in resource "stack_phone_home" "this":
│  100:       condition     = length(local.missing_required_inputs) == 0
│     ├────────────────
│     │ local.missing_required_inputs is tuple with 1 element
│
│ the app requires a value for these inputs: a_new_input.
╵
```

To manage updates to the stack module itself, recommend setting a semver constraint on the minor version.
That way your customer only needs to run `terraform init -upgrade` to receive patch updates.
Minor and major versions can be received by updating the module version.

```hcl theme={null}
module "aws_stack" {
  source  = "nuonco/stack/aws"
  version = "~> 0.2" // [!code --]
  version = "~> 0.3" // [!code ++]

  install_id = "<install-id>"

  inputs = {
    instance_type = "t3a.medium"
  }

  secrets = {
    license_key = { value = var.license_key }
  }
}
```

For more details, see the [Provision Stack with a Terraform Module](/guides/provision-stacks-with-terraform-module) guide.