Skip to content
Infragr.amDocs

Bundle schema

The bundle is the only thing that leaves your runner. Its shape is fixed by a JSON Schema (draft 2020-12):

Every object in it sets additionalProperties: false. The server enforces the same contract, so a bundle that carries any field not described here is refused.

Example

Section titled “Example”

A trimmed bundle for a VPC with one private subnet and an instance:

bundle.json
{
  "schema_version": 3,
  "terraform_version": "1.9.8",
  "terraform_format_version": "1.2",
  "resources": [
    {
      "address": "aws_instance.web",
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "actions": ["create"],
      "values": {
        "instance_type": "t3.small",
        "tags": { "Name": "web" }
      }
    },
    {
      "address": "module.vpc.aws_subnet.private[0]",
      "module_address": "module.vpc",
      "mode": "managed",
      "type": "aws_subnet",
      "name": "private",
      "actions": ["no-op"],
      "values": { "cidr_block": "10.0.101.0/24", "availability_zone": "eu-west-1a" }
    }
  ],
  "references": [
    {
      "source": "aws_instance.web",
      "via": "subnet_id",
      "block_index": -1,
      "ref": "local.app_subnet"
    }
  ],
  "symbols": {
    "local.app_subnet": ["module.vpc.private_subnets"],
    "module.vpc.private_subnets": ["module.vpc.aws_subnet.private"]
  },
  "sanitization": {
    "profile": "standard",
    "sensitive_paths_removed": 6,
    "denied_keys_removed": 1
  }
}

Top level

Section titled “Top level”
Field Type Required Description
schema_version 3 ✓ The bundle version. Infragr.am accepts exactly one version at a time.
terraform_version string Terraform version that produced the plan.
terraform_format_version string Plan JSON format version.
resources array ✓ One entry per resource instance in the plan. At most 20,000.
references array Resource-to-resource references. At most 100,000.
symbols object What locals and module inputs and outputs point to.
sanitization object ✓ What the collector removed.

resources[]

Section titled “resources[]”
Field Type Description
address string Full address, including module path and index, e.g. module.vpc.aws_subnet.private[0].
module_address string Enclosing module, empty for the root module.
mode string managed or data.
type string Resource type, e.g. aws_subnet.
name string Name in configuration.
provider_name string Provider source address.
actions string[] Planned actions: create, update, delete, no-op, read.
values object Planned attribute values after sanitization. Unknown-until-apply values are absent.

references[]

Section titled “references[]”

Each entry says that one resource’s configuration refers to something. References are unresolved: they are written as the configuration writes them, and Infragr.am resolves them when rendering, including which instance of a counted resource is meant.

Field Type Description
source string The referring resource, without index.
via string The attribute holding the reference, e.g. subnet_id.
block_type string Enclosing nested block, e.g. ingress or route. Empty at the top level.
block_index integer Position of that block. -1 for a top-level attribute, so 0 always means “the first block”.
ref string What is referenced: a resource address (with an index when the configuration writes one), or a symbol that keys into symbols.

symbols

Section titled “symbols”

A map from a module-qualified name to the addresses it references:

  • a local: local.app_subnet, or module.vpc.local.x inside a module;
  • a module input variable: module.vpc.var.subnets;
  • a module output: module.vpc.private_subnets.

Together, these carry a reference across a module boundary. Values never appear. A symbol that holds a literal has no references and is left out, and so is a symbol that never reaches a resource.

sanitization

Section titled “sanitization”
Field Type Description
profile "standard" The rule set applied. standard is the only profile today.
sensitive_paths_removed integer Values removed because Terraform marked them sensitive.
denied_keys_removed integer Attributes removed because their name looks like a credential.

Versioning

Section titled “Versioning”
Version Change
3 (current) Carries references unresolved, plus symbols for locals and module wiring. Connections through local.* and across modules now survive.
2 Carried resolved relationships, with the enclosing nested block, so routes pair with their gateways. No longer accepted.