> ## Documentation Index
> Fetch the complete documentation index at: https://clumio.reclear.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage protection with Terraform

> Manage Clumio connections, policies, protection groups and access controls as code.

The Clumio provider manages Clumio resources through the REST API. Companion modules provision the
AWS or Google Cloud resources that Clumio needs to protect an account or project.

<Note>
  **Prototype note.** These examples match the public provider documentation for version 0.24.0 and
  have not been validated against a live Clumio tenant.
</Note>

## Install

```hcl theme={null}
terraform {
  required_providers {
    clumio = {
      source  = "clumio-code/clumio"
      version = "~> 0.24.0"
    }
  }
}

provider "clumio" {}
```

## Configure

The provider reads its token and API base URL from environment variables:

```bash theme={null}
export CLUMIO_API_TOKEN="<your_api_token>"
export CLUMIO_API_BASE_URL="https://us-west-2.api.clumio.com"
```

You can also set `clumio_api_token` and `clumio_api_base_url` in the provider block. Use the base URL
listed for the control plane that issued the token. See
[Authentication](/developer-tools/authentication).

## Connect an AWS account

Create the Clumio connection, then pass its outputs to the AWS bootstrap module:

```hcl theme={null}
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

resource "clumio_aws_connection" "production" {
  account_native_id = data.aws_caller_identity.current.account_id
  aws_region        = data.aws_region.current.region
  description       = "Production workloads"
}

module "clumio_protect" {
  providers = {
    clumio = clumio
    aws    = aws
  }

  source                = "clumio-code/aws-template/clumio"
  clumio_token          = clumio_aws_connection.production.token
  role_external_id      = clumio_aws_connection.production.role_external_id
  aws_account_id        = clumio_aws_connection.production.account_native_id
  aws_region            = clumio_aws_connection.production.aws_region
  clumio_aws_account_id = clumio_aws_connection.production.clumio_aws_account_id

  is_ebs_enabled      = true
  is_rds_enabled      = true
  is_dynamodb_enabled = true
  is_s3_enabled       = true
}
```

## Define and assign S3 protection

The provider models the protection group, policy and assignment as separate resources:

```hcl theme={null}
resource "clumio_protection_group" "daily" {
  name = "daily-backup"

  bucket_rule = jsonencode({
    aws_tag = {
      "$eq" = {
        key   = "backup"
        value = "daily"
      }
    }
  })

  object_filter {
    storage_classes = ["S3 Standard", "S3 Standard-IA"]
  }
}

resource "clumio_policy" "daily" {
  name = "S3 daily"

  operations {
    action_setting = "immediate"
    type           = "protection_group_backup"

    slas {
      retention_duration {
        unit  = "months"
        value = 3
      }
      rpo_frequency {
        unit  = "days"
        value = 1
      }
    }

    advanced_settings {
      protection_group_backup {
        backup_tier = "cold"
      }
    }
  }
}

resource "clumio_policy_assignment" "daily" {
  entity_id   = clumio_protection_group.daily.id
  entity_type = "protection_group"
  policy_id   = clumio_policy.daily.id
}
```

Run `terraform plan` and review the proposed resources before applying them.

## Bootstrap modules

| Module                                                                                                              | Purpose                                                             |
| ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| [`clumio-code/aws-template/clumio`](https://registry.terraform.io/modules/clumio-code/aws-template/clumio/latest)   | Connect AWS accounts and enable selected data sources               |
| [`clumio-code/gcp-template/clumio`](https://registry.terraform.io/modules/clumio-code/gcp-template/clumio/latest)   | Connect GCP projects and enable GCS protection                      |
| [`clumio-code/byok-template/clumio`](https://registry.terraform.io/modules/clumio-code/byok-template/clumio/latest) | Provision AWS resources for customer-managed backup encryption keys |

<CardGroup cols={2}>
  <Card title="Provider guide" icon="book" href="https://registry.terraform.io/providers/clumio-code/clumio/latest/docs/guides/getting_started" arrow>
    Clumio's current getting-started guide and complete examples.
  </Card>

  <Card title="Provider source" icon="github" href="https://github.com/clumio-code/terraform-provider-clumio" arrow>
    Source code, issues and release notes.
  </Card>
</CardGroup>