Terraform Provider for S2

Terraform provider for managing S2 basins, streams, and access tokens.

Getting started

1. Install Terraform (version >= 1.5.0).

2. Generate an S2 access token from the S2 dashboard.

3. Set provider credentials:

   export S2_ACCESS_TOKEN="<your access token>"
   # Optional:
   # export S2_ACCOUNT_ENDPOINT="aws.s2.dev"

4. Configure the provider:

   terraform {
     required_providers {
       s2 = {
         source = "s2-streamstore/s2"
       }
     }
   }
   
   provider "s2" {}

5. Create resources:

   resource "s2_basin" "example" {
     name = "my-example-basin"
   }
   
   resource "s2_stream" "events" {
     basin = s2_basin.example.name
     name  = "events"
   }

6. Apply:

   terraform init
   terraform apply

Resources and data sources

Resources:

• s2_basin - docs/resources/basin.md
• s2_stream - docs/resources/stream.md
• s2_access_token - docs/resources/access_token.md

Data sources:

• s2_basin - docs/data-sources/basin.md
• s2_stream - docs/data-sources/stream.md

Examples

The examples directory includes ready-to-run configurations:

Example	Description
examples/provider/main.tf	Provider configuration
examples/resources/s2_basin/resource.tf	Create a basin
examples/resources/s2_stream/resource.tf	Create a stream
examples/resources/s2_access_token/resource.tf	Issue an access token
examples/data-sources/s2_basin/data-source.tf	Read basin metadata
examples/data-sources/s2_stream/data-source.tf	Read stream metadata
examples/full-workflow/main.tf	End-to-end basin, stream, token, and data-source workflow

Development

Requirements:

• Go 1.24+
• Terraform >= 1.5.0

Common commands:

go mod download
go build ./...
go test ./...

Using make targets:

make build
make install

Regenerate provider docs (requires tfplugindocs):

tfplugindocs generate --provider-name s2 --tf-version 1.14.6

Run acceptance tests:

export S2_ACCESS_TOKEN="<your access token>"
make testacc

Run acceptance tests against an already-running local s2-lite:

make testacc-lite

To start and stop s2-lite automatically with the s2 CLI binary:

make testacc-lite-managed

You can override defaults if needed (port, URLs, timeout, binary path):

make testacc-lite-managed S2_LITE_BIN=s2 S2_LITE_PORT=18080 S2_LITE_WAIT_SECS=300

Note: s2-lite currently does not implement /access-tokens, so access-token acceptance tests are skipped for Lite acceptance targets.

Feedback

Please use GitHub Issues to report bugs, request features, or share feedback.

Contributing

Pull requests are welcome. If possible, open an issue first to discuss larger changes before submitting a PR.

Reach out to us

Join our Discord server or email hi@s2.dev.