--- title: "How to Run Terraform in Bitbucket Pipelines" url: https://daily.dev/posts/how-to-run-terraform-in-bitbucket-pipelines-4tlbvbqih source_url: https://spacelift.io/blog/terraform-bitbucket type: article source: "Spacelift" published: 2026-08-07T13:53:25.607Z updated: 2026-08-07T13:53:57.160Z tags: ["aws", "authentication", "terraform", "iac"] reading_time: 18 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Run Terraform in Bitbucket Pipelines **[Spacelift](https://daily.dev/sources/spacelift)** · 18 min read · 0 upvotes · 0 comments ## Summary Step-by-step walkthrough for running Terraform in Bitbucket Pipelines using a single `bitbucket-pipelines.yml` file. Covers enabling pipelines, defining reusable YAML-anchor-based steps for fmt/validate/plan/apply, configuring an AWS S3 remote backend via repository variables, and setting up OIDC workload identity federation to authenticate to AWS without long-lived credentials. Includes a complete final pipeline file, best practices (concurrency groups, deployment environments, secrets management), and a comparison of alternatives like GitHub Actions, GitLab CI/CD, Spacelift, and HCP Terraform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I authenticate to AWS from Bitbucket Pipelines without storing access keys? Use OIDC workload identity federation: register Bitbucket as an IAM OIDC identity provider in AWS, create an IAM role with a trust policy scoped to your repository UUID, then set `oidc: true` on the pipeline step. Bitbucket injects a short-lived token into `BITBUCKET_STEP_OIDC_TOKEN`, which you write to a file and reference via `AWS_WEB_IDENTITY_TOKEN_FILE` so the AWS SDK exchanges it for temporary credentials automatically. _Teams migrating Terraform pipelines away from static credentials track OIDC patterns like this on daily.dev._ ### How do I pass a Terraform plan file between the plan and apply steps in Bitbucket Pipelines? Declare the plan file as an artifact on the plan step using the `artifacts` key. In the step definition, add `artifacts: [tfplan]` after running `terraform plan -input=false -out=tfplan`. Bitbucket Pipelines automatically makes declared artifacts available to subsequent steps in the same pipeline, so the apply step can run `terraform apply -input=false -auto-approve tfplan` against the exact plan produced earlier. _Developers building safe plan-then-apply pipelines find workflow patterns like this on daily.dev._ ### How much does Bitbucket Pipelines cost for Terraform CI/CD and what are the free tier limits? The free tier provides 50 build minutes per workspace per month, which is enough for light experimentation but insufficient for sustained Terraform use. The Standard paid plan includes 2,500 minutes and Premium includes 3,500 minutes. Additional minutes beyond the plan allocation are sold at approximately $10 per 1,000 minutes. _Engineers evaluating CI/CD costs for infrastructure automation compare options like these on daily.dev._ ## Similar posts on daily.dev - [Split your pipelines workflows across multiple files](https://daily.dev/posts/split-your-pipelines-workflows-across-multiple-files-oymmal3kg) · Atlassian · 1 upvotes · 0 comments - [How Terraform Works](https://daily.dev/posts/how-terraform-works-m4paeflla) · System Design Codex · 35 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#authentication](https://daily.dev/tags/authentication), [#terraform](https://daily.dev/tags/terraform), [#iac](https://daily.dev/tags/iac) [View this post on daily.dev](https://daily.dev/posts/how-to-run-terraform-in-bitbucket-pipelines-4tlbvbqih)