Install modules with terraform init

Every Terraform/OpenTofu module on IaC Bazaar is installable directly by terraform and tofu via the standard module registry protocol - no tarball downloads, no vendoring. Reference the module in a source address, pin a version, run init. Ansible roles are not served here (the protocol is Terraform/OpenTofu-only); download those from your account.

The module address

www.iac-bazaar.com/iac-bazaar/<slug>/<system>

• www.iac-bazaar.comThe registry host - always the bare hostname, no https://.
• iac-bazaarThe namespace - always literally this.
• <slug>The module slug, exactly as it appears in the catalog URL (e.g. aws-s3-bucket).
• <system>The module's cloud/provider key as shown in the catalog (e.g. aws, azure, gcp). Any of the module's target clouds is accepted, case-insensitive.

Quick start - free modules

Free modules need no credentials - anonymous download is allowed. Add the module block, pin the version, init:

module "s3_bucket" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-s3-bucket/aws"
  version = "1.0.0"

  bucket_name = "my-hardened-bucket"
}

terraform init   # or: tofu init

Paid modules

Three steps, once per machine:

1. Purchase the module (or hold a subscription that covers it) - the registry enforces the same entitlements as the download button.
2. Create a registry token at /account/tokens. Tokens look like iacb_<40 hex> and are shown once - only a hash is stored, so copy it when it appears.
3. Configure credentials - either of the two options below. Both work for terraform and tofu.

Option A - CLI config file

Add a credentials block to ~/.terraformrc (Windows: %APPDATA%/terraform.rc; OpenTofu: ~/.tofurc):

credentials "www.iac-bazaar.com" {
  token = "iacb_..."
}

Option B - environment variable

Terraform and tofu both read a per-host token from an env var named after the hostname, where dots become underscores and dashes become double underscores - so www.iac-bazaar.com becomes TF_TOKEN_www_iac__bazaar_com:

export TF_TOKEN_www_iac__bazaar_com="iacb_..."

In CI

The env-var form is made for CI - store the token as a secret and expose it to the job. GitHub Actions, for example:

jobs:
  plan:
    runs-on: ubuntu-latest
    env:
      TF_TOKEN_www_iac__bazaar_com: ${{ secrets.IAC_BAZAAR_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - run: terraform init
      - run: terraform plan

Behaviour notes

• Versions — pin version to a published version of the module (the module page shows the current one). The registry serves exactly the published versions, nothing else.
• Updates window — purchases include 12 months of updates. After that, the exact version you bought stays downloadable; newer versions return 403.
• 401 vs 403 — 401 means the token is missing or invalid; 403 means the account has no entitlement for that module.
• Verification — registry installs are the same signed tarballs as direct downloads: every one ships its embedded VERIFICATION.json, and the public sha256 + cosign signature endpoints still apply. See /verify and the API docs.
• Under the hood — the standard Terraform module registry protocol; service discovery lives at /.well-known/terraform.json.