diff --git a/stdlib/terraform/terraform.cue b/stdlib/terraform/terraform.cue
new file mode 100644
index 00000000..d2d32c53
--- /dev/null
+++ b/stdlib/terraform/terraform.cue
@@ -0,0 +1,65 @@
+package terraform
+
+import (
+	"encoding/json"
+
+	"dagger.io/dagger"
+	"dagger.io/dagger/op"
+)
+
+#Configuration: {
+	version: string | *"latest"
+
+	source: dagger.#Artifact
+
+	tfvars?: [string]: _
+
+	env: [string]: string
+
+	state: #up: [
+		op.#FetchContainer & {
+			ref: "hashicorp/terraform:\(version)"
+		},
+
+		op.#Copy & {
+			from: source
+			dest: "/src"
+		},
+
+		if tfvars != _|_ {
+			op.#WriteFile & {
+				dest:    "/src/terraform.tfvars.json"
+				content: json.Marshal(tfvars)
+			}
+		},
+
+		op.#Exec & {
+			args: ["terraform", "init"]
+			dir:   "/src"
+			"env": env
+		},
+
+		op.#Exec & {
+			args: ["terraform", "apply", "-auto-approve"]
+			always: true
+			dir:    "/src"
+			"env":  env
+		},
+	]
+
+	output: {
+		#up: [
+			op.#Load & {from: state},
+			op.#Exec & {
+				args: ["sh", "-c", "terraform output -json > /output.json"]
+				dir:   "/src"
+				"env": env
+			},
+			op.#Export & {
+				source: "/output.json"
+				format: "json"
+			},
+		]
+		...
+	}
+}
diff --git a/tests/stdlib.bats b/tests/stdlib.bats
index 576ab5a6..9007b5c2 100644
--- a/tests/stdlib.bats
+++ b/tests/stdlib.bats
@@ -58,4 +58,34 @@ setup() {
     skip_unless_secrets_available "$TESTDIR"/stdlib/aws/inputs.yaml
 
     "$DAGGER" compute "$TESTDIR"/stdlib/aws/ecr --input-yaml "$TESTDIR"/stdlib/aws/inputs.yaml
-}
\ No newline at end of file
+}
+
+@test "stdlib: terraform" {
+    skip_unless_secrets_available "$TESTDIR"/stdlib/aws/inputs.yaml
+
+    "$DAGGER" new --plan-dir "$TESTDIR"/stdlib/terraform/s3 terraform
+    "$DAGGER" -e terraform input dir TestData "$TESTDIR"/stdlib/terraform/s3/testdata
+    sops -d "$TESTDIR"/stdlib/aws/inputs.yaml | "$DAGGER" -e "terraform" input yaml "" -f -
+
+    # it must fail because of a missing var
+    run "$DAGGER" up -e terraform
+    assert_failure
+
+    # add the var and try again
+    "$DAGGER" -e terraform input text TestTerraform.apply.tfvars.input "42"
+    run "$DAGGER" up -e terraform
+    assert_success
+
+    # ensure the tfvar was passed correctly
+    run "$DAGGER" query -e terraform \
+        TestTerraform.apply.output.input.value  -f text
+    assert_success
+    assert_output "42"
+
+    # ensure the random value is always the same
+    # this proves we're effectively using the s3 backend
+    run "$DAGGER" query -e terraform \
+        TestTerraform.apply.output.random.value  -f json
+    assert_success
+    assert_output "36"
+}
diff --git a/tests/stdlib/terraform/s3/main.cue b/tests/stdlib/terraform/s3/main.cue
new file mode 100644
index 00000000..356b3683
--- /dev/null
+++ b/tests/stdlib/terraform/s3/main.cue
@@ -0,0 +1,24 @@
+package testing
+
+import (
+	"dagger.io/dagger"
+
+	"dagger.io/terraform"
+	"dagger.io/aws"
+)
+
+TestData: dagger.#Artifact
+
+TestConfig: awsConfig: aws.#Config & {
+	region: "us-east-2"
+}
+
+TestTerraform: apply: terraform.#Configuration & {
+	source: TestData
+	env: {
+		AWS_ACCESS_KEY_ID:     TestConfig.awsConfig.accessKey
+		AWS_SECRET_ACCESS_KEY: TestConfig.awsConfig.secretKey
+		AWS_DEFAULT_REGION:    TestConfig.awsConfig.region
+		AWS_REGION:            TestConfig.awsConfig.region
+	}
+}
diff --git a/tests/stdlib/terraform/s3/testdata/test.tf b/tests/stdlib/terraform/s3/testdata/test.tf
new file mode 100644
index 00000000..878484e2
--- /dev/null
+++ b/tests/stdlib/terraform/s3/testdata/test.tf
@@ -0,0 +1,34 @@
+terraform {
+  required_providers {
+    random = {
+      source = "hashicorp/random"
+      version = "3.1.0"
+    }
+  }
+
+  backend "s3" {
+    bucket = "dagger-ci"
+    key    = "terraform/tfstate"
+    region = "us-east-2"
+  }
+}
+
+provider "random" {
+}
+
+variable "input" {
+  type = string
+}
+
+resource "random_integer" "test" {
+  min = 1
+  max = 50
+}
+
+output "random" {
+  value = random_integer.test.result
+}
+
+output "input" {
+    value = var.input
+}