Library
REF 03Cheat Sheet · Reference

Auto-injected environment variables

Available in every lifecycle script (setup / check / solve / cleanup) without configuration. Cloud credentials inject only when a matching resource block exists in config.yml.

Participant & userAlways set
INSTRUQT_PARTICIPANT_IDStable per-play identifier.
INSTRUQT_USER_IDStable user identifier.
INSTRUQT_USER_NAMEDisplay name.
INSTRUQT_USER_EMAILMay be empty on invite-link plays. Guard with a fallback.
Track & sandboxAlways set
INSTRUQT_TRACK_SLUGTrack’s slug string.
INSTRUQT_TRACK_IDPlatform-assigned UUID. Distinct from slug.
_SANDBOX_IDSandbox identifier. Shell env only — not in the agent variable store.
_SANDBOX_DNSSandbox DNS suffix. Useful for FQDNs.
Cloud account names & authWhen declared
INSTRUQT_AWS_ACCOUNTSName of declared AWS account(s), uppercased.
INSTRUQT_AZURE_SUBSCRIPTIONSName of declared Azure subscription(s).
INSTRUQT_GCP_PROJECTSName of declared GCP project(s).
INSTRUQT_AUTH_TOKENEphemeral JWT for the Instruqt REST API.
AWS account credentialsPer-account — {NAME}
..._{NAME}_ACCOUNT_IDAWS account number.
..._{NAME}_USERNAMEConsole username (provisioned).
..._{NAME}_PASSWORDConsole password.
..._{NAME}_AWS_ACCESS_KEY_IDCLI access key.
..._{NAME}_AWS_SECRET_ACCESS_KEYCLI secret key.
Azure subscription credentialsPer-subscription — {NAME}
..._{NAME}_ADMIN_SPN_IDService principal app ID.
..._{NAME}_ADMIN_SPN_PASSWORDSP secret.
..._{NAME}_TENANT_IDTenant UUID.
..._{NAME}_SUBSCRIPTION_IDSubscription UUID.
..._{NAME}_SUBSCRIPTION_NAMESubscription display name.
..._{NAME}_USERNAMEProvisioned learner UPN.
..._{NAME}_PASSWORDLearner password.
GCP project credentialsPer-project — {NAME}
..._{NAME}_PROJECT_IDGCP project ID.
..._{NAME}_USER_EMAILProvisioned learner email.
..._{NAME}_USER_PASSWORDLearner password.
..._{NAME}_SERVICE_ACCOUNT_KEYSA key, base64-encoded. Decode with base64 -d.
..._{NAME}_ADMIN_SERVICE_ACCOUNT_KEYAdmin SA key, base64. For provisioning operations.
Cloud-client auto-aliasescloud-client base image only
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEYStandard AWS CLI env names. Mapped from the prefixed form automatically.
AWS_ACCOUNT_ID / AWS_ACCOUNT_USERNAME / AWS_ACCOUNT_PASSWORDConsole fields without the long prefix.
ARM_CLIENT_ID / ARM_CLIENT_SECRET / ARM_TENANT_ID / ARM_SUBSCRIPTION_IDTerraform AzureRM-style aliases. Use directly in provider blocks.
AZURE_LOCATIONSubscription’s configured region.
Notes