← Library
REF 03 Cheat Sheet · Reference

Auto-injected environment variables

Available in every lifecycle script (setup / check / solve / cleanup) without configuration. Cloud credentials inject only when a matching resource block exists in config.yml.

Participant & user Always set
INSTRUQT_PARTICIPANT_ID Stable per-play identifier.
INSTRUQT_USER_ID Stable user identifier.
INSTRUQT_USER_NAME Display name.
INSTRUQT_USER_EMAIL May be empty on invite-link plays. Guard with a fallback.
Track & sandbox Always set
INSTRUQT_TRACK_SLUG Track's slug string.
INSTRUQT_TRACK_ID Platform-assigned UUID. Distinct from slug.
_SANDBOX_ID Sandbox identifier. Shell env only — not in the agent variable store.
_SANDBOX_DNS Sandbox DNS suffix. Useful for FQDNs.
Cloud account names & auth When declared
INSTRUQT_AWS_ACCOUNTS Name of declared AWS account(s), uppercased.
INSTRUQT_AZURE_SUBSCRIPTIONS Name of declared Azure subscription(s).
INSTRUQT_GCP_PROJECTS Name of declared GCP project(s).
INSTRUQT_AUTH_TOKEN Ephemeral JWT for the Instruqt REST API.
AWS account credentials Per-account — {NAME}
..._{NAME}_ACCOUNT_ID AWS account number.
..._{NAME}_USERNAME Console username (provisioned).
..._{NAME}_PASSWORD Console password.
..._{NAME}_AWS_ACCESS_KEY_ID CLI access key.
..._{NAME}_AWS_SECRET_ACCESS_KEY CLI secret key.
Azure subscription credentials Per-subscription — {NAME}
..._{NAME}_ADMIN_SPN_ID Service principal app ID.
..._{NAME}_ADMIN_SPN_PASSWORD SP secret.
..._{NAME}_TENANT_ID Tenant UUID.
..._{NAME}_SUBSCRIPTION_ID Subscription UUID.
..._{NAME}_SUBSCRIPTION_NAME Subscription display name.
..._{NAME}_USERNAME Provisioned learner UPN.
..._{NAME}_PASSWORD Learner password.
GCP project credentials Per-project — {NAME}
..._{NAME}_PROJECT_ID GCP project ID.
..._{NAME}_USER_EMAIL Provisioned learner email.
..._{NAME}_USER_PASSWORD Learner password.
..._{NAME}_SERVICE_ACCOUNT_KEY SA key, base64-encoded. Decode with base64 -d.
..._{NAME}_ADMIN_SERVICE_ACCOUNT_KEY Admin SA key, base64. For provisioning operations.
Cloud-client auto-aliases cloud-client base image only
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY Standard AWS CLI env names. Mapped from the prefixed form automatically.
AWS_ACCOUNT_ID / AWS_ACCOUNT_USERNAME / AWS_ACCOUNT_PASSWORD Console fields without the long prefix.
ARM_CLIENT_ID / ARM_CLIENT_SECRET / ARM_TENANT_ID / ARM_SUBSCRIPTION_ID Terraform AzureRM-style aliases. Use directly in provider blocks.
AZURE_LOCATION Subscription's configured region.
Notes