> ## Documentation Index
> Fetch the complete documentation index at: https://cdktn.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Java: DataTerraformRemoteStateS3Config
> CDKTN Core API Reference for DataTerraformRemoteStateS3Config in Java.
## Initializer
```java theme={null}
import io.cdktn.cdktn.DataTerraformRemoteStateS3Config;
DataTerraformRemoteStateS3Config.builder()
// .defaults(java.util.Map)
// .workspace(java.lang.String)
.bucket(java.lang.String)
.key(java.lang.String)
// .accessKey(java.lang.String)
// .acl(java.lang.String)
// .allowedAccountIds(java.util.List)
// .assumeRole(S3BackendAssumeRoleConfig)
// .assumeRolePolicy(java.lang.String)
// .assumeRolePolicyArns(java.util.List)
// .assumeRoleTags(java.util.Map)
// .assumeRoleTransitiveTagKeys(java.util.List)
// .assumeRoleWithWebIdentity(S3BackendAssumeRoleWithWebIdentityConfig)
// .customCaBundle(java.lang.String)
// .dynamodbEndpoint(java.lang.String)
// .dynamodbTable(java.lang.String)
// .ec2MetadataServiceEndpoint(java.lang.String)
// .ec2MetadataServiceEndpointMode(java.lang.String)
// .encrypt(java.lang.Boolean)
// .endpoint(java.lang.String)
// .endpoints(S3BackendEndpointConfig)
// .externalId(java.lang.String)
// .forbiddenAccountIds(java.util.List)
// .forcePathStyle(java.lang.Boolean)
// .httpProxy(java.lang.String)
// .httpsProxy(java.lang.String)
// .iamEndpoint(java.lang.String)
// .insecure(java.lang.Boolean)
// .kmsKeyId(java.lang.String)
// .maxRetries(java.lang.Number)
// .noProxy(java.lang.String)
// .profile(java.lang.String)
// .region(java.lang.String)
// .retryMode(java.lang.String)
// .roleArn(java.lang.String)
// .secretKey(java.lang.String)
// .sessionName(java.lang.String)
// .sharedConfigFiles(java.util.List)
// .sharedCredentialsFile(java.lang.String)
// .sharedCredentialsFiles(java.util.List)
// .skipCredentialsValidation(java.lang.Boolean)
// .skipMetadataApiCheck(java.lang.Boolean)
// .skipRegionValidation(java.lang.Boolean)
// .skipRequestingAccountId(java.lang.Boolean)
// .skipS3Checksum(java.lang.Boolean)
// .sseCustomerKey(java.lang.String)
// .stsEndpoint(java.lang.String)
// .stsRegion(java.lang.String)
// .token(java.lang.String)
// .useLegacyWorkflow(java.lang.Boolean)
// .useLockfile(java.lang.Boolean)
// .usePathStyle(java.lang.Boolean)
// .workspaceKeyPrefix(java.lang.String)
.build();
```
## Properties
| **Name** | **Type** | **Description** |
| ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| defaults | java.util.Map\< java.lang.String, java.lang.Object > | *No description.* |
| workspace | java.lang.String | *No description.* |
| bucket | java.lang.String | Name of the S3 Bucket. |
| key | java.lang.String | Path to the state file inside the S3 Bucket. |
| accessKey | java.lang.String | (Optional) AWS access key. |
| acl | java.lang.String | (Optional) Canned ACL to be applied to the state file. |
| allowedAccountIds | java.util.List\< java.lang.String > | (Optional) List of allowed AWS account IDs to prevent potential destruction of a live environment. |
| assumeRole | S3BackendAssumeRoleConfig | Assuming an IAM Role can be configured in two ways. |
| assumeRolePolicy | java.lang.String | (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed. |
| assumeRolePolicyArns | java.util.List\< java.lang.String > | (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed. |
| assumeRoleTags | java.util.Map\< java.lang.String, java.lang.String > | (Optional) Map of assume role session tags. |
| assumeRoleTransitiveTagKeys | java.util.List\< java.lang.String > | (Optional) Set of assume role session tag keys to pass to any subsequent sessions. |
| assumeRoleWithWebIdentity | S3BackendAssumeRoleWithWebIdentityConfig | Assume Role With Web Identity Configuration. |
| customCaBundle | java.lang.String | (Optional) File containing custom root and intermediate certificates. |
| dynamodbEndpoint | java.lang.String | (Optional) Custom endpoint for the AWS DynamoDB API. |
| dynamodbTable | java.lang.String | (Optional) Name of DynamoDB Table to use for state locking and consistency. |
| ec2MetadataServiceEndpoint | java.lang.String | Optional) Custom endpoint URL for the EC2 Instance Metadata Service (IMDS) API. |
| ec2MetadataServiceEndpointMode | java.lang.String | (Optional) Mode to use in communicating with the metadata service. |
| encrypt | java.lang.Boolean | (Optional) Enable server side encryption of the state file. |
| endpoint | java.lang.String | (Optional) Custom endpoint for the AWS S3 API. |
| endpoints | S3BackendEndpointConfig | (Optional) The endpoint configuration block. |
| externalId | java.lang.String | (Optional) External identifier to use when assuming the role. |
| forbiddenAccountIds | java.util.List\< java.lang.String > | (Optional) List of forbidden AWS account IDs to prevent potential destruction of a live environment. |
| forcePathStyle | java.lang.Boolean | (Optional) Enable path-style S3 URLs (https\://\< HOST >/\< BUCKET > instead of https\://\< BUCKET >.\< HOST >). |
| httpProxy | java.lang.String | (Optional) URL of a proxy to use for HTTP requests when accessing the AWS API. |
| httpsProxy | java.lang.String | (Optional) URL of a proxy to use for HTTPS requests when accessing the AWS API. |
| iamEndpoint | java.lang.String | (Optional) Custom endpoint for the AWS Identity and Access Management (IAM) API. |
| insecure | java.lang.Boolean | Optional) Whether to explicitly allow the backend to perform "insecure" SSL requests. |
| kmsKeyId | java.lang.String | (Optional) Amazon Resource Name (ARN) of a Key Management Service (KMS) Key to use for encrypting the state. |
| maxRetries | java.lang.Number | (Optional) The maximum number of times an AWS API request is retried on retryable failure. |
| noProxy | java.lang.String | (Optional) Comma-separated list of hosts that should not use HTTP or HTTPS proxies. |
| profile | java.lang.String | (Optional) Name of AWS profile in AWS shared credentials file (e.g. \~/.aws/credentials) or AWS shared configuration file (e.g. \~/.aws/config) to use for credentials and/or configuration. This can also be sourced from the AWS\_PROFILE environment variable. |
| region | java.lang.String | AWS Region of the S3 Bucket and DynamoDB Table (if used). |
| retryMode | java.lang.String | (Optional) Specifies how retries are attempted. |
| roleArn | java.lang.String | (Optional) Amazon Resource Name (ARN) of the IAM Role to assume. |
| secretKey | java.lang.String | (Optional) AWS secret access key. |
| sessionName | java.lang.String | (Optional) Session name to use when assuming the role. |
| sharedConfigFiles | java.util.List\< java.lang.String > | (Optional) List of paths to AWS shared configuration files. |
| sharedCredentialsFile | java.lang.String | (Optional) Path to the AWS shared credentials file. |
| sharedCredentialsFiles | java.util.List\< java.lang.String > | (Optional) List of paths to AWS shared credentials files. |
| skipCredentialsValidation | java.lang.Boolean | (Optional) Skip credentials validation via the STS API. |
| skipMetadataApiCheck | java.lang.Boolean | (Optional) Skip usage of EC2 Metadata API. |
| skipRegionValidation | java.lang.Boolean | (Optional) Skip validation of provided region name. |
| skipRequestingAccountId | java.lang.Boolean | (Optional) Whether to skip requesting the account ID. |
| skipS3Checksum | java.lang.Boolean | (Optional) Do not include checksum when uploading S3 Objects. |
| sseCustomerKey | java.lang.String | (Optional) The key to use for encrypting state with Server-Side Encryption with Customer-Provided Keys (SSE-C). |
| stsEndpoint | java.lang.String | (Optional) Custom endpoint for the AWS Security Token Service (STS) API. |
| stsRegion | java.lang.String | (Optional) AWS region for STS. |
| token | java.lang.String | (Optional) Multi-Factor Authentication (MFA) token. |
| useLegacyWorkflow | java.lang.Boolean | (Optional) Use the legacy authentication workflow, preferring environment variables over backend configuration. |
| useLockfile | java.lang.Boolean | (Optional) Whether to use a lockfile for locking the state file. |
| usePathStyle | java.lang.Boolean | (Optional) Enable path-style S3 URLs (https\://\< HOST >/\< BUCKET > instead of https\://\< BUCKET >.\< HOST >). |
| workspaceKeyPrefix | java.lang.String | (Optional) Prefix applied to the state path inside the bucket. |
***
### `defaults`Optional
```java theme={null}
public java.util.Map getDefaults();
```
* *Type:* java.util.Map\< java.lang.String, java.lang.Object >
***
### `workspace`Optional
```java theme={null}
public java.lang.String getWorkspace();
```
* *Type:* java.lang.String
***
### `bucket`Required
```java theme={null}
public java.lang.String getBucket();
```
* *Type:* java.lang.String
Name of the S3 Bucket.
***
### `key`Required
```java theme={null}
public java.lang.String getKey();
```
* *Type:* java.lang.String
Path to the state file inside the S3 Bucket.
When using a non-default workspace, the state path will be /workspace\_key\_prefix/workspace\_name/key
***
### `accessKey`Optional
```java theme={null}
public java.lang.String getAccessKey();
```
* *Type:* java.lang.String
(Optional) AWS access key.
If configured, must also configure secret\_key.
This can also be sourced from
the AWS\_ACCESS\_KEY\_ID environment variable,
AWS shared credentials file (e.g. \~/.aws/credentials),
or AWS shared configuration file (e.g. \~/.aws/config).
***
### `acl`Optional
```java theme={null}
public java.lang.String getAcl();
```
* *Type:* java.lang.String
(Optional) Canned ACL to be applied to the state file.
***
### `allowedAccountIds`Optional
```java theme={null}
public java.util.List getAllowedAccountIds();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) List of allowed AWS account IDs to prevent potential destruction of a live environment.
Conflicts with forbidden\_account\_ids.
***
### `assumeRole`Optional
```java theme={null}
public S3BackendAssumeRoleConfig getAssumeRole();
```
* *Type:* S3BackendAssumeRoleConfig
Assuming an IAM Role can be configured in two ways.
The preferred way is to use the argument assume\_role, the other, which is deprecated, is with arguments at the top level.
***
### ~~`assumeRolePolicy`~~Optional
* *Deprecated:* Use assumeRole.policy instead.
```java theme={null}
public java.lang.String getAssumeRolePolicy();
```
* *Type:* java.lang.String
(Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
***
### ~~`assumeRolePolicyArns`~~Optional
* *Deprecated:* Use assumeRole.policyArns instead.
```java theme={null}
public java.util.List getAssumeRolePolicyArns();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
***
### ~~`assumeRoleTags`~~Optional
* *Deprecated:* Use assumeRole.tags instead.
```java theme={null}
public java.util.Map getAssumeRoleTags();
```
* *Type:* java.util.Map\< java.lang.String, java.lang.String >
(Optional) Map of assume role session tags.
***
### ~~`assumeRoleTransitiveTagKeys`~~Optional
* *Deprecated:* Use assumeRole.transitiveTagKeys instead.
```java theme={null}
public java.util.List getAssumeRoleTransitiveTagKeys();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) Set of assume role session tag keys to pass to any subsequent sessions.
***
### `assumeRoleWithWebIdentity`Optional
```java theme={null}
public S3BackendAssumeRoleWithWebIdentityConfig getAssumeRoleWithWebIdentity();
```
* *Type:* S3BackendAssumeRoleWithWebIdentityConfig
Assume Role With Web Identity Configuration.
***
### `customCaBundle`Optional
```java theme={null}
public java.lang.String getCustomCaBundle();
```
* *Type:* java.lang.String
(Optional) File containing custom root and intermediate certificates.
Can also be set using the AWS\_CA\_BUNDLE environment variable.
Setting ca\_bundle in the shared config file is not supported.
***
### ~~`dynamodbEndpoint`~~Optional
* *Deprecated:* Use endpoints.dynamodb instead
```java theme={null}
public java.lang.String getDynamodbEndpoint();
```
* *Type:* java.lang.String
(Optional) Custom endpoint for the AWS DynamoDB API.
This can also be sourced from the AWS\_DYNAMODB\_ENDPOINT environment variable.
***
### ~~`dynamodbTable`~~Optional
* *Deprecated:* Use useLockfile instead, which uses S3 for locking
```java theme={null}
public java.lang.String getDynamodbTable();
```
* *Type:* java.lang.String
(Optional) Name of DynamoDB Table to use for state locking and consistency.
The table must have a partition key named LockID with type of String.
If not configured, state locking will be disabled.
***
### `ec2MetadataServiceEndpoint`Optional
```java theme={null}
public java.lang.String getEc2MetadataServiceEndpoint();
```
* *Type:* java.lang.String
Optional) Custom endpoint URL for the EC2 Instance Metadata Service (IMDS) API.
Can also be set with the AWS\_EC2\_METADATA\_SERVICE\_ENDPOINT environment variable.
***
### `ec2MetadataServiceEndpointMode`Optional
```java theme={null}
public java.lang.String getEc2MetadataServiceEndpointMode();
```
* *Type:* java.lang.String
(Optional) Mode to use in communicating with the metadata service.
Valid values are IPv4 and IPv6.
Can also be set with the AWS\_EC2\_METADATA\_SERVICE\_ENDPOINT\_MODE environment variable.
***
### `encrypt`Optional
```java theme={null}
public java.lang.Boolean getEncrypt();
```
* *Type:* java.lang.Boolean
(Optional) Enable server side encryption of the state file.
***
### ~~`endpoint`~~Optional
* *Deprecated:* Use endpoints.s3 instead
```java theme={null}
public java.lang.String getEndpoint();
```
* *Type:* java.lang.String
(Optional) Custom endpoint for the AWS S3 API.
This can also be sourced from the AWS\_S3\_ENDPOINT environment variable.
***
### `endpoints`Optional
```java theme={null}
public S3BackendEndpointConfig getEndpoints();
```
* *Type:* S3BackendEndpointConfig
(Optional) The endpoint configuration block.
***
### ~~`externalId`~~Optional
* *Deprecated:* Use assume\_role.external\_id instead.
```java theme={null}
public java.lang.String getExternalId();
```
* *Type:* java.lang.String
(Optional) External identifier to use when assuming the role.
***
### `forbiddenAccountIds`Optional
```java theme={null}
public java.util.List getForbiddenAccountIds();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) List of forbidden AWS account IDs to prevent potential destruction of a live environment.
Conflicts with allowed\_account\_ids.
***
### ~~`forcePathStyle`~~Optional
* *Deprecated:* Use usePathStyle instead
```java theme={null}
public java.lang.Boolean getForcePathStyle();
```
* *Type:* java.lang.Boolean
(Optional) Enable path-style S3 URLs (https\://\< HOST >/\< BUCKET > instead of https\://\< BUCKET >.\< HOST >).
***
### `httpProxy`Optional
```java theme={null}
public java.lang.String getHttpProxy();
```
* *Type:* java.lang.String
(Optional) URL of a proxy to use for HTTP requests when accessing the AWS API.
Can also be set using the HTTP\_PROXY or http\_proxy environment variables.
***
### `httpsProxy`Optional
```java theme={null}
public java.lang.String getHttpsProxy();
```
* *Type:* java.lang.String
(Optional) URL of a proxy to use for HTTPS requests when accessing the AWS API.
Can also be set using the HTTPS\_PROXY or https\_proxy environment variables.
***
### ~~`iamEndpoint`~~Optional
* *Deprecated:* Use endpoints.iam instead
```java theme={null}
public java.lang.String getIamEndpoint();
```
* *Type:* java.lang.String
(Optional) Custom endpoint for the AWS Identity and Access Management (IAM) API.
This can also be sourced from the AWS\_IAM\_ENDPOINT environment variable.
***
### `insecure`Optional
```java theme={null}
public java.lang.Boolean getInsecure();
```
* *Type:* java.lang.Boolean
Optional) Whether to explicitly allow the backend to perform "insecure" SSL requests.
If omitted, the default value is false.
***
### `kmsKeyId`Optional
```java theme={null}
public java.lang.String getKmsKeyId();
```
* *Type:* java.lang.String
(Optional) Amazon Resource Name (ARN) of a Key Management Service (KMS) Key to use for encrypting the state.
Note that if this value is specified,
Terraform will need kms:Encrypt, kms:Decrypt and kms:GenerateDataKey permissions on this KMS key.
***
### `maxRetries`Optional
```java theme={null}
public java.lang.Number getMaxRetries();
```
* *Type:* java.lang.Number
(Optional) The maximum number of times an AWS API request is retried on retryable failure.
Defaults to 5.
***
### `noProxy`Optional
```java theme={null}
public java.lang.String getNoProxy();
```
* *Type:* java.lang.String
(Optional) Comma-separated list of hosts that should not use HTTP or HTTPS proxies.
Each value can be one of:
* A domain name
* An IP address
* A CIDR address
* An asterisk (\*), to indicate that no proxying should be performed Domain name and IP address values can also include a port number.
Can also be set using the NO\_PROXY or no\_proxy environment variables.
***
### `profile`Optional
```java theme={null}
public java.lang.String getProfile();
```
* *Type:* java.lang.String
(Optional) Name of AWS profile in AWS shared credentials file (e.g. \~/.aws/credentials) or AWS shared configuration file (e.g. \~/.aws/config) to use for credentials and/or configuration. This can also be sourced from the AWS\_PROFILE environment variable.
***
### `region`Optional
```java theme={null}
public java.lang.String getRegion();
```
* *Type:* java.lang.String
AWS Region of the S3 Bucket and DynamoDB Table (if used).
This can also
be sourced from the AWS\_DEFAULT\_REGION and AWS\_REGION environment
variables.
***
### `retryMode`Optional
```java theme={null}
public java.lang.String getRetryMode();
```
* *Type:* java.lang.String
(Optional) Specifies how retries are attempted.
Valid values are standard and adaptive.
Can also be configured using the AWS\_RETRY\_MODE environment variable or the shared config file parameter retry\_mode.
***
### ~~`roleArn`~~Optional
* *Deprecated:* Use assumeRole.roleArn instead.
```java theme={null}
public java.lang.String getRoleArn();
```
* *Type:* java.lang.String
(Optional) Amazon Resource Name (ARN) of the IAM Role to assume.
***
### `secretKey`Optional
```java theme={null}
public java.lang.String getSecretKey();
```
* *Type:* java.lang.String
(Optional) AWS secret access key.
If configured, must also configure access\_key.
This can also be sourced from
the AWS\_SECRET\_ACCESS\_KEY environment variable,
AWS shared credentials file (e.g. \~/.aws/credentials),
or AWS shared configuration file (e.g. \~/.aws/config)
***
### ~~`sessionName`~~Optional
* *Deprecated:* Use assumeRole.sessionName instead.
```java theme={null}
public java.lang.String getSessionName();
```
* *Type:* java.lang.String
(Optional) Session name to use when assuming the role.
***
### `sharedConfigFiles`Optional
```java theme={null}
public java.util.List getSharedConfigFiles();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) List of paths to AWS shared configuration files.
Defaults to \~/.aws/config.
***
### `sharedCredentialsFile`Optional
```java theme={null}
public java.lang.String getSharedCredentialsFile();
```
* *Type:* java.lang.String
(Optional) Path to the AWS shared credentials file.
Defaults to \~/.aws/credentials.
***
### `sharedCredentialsFiles`Optional
```java theme={null}
public java.util.List getSharedCredentialsFiles();
```
* *Type:* java.util.List\< java.lang.String >
(Optional) List of paths to AWS shared credentials files.
Defaults to \~/.aws/credentials.
***
### `skipCredentialsValidation`Optional
```java theme={null}
public java.lang.Boolean getSkipCredentialsValidation();
```
* *Type:* java.lang.Boolean
(Optional) Skip credentials validation via the STS API.
***
### `skipMetadataApiCheck`Optional
```java theme={null}
public java.lang.Boolean getSkipMetadataApiCheck();
```
* *Type:* java.lang.Boolean
(Optional) Skip usage of EC2 Metadata API.
***
### `skipRegionValidation`Optional
```java theme={null}
public java.lang.Boolean getSkipRegionValidation();
```
* *Type:* java.lang.Boolean
(Optional) Skip validation of provided region name.
***
### `skipRequestingAccountId`Optional
```java theme={null}
public java.lang.Boolean getSkipRequestingAccountId();
```
* *Type:* java.lang.Boolean
(Optional) Whether to skip requesting the account ID.
Useful for AWS API implementations that do not have the IAM, STS API, or metadata API.
***
### `skipS3Checksum`Optional
```java theme={null}
public java.lang.Boolean getSkipS3Checksum();
```
* *Type:* java.lang.Boolean
(Optional) Do not include checksum when uploading S3 Objects.
Useful for some S3-Compatible APIs.
***
### `sseCustomerKey`Optional
```java theme={null}
public java.lang.String getSseCustomerKey();
```
* *Type:* java.lang.String
(Optional) The key to use for encrypting state with Server-Side Encryption with Customer-Provided Keys (SSE-C).
This is the base64-encoded value of the key, which must decode to 256 bits.
This can also be sourced from the AWS\_SSE\_CUSTOMER\_KEY environment variable,
which is recommended due to the sensitivity of the value.
Setting it inside a terraform file will cause it to be persisted to disk in terraform.tfstate.
***
### ~~`stsEndpoint`~~Optional
* *Deprecated:* Use endpoints.sts instead
```java theme={null}
public java.lang.String getStsEndpoint();
```
* *Type:* java.lang.String
(Optional) Custom endpoint for the AWS Security Token Service (STS) API.
This can also be sourced from the AWS\_STS\_ENDPOINT environment variable.
***
### `stsRegion`Optional
```java theme={null}
public java.lang.String getStsRegion();
```
* *Type:* java.lang.String
(Optional) AWS region for STS.
If unset, AWS will use the same region for STS as other non-STS operations.
***
### `token`Optional
```java theme={null}
public java.lang.String getToken();
```
* *Type:* java.lang.String
(Optional) Multi-Factor Authentication (MFA) token.
This can also be sourced from the AWS\_SESSION\_TOKEN environment variable.
***
### `useLegacyWorkflow`Optional
```java theme={null}
public java.lang.Boolean getUseLegacyWorkflow();
```
* *Type:* java.lang.Boolean
(Optional) Use the legacy authentication workflow, preferring environment variables over backend configuration.
Defaults to true.
This behavior does not align with the authentication flow of the AWS CLI or SDK's, and will be removed in the future.
***
### `useLockfile`Optional
```java theme={null}
public java.lang.Boolean getUseLockfile();
```
* *Type:* java.lang.Boolean
(Optional) Whether to use a lockfile for locking the state file.
Defaults to false.
State locking is an opt-in feature of the S3 backend.
Locking can be enabled via S3 or DynamoDB (see dynamodbTable). However, DynamoDB-based locking
is deprecated and will be removed in a future minor version. To support migration from older
versions of Terraform that only support DynamoDB-based locking, the S3 (useLockfile) and DynamoDB
(dynamodbTable) arguments can be configured simultaneously.
***
### `usePathStyle`Optional
```java theme={null}
public java.lang.Boolean getUsePathStyle();
```
* *Type:* java.lang.Boolean
(Optional) Enable path-style S3 URLs (https\://\< HOST >/\< BUCKET > instead of https\://\< BUCKET >.\< HOST >).
***
### `workspaceKeyPrefix`Optional
```java theme={null}
public java.lang.String getWorkspaceKeyPrefix();
```
* *Type:* java.lang.String
(Optional) Prefix applied to the state path inside the bucket.
This is only relevant when using a non-default workspace. Defaults to env:
***