terraform-provider-opal

README

Terraform provider for Opal

SDK Generation

Generate the new SDK using speakeasy run. This pulls the remote spec specified in .speakeasy/workflow.yaml#6 and applies the overrides in terraform_overlay.yaml. Note the Makefile is only useful if you want to do development with a local OpenAPI spec and update the Speakeasy workflow config to reference that OpenAPI spec.

Summary

Opal API: The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically.

Table of Contents

• Terraform provider for Opal
  • SDK Generation
  • Installation
  • Authentication
  • Available Resources and Data Sources
  • Testing the provider locally

Installation

To install this provider, copy and paste this code into your Terraform configuration. Then, run terraform init.

terraform {
  required_providers {
    opal = {
      source  = "opalsecurity/opal"
      version = "3.2.1"
    }
  }
}

provider "opal" {
  # Configuration options
}

Authentication

This provider supports authentication configuration via environment variables and provider configuration.

The configuration precedence is:

• Provider configuration
• Environment variables

Available configuration:

Provider Attribute	Description
bearer_auth	HTTP Bearer. Configurable via environment variable OPAL_AUTH_TOKEN.

Available Resources and Data Sources

Resources

• opal_access_rule
• opal_bundle
• opal_bundle_group
• opal_bundle_resource
• opal_configuration_template
• opal_group
• opal_group_containing_group
• opal_group_resource_list
• opal_group_tag
• opal_group_user
• opal_idp_group_mappings
• opal_message_channel
• opal_on_call_schedule
• opal_owner
• opal_resource
• opal_resource_tag
• opal_scoped_role_permission_list
• opal_tag
• opal_tag_user

Data Sources

• opal_access_rule
• opal_app
• opal_apps
• opal_bundle
• opal_bundle_visibility
• opal_configuration_template_list
• opal_events
• opal_group
• opal_group_list
• opal_group_containing_group
• opal_group_resource_list
• opal_group_reviewers_stages_list
• opal_group_tags
• opal_group_users
• opal_idp_group_mappings
• opal_message_channel
• opal_message_channel_list
• opal_on_call_schedule
• opal_on_call_schedule_list
• opal_owner
• opal_owner_from_name
• opal_owners
• opal_paginated_bundle_group_list
• opal_paginated_bundle_list
• opal_paginated_bundle_resource_list
• opal_requests
• opal_resource
• opal_resource_message_channel_list
• opal_resource_reviewers_list
• opal_resources_list
• opal_resources_access_status
• opal_resources_users_list
• opal_resource_tags
• opal_resource_visibility
• opal_scoped_role_permission_list
• opal_sessions
• opal_tag
• opal_tags_list
• opal_uar
• opal_uars_list
• opal_user
• opal_users
• opal_user_tags

Testing the provider locally

Local Provider

Should you want to validate a change locally, the --debug flag allows you to execute the provider against a terraform instance locally.

This also allows for debuggers (e.g. delve) to be attached to the provider.

go run main.go --debug
# Copy the TF_REATTACH_PROVIDERS env var
# In a new terminal
cd examples/your-example
TF_REATTACH_PROVIDERS=... terraform init
TF_REATTACH_PROVIDERS=... terraform apply

Compiled Provider

Terraform allows you to use local provider builds by setting a dev_overrides block in a configuration file called .terraformrc. This block overrides all other configured installation methods.

1. Execute go build to construct a binary called terraform-provider-opal
2. Ensure that the .terraformrc file is configured with a dev_overrides section such that your local copy of terraform can see the provider binary

Terraform searches for the .terraformrc file in your home directory and applies any configuration settings you set.

provider_installation {

  dev_overrides {
      "registry.terraform.io/opalsecurity/opal" = "<PATH>"
  }

  # For all other providers, install them directly from their origin provider
  # registries as normal. If you omit this, Terraform will _only_ use
  # the dev_overrides block, and so no other providers will be available.
  direct {}
}