Terraform provider resources

Supported resources:

• teleport_user
• teleport_role
• teleport_provision_token
• teleport_github_connector
• teleport_oidc_connector
• teleport_saml_connector
• teleport_trusted_cluster
• teleport_auth_preference

Provider configuration

Add the following configuration section to your terraform configuration block:

terraform {
  required_providers {
    teleport = {
      version = ">= 11.3.1"
      source  = "terraform.releases.teleport.dev/gravitational/teleport"
    }
  }
}

The provider supports the following options:

You need to specify at least one of:

• cert_path, key_path,root_ca_path and addr to connect using key files.
• cert_base64, key_base64,root_ca_base64 and addr to connect using a base64-encoded key.
• identity_file_path and addr to connect using identity file.
• profile_name and profile_dir (both can be empty) and Teleport will try to connect using current profile from ~/.tsh

The retry_* values are used to retry the API calls to Teleport when the cache is stale.

If more than one are provided, they will be tried in the order above until one succeeds.

Example:

provider "teleport" {
  addr         = "localhost:3025"
  cert_path    = "tf.crt"
  key_path     = "tf.key"
  root_ca_path = "tf.ca"
}

teleport_user

The user resource allows to manage local non-interactive Teleport users: CI/CD bots and plugins.

metadata

Metadata specifies the resource name, description, labels and optional expiry date and time.

Example:

resource "teleport_user" "example" {
  metadata = {
    name        = "example"
    description = "Example Teleport User"
    expires     = "2022-10-12T07:20:50.3Z"
    labels      = {
      example = "yes"
    }
  }
}

spec

Spec contains parameters of a resource.

Example:

resource "teleport_user" "example" {
  metadata = {
    name        = "example"
  }
  spec = {
    roles = ["example"]

    oidc_identities = [
      {
        connector_id = "oidc1.example.com"
        username     = "example"
      },
      {
        connector_id = "oidc2.example.com"
        username     = "example"
      }
    ]

    traits = {
      key   = ["trait1"]
      value = ["example", "test"]
    }

    traits = {
      key   = ["trait2"]
      value = ["foo", "bar"]
    }

    github_identities = [
      {
        connector_id = "github.com"
        username     = "example"
      }
    ]

    saml_identities = [
      {
        connector_id = "saml.example.com"
        username     = "example"
      }
    ]
  }
}

teleport_role

The role resource specifies a set of permissions assigned to local and SSO users.

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

version

version is an optional string that specifies the role version (default v3).

spec

Role specification consists of two sections: allow and deny. They are identical and contain the following fields:

spec.allow and spec.deny

spec.allow.request and spec.deny.request

Request matcher represents matcher for allow/deny restrictions on access-requests.

spec.allow.review_requests and spec.deny.review_requests

Allow or deny access reviews matching the criteria.

spec.options

Options specify session, connection and auditing permissions of the role.

Example:

resource "teleport_role" "example" {
  metadata = {
    name = "example"
  }
  
  spec = {
    options = {
      forward_agent           = false
      max_session_ttl         = "7m"
      port_forwarding         = false
      client_idle_timeout     = "1h"
      disconnect_expired_cert = true
      permit_x11_forwarding   = false
      request_access          = "denied"
    }

    allow = {
      logins = ["example"]

      rules = [{
        resources = ["user", "role"]
        verbs = ["list"]
      }]

      request = {
        roles = ["example"]
        claims_to_roles = [{
          claim = "example"
          value = "example"
          roles = ["example"]
        }]
      }

      node_labels = {
        env = ["prod"]
        example = ["a", "b"]
      }
    }

    deny = {
      logins = ["anonymous"]
    }
  }
}

teleport_provision_token

Provision tokens authenticate Teleport resource services and Proxy Service instances when they first join the cluster.

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource. It has a single field: roles, a list of roles associated with a token. It will be converted to metadata in the SSH and X509 certificates issued to the user of the token.

teleport_github_connector

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource.

teleport_oidc_connector

An OIDC connector resource specifies OpenID Connect identity provider for Teleport.

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource.

teleport_saml_connector

An OIDC connector resource specifies SAML identity provider for Teleport.

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource.

teleport_trusted_cluster

A trusted cluster resource connects dials and connects this cluster to another, root cluster.

metadata

Metadata specifies a resource name, description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource.

teleport_auth_preference

The auth preference resource defines cluster auth preference for the Teleport cluster. This resource is a singleton. It gots reset on deletion.

metadata

Metadata specifies a resource description, labels and optional expiry date and time.

spec

Spec contains parameters of a resource.