Skip to main content
Version: 19.x (unreleased)

Reference for the teleport_scoped_role Terraform data-source

Report an Issue

This page lists the supported values of the teleport_scoped_role data source of the Teleport Terraform provider.

Schema​

Required​

  • metadata (Attributes) Metadata contains the resource metadata. (see below for nested schema)
  • scope (String) Scope is the scope of the role resource.
  • spec (Attributes) Spec is the role specification. (see below for nested schema)
  • version (String) Version is the resource version.

Optional​

  • sub_kind (String) SubKind is the resource sub-kind.

Nested Schema for metadata​

Required:

  • name (String) name is an object name.

Optional:

  • description (String) description is object description.
  • labels (Map of String) labels is a set of labels.

Nested Schema for spec​

Required:

  • assignable_scopes (List of String) AssignableScopes is a list of scopes to which this role can be assigned. If empty, defaults to being assignable at resource scope and all descendants. Root scoped roles have no default and must specify assignable scopes explicitly.

Optional:

  • app (Attributes) The App Access specific configuration for a scoped role. (see below for nested schema)
  • defaults (Attributes) Defaults specifies default values for controls common across multiple protocols. If the same control specified in defaults is also specified in a protocol block, the value in the protocol block takes precedence. (see below for nested schema)
  • evaluation (Attributes) Evaluation groups role-level settings that govern how a role is evaluated. (see below for nested schema)
  • kube (Attributes) The kubernetes specific configuration for a scoped role. (see below for nested schema)
  • rules (Attributes List) Rules describes basic resource:verb permissions (e.g. scoped_role:read). (see below for nested schema)
  • ssh (Attributes) Ssh specifies controls that govern SSH access. (see below for nested schema)
  • workload_identity (Attributes) WorkloadIdentity specifies controls that govern issuance using WorkloadIdentity resources. (see below for nested schema)

Nested Schema for spec.app​

Optional:

  • aws (Attributes) AWS contains the AWS configuration for the scoped role. (see below for nested schema)
  • client_idle_timeout (String) Overrides the defaults block idle timeout specifically for app sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
  • disconnect_expired_cert (Boolean) DisconnectExpiredCert controls whether App sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
  • label_expression (String) LabelExpression is an optional predicate expression evaluated against an application's labels.
  • labels (Attributes List) The set of application labels used for RBAC. (see below for nested schema)
  • lock (Attributes) Lock configures the role's locking behavior for app sessions. If empty, the defaults block value (or global default) applies. (see below for nested schema)
  • resources (Attributes List) Resources is a list of rules controlling access to an app's resources on each HTTP request. This version does not implement app.resources on scoped roles and rejects a scoped role that sets it to a non-empty list. An empty list is the same as leaving the field unset. The field is declared so that version skew or a rollback cannot silently drop it and widen a role's access. (see below for nested schema)
  • resources_expressions (List of String) ResourcesExpressions is a list of predicates controlling access to an app's resources on each HTTP request. Every AppResource rule can be written as an expression, but not the reverse. This version does not implement app.resources_expressions on scoped roles and rejects a scoped role that sets it to a non-empty list. An empty list is the same as leaving the field unset. The field is declared so that version skew or a rollback cannot silently drop it and widen a role's access.

Nested Schema for spec.app.aws​

Optional:

  • role_arns (List of String) RoleArns specifies the AWS role ARNs to allow for this scoped app.

Nested Schema for spec.app.labels​

Optional:

  • name (String) The name of the label.
  • values (List of String) The values associated with the label.

Nested Schema for spec.app.lock​

Optional:

  • mode (String) Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.

Nested Schema for spec.app.resources​

Optional:

  • allow_all (Boolean) AllowAll grants unrestricted access to every path and method. It cannot be combined with any other field.
  • allow_code (String) AllowCode is the code recorded on the allow audit event when the rule matches. If it is not set, no allow audit event is recorded. A code may not start with the reserved "teleport_" prefix.
  • allow_reason (String) AllowReason is the explanation recorded alongside AllowCode. A rule sets it only together with AllowCode.
  • allow_unsafe (Attributes) AllowUnsafe lists options that can extend what the rule allows. They can be unsafe, so use them with care. For example: paths: ["/api/v4/projects/{project}/**"] allow_unsafe: {encoded: {project: "/"}} Set encoded only for an application that reads the encoded slash (%2F) as part of one path segment's content and does not auto-decode it to a literal /. (see below for nested schema)
  • deny_code_hint (String) DenyCodeHint is the code added to the deny decision when the rule's path and method match but the Where predicate does not. A denied request collects a code from every such rule, so one decision can record several codes. A code may not start with the reserved "teleport_" prefix.
  • deny_reason_hint (String) DenyReasonHint is the explanation recorded alongside DenyCodeHint. A rule sets it only together with DenyCodeHint.
  • methods (List of String) Methods are the HTTP methods the rule matches, compared case-insensitively. A rule may list only GET, HEAD, POST, PUT, PATCH, DELETE, and OPTIONS. An empty list matches any of them.
  • paths (List of String) Paths are the path patterns the rule matches, for example: paths: ["/api/projects/{project}/**"] The {project} segment is captured, and the rule's Where reads it as vars.project. A rule sets either Paths or AllowAll.
  • where (String) Where is a predicate over the caller identity and the rule's path captures, for example matching a captured project against a user's traits: where: contains(user.traits["projects"], vars.project)

Nested Schema for spec.app.resources.allow_unsafe​

Optional:

  • encoded (Map of String) Encoded maps a capture name to the characters a request path may contain in percent-encoded form inside that captured segment. The only supported value is "/", which allows the encoded slash (%2F or %2f).

Nested Schema for spec.defaults​

Optional:

  • client_idle_timeout (String) ClientIdleTimeout sets the default idle timeout for access sessions across all protocols that do not specify their own value. Must be a valid Go duration string (e.g. "30m", "1h"). The cluster-wide default is used only when neither this nor the protocol's equivalent control is set.
  • disconnect_expired_cert (Boolean) DisconnectExpiredCert defines the default behavior of all protocols when certs expire for a session. The cluster-wide default is used only when neither this nor the protocol's equivalent control is set.
  • lock (Attributes) Lock specifies the default locking mode for access sessions across all protocols that do not specify their own value. The cluster-wide default is used only when neither this nor the protocol's equivalent control is set. (see below for nested schema)
  • session_recording (Attributes) SessionRecording configures the session recording strategy for all protocols that don't explicitly set their session recording mode. If neither this nor the protocol's equivalent control is set, best_effort is used. (see below for nested schema)

Nested Schema for spec.defaults.lock​

Optional:

  • mode (String) Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.

Nested Schema for spec.defaults.session_recording​

Optional:

  • mode (String) Mode sets the session recording mode. Allowed values: strict or best_effort.

Nested Schema for spec.evaluation​

Optional:

  • mode (String) Mode determines the evaluation mode of the role. Allowed values are 'inclusive' (default) and 'exclusive'. The default inclusive mode allows permissions from multiple matching roles to be combined. When a role is set to exclusive, the first matching role fully determines all permissions and controls for the access attempt. Inclusive is easier to manage day to day, but exclusive offers tighter control.

Nested Schema for spec.kube​

Optional:

  • client_idle_timeout (String) Overrides the defaults block idle timeout specifically for kube sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
  • disconnect_expired_cert (Boolean) DisconnectExpiredCert controls whether Kube sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
  • groups (List of String) The list of kubernetes groups this role allows.
  • label_expression (String) LabelExpression is an optional predicate expression evaluated against a kubernetes server's labels.
  • labels (Attributes List) The map of kubernetes cluster labels used for RBAC. (see below for nested schema)
  • lock (Attributes) Lock configures the role's locking behavior for kubernetes sessions. If empty, the defaults block value (or global default) applies. (see below for nested schema)
  • resources (Attributes List) The kubernetes resources this role grants access to. (see below for nested schema)
  • users (List of String) An optional list of impersonatable kubernetes users this role allows.

Nested Schema for spec.kube.labels​

Optional:

  • name (String) The name of the label.
  • values (List of String) The values associated with the label.

Nested Schema for spec.kube.lock​

Optional:

  • mode (String) Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.

Nested Schema for spec.kube.resources​

Optional:

  • api_group (String) The kube API group of the kube resource. It supports wildcards.
  • kind (String) The kube resource type.
  • name (String) The kube resource name. It supports wildcards.
  • namespace (String) The kube resource namespace. It supports wildcards.
  • verbs (List of String) The allowed kube verbs for interacting with the kube resource.

Nested Schema for spec.rules​

Optional:

  • resources (List of String) Resources is a list of resource kinds (e.g. 'scoped_token') that the below verbs apply to.
  • verbs (List of String) Verbs is the list of action verbs (e.g. 'read') that apply to the above resources.

Nested Schema for spec.ssh​

Optional:

  • client_idle_timeout (String) ClientIdleTimeout overrides the defaults block idle timeout specifically for SSH sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
  • disconnect_expired_cert (Boolean) DisconnectExpiredCert controls whether SSH sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
  • enhanced_recording (Attributes) EnhancedRecording is the set of BPF events to record for enhanced session recording. (see below for nested schema)
  • file_copy (Boolean) FileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. If not set, remote file operations are not permitted.
  • forward_agent (Boolean) ForwardAgent enables SSH agent forwarding.
  • host_sudoers (List of String) Sudoers is a list of entries to include in a users sudoer file
  • host_user_creation (Attributes) HostUserCreation configures the creation of host users. (see below for nested schema)
  • label_expression (String) LabelExpression is an optional predicate expression evaluated against an ssh node's labels.
  • labels (Attributes List) Labels is the set of node labels used to dynamically select which nodes this role applies to. (see below for nested schema)
  • lock (Attributes) Lock configures the role's locking behavior for SSH sessions. If empty, the defaults block value (or global default) applies. (see below for nested schema)
  • logins (List of String) Logins is the list of OS logins this role permits on matching nodes.
  • max_sessions (Number) MaxSessions defines the maximum number of concurrent sessions per connection.
  • permit_x11_forwarding (Boolean) PermitX11Forwarding, when true, authorizes use of X11 forwarding over SSH sessions. If not set, X11 forwarding is not permitted.
  • port_forwarding (Attributes) SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. (see below for nested schema)
  • session_recording (Attributes) SessionRecording configures the session recording strategy for SSH sessions. (see below for nested schema)

Nested Schema for spec.ssh.enhanced_recording​

Optional:

  • command (Boolean) Command enables session.command in audit logs
  • disk (Boolean) Disk enables session.disk in audit logs
  • network (Boolean) Network enables session.network in audit logs

Nested Schema for spec.ssh.host_user_creation​

Optional:

  • groups (List of String) Groups is a list of host groups to add the user to.
  • mode (String) Mode specifies how the host user should be created.
  • shell (String) Shell is the shell to set for the user.

Nested Schema for spec.ssh.labels​

Optional:

  • name (String) The name of the label.
  • values (List of String) The values associated with the label.

Nested Schema for spec.ssh.lock​

Optional:

  • mode (String) Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.

Nested Schema for spec.ssh.port_forwarding​

Optional:

Nested Schema for spec.ssh.port_forwarding.local​

Optional:

  • enabled (Boolean) Enabled, when true, authorizes local port forwarding. If not set, local port forwarding is not permitted.

Nested Schema for spec.ssh.port_forwarding.remote​

Optional:

  • enabled (Boolean) Enabled, when true, authorizes remote port forwarding. If not set, remote port forwarding is not permitted.

Nested Schema for spec.ssh.session_recording​

Optional:

  • mode (String) Mode sets the session recording mode. Allowed values: strict or best_effort.

Nested Schema for spec.workload_identity​

Optional:

  • labels (Attributes List) Labels is the set of WorkloadIdentity labels used to dynamically select which WorkloadIdentity resources this role permits issuance with. Issuance additionally requires the caller to hold read_no_secrets (and, for the multi-issue RPC, list) rules for the workload_identity kind in the relevant scope. (see below for nested schema)

Nested Schema for spec.workload_identity.labels​

Optional:

  • name (String) The name of the label.
  • values (List of String) The values associated with the label.