/terraform-gcp-terraform-cloud-oidc

Terraform Cloud Dynamic Credentials module as an IAM OIDC identity provider in GCP

Primary LanguageHCLApache License 2.0Apache-2.0

Terraform GCP Terraform Cloud OIDC Provider

CI GitHub issues License

This Terraform module enables you to configure Terraform Cloud as an GCP IAM OIDC identity provider in GCP, which enables Terraform Cloud to access resources within an GCP Projects(s) without requiring long-lived credentials to be stored as Terraform Cloud Variables.

Prerequisites

  • GCP Project(s) and credentials
  • Terraform Cloud Account(s)
  • Git repository integration with Terraform Cloud
  • Terraform >= 1.x
  • Profit?

Deployment / Usage

provider "google" {
  region  = var.region
  project = var.project_id
}

provider "google-beta" {
  region  = var.region
  project = var.project_id
}

module "terraform_cloud" {
  source  = "saidsef/terraform-cloud-oidc/gcp"
  version = ">= 1"

  organisation     = "saidsef"
  projects         = [{ "project" : "platform", "workspaces" : "dev" }]
}

Provider Specifications and Requirements

Please see TERRAFORM.md and Terraform token specification

Terraform Cloud Configure trust variables

After you have create a workspace, navigate to the Variables page and add the following variables:

Category Key Value Sensitive Required
Environment variable TFC_GCP_PROVIDER_AUTH true false Yes
Environment variable TFC_GCP_RUN_SERVICE_ACCOUNT_EMAIL The service account email Terraform Cloud will use when authenticating to GCP false Yes
Environment variable TFC_GCP_WORKLOAD_PROVIDER_NAME The canonical name of the workload identity provider. false Yes
Environment variable TFC_GCP_WORKLOAD_IDENTITY_AUDIENCE [] false No

NOTE: You can undelete a provider for up to 30 days after deletion. After 30 days, deletion is permanent. Until a provider is permanently deleted, you cannot reuse its name when creating a new provider.

Provider Specifications and Requirements

Please see TERRAFORM.md

Source

Our latest and greatest source of terraform-gcp-terraform-cloud-oidc can be found on GitHub. Fork us!

Contributing

We would ❤️ you to contribute by making a pull request.

Please read the official Contribution Guide for more information on how you can contribute.

Useful Links