diff --git a/azure_static/main.tf b/azure_static/main.tf new file mode 100644 index 0000000..11f1b7c --- /dev/null +++ b/azure_static/main.tf @@ -0,0 +1,43 @@ +data "azuread_client_config" "current" {} +data "azurerm_subscription" "current" {} + +# Create Azure AD application +resource "azuread_application" "app_registration" { + display_name = var.AD_name + owners = [data.azuread_client_config.current.object_id] +} + +# Create the Service Principal +resource "azuread_service_principal" "sg_sp" { + client_id = azuread_application.app_registration.client_id + owners = [data.azuread_client_config.current.object_id] + app_role_assignment_required = false +} + +# Assign Contributor role to the Service Principal at the subscription level +resource "azurerm_role_assignment" "example" { + principal_id = azuread_service_principal.sg_sp.object_id + role_definition_name = "Contributor" + scope = data.azurerm_subscription.current.id +} + +# Step 3: Create a Client Secret for the Service Principal +resource "azuread_service_principal_password" "client_secret" { + service_principal_id = azuread_service_principal.sg_sp.id +} + +# Step 4: Output the Client Secret Value (ID will be available in the Service Principal) +output "client_secret_value" { + value = azuread_service_principal_password.client_secret.value + sensitive = true +} + +# Step 5: Output the Client ID (Application ID) +output "client_id" { + value = azuread_application.app_registration.client_id +} + +# Step 6: Output the Client Secret ID (from the service principal password) +output "client_secret_id" { + value = azuread_service_principal_password.client_secret.id +} \ No newline at end of file diff --git a/azure_static/provider.tf b/azure_static/provider.tf new file mode 100644 index 0000000..df86177 --- /dev/null +++ b/azure_static/provider.tf @@ -0,0 +1,26 @@ +terraform { + required_providers { + azurerm = { + source = "hashicorp/azurerm" + version = "=4.6.0" + } + azuread = { + source = "hashicorp/azuread" + version = "=3.0.2" + } + } +} + +provider "azurerm" { + features { + + } + subscription_id = var.subscription_id + client_id = var.client_id + client_secret = var.client_secret + tenant_id = var.tenant_id +} + +provider "azuread" { + tenant_id = var.tenant_id +} \ No newline at end of file diff --git a/azure_static/variables.tf b/azure_static/variables.tf new file mode 100644 index 0000000..885886a --- /dev/null +++ b/azure_static/variables.tf @@ -0,0 +1,20 @@ +variable "subscription_id" { + type = string +} + +variable "client_id" { + type = string +} + +variable "client_secret" { + type = string +} + +variable "tenant_id" { + type = string +} + +variable "AD_name" { + type = string + description = "name of the azure active directory" +} \ No newline at end of file diff --git a/stackguardian_connector_cloud/main.tf b/stackguardian_connector_cloud/main.tf index d41b7a2..ed9e4c5 100644 --- a/stackguardian_connector_cloud/main.tf +++ b/stackguardian_connector_cloud/main.tf @@ -53,3 +53,29 @@ resource "stackguardian_connector" "sg_azure_static_connector" { }] } } + +resource "stackguardian_connector" "sg_azure_oidc_connector" { + count = (var.connector_type == "AZURE_OIDC") ? 1 : 0 + resource_name = var.cloud_connector_name + description = "Onboarding example of terraform-provider-stackguardian for AzureConnectorCloud" + settings = { + kind = var.connector_type, + config = [{ + armTenantId = var.armTenantId, + armSubscriptionId = var.armSubscriptionId, + armClientId = var.armClientId, + }] + } +} + +resource "stackguardian_connector" "sg_gcp_oidc_connector" { + count = (var.connector_type == "GCP_OIDC") ? 1 : 0 + resource_name = var.cloud_connector_name + description = "Onboarding example of terraform-provider-stackguardian for AzureConnectorCloud" + settings = { + kind = var.connector_type, + config = [{ + gcp_config_file_content = var.gcp_config_file_content + }] + } +} diff --git a/stackguardian_connector_cloud/variables.tf b/stackguardian_connector_cloud/variables.tf index 637da87..632ffa1 100644 --- a/stackguardian_connector_cloud/variables.tf +++ b/stackguardian_connector_cloud/variables.tf @@ -86,3 +86,11 @@ variable "role_external_id" { description = "external id of the aws rbac role" #default = ":" } + +################ +# GCP_OIDC Credentials + GCP_STATIC Credentials +################ +variable "gcp_config_file_content" { + type = string + description = "the gco config content gor the connector" +}