Skip to content

Releases: jamf/terraform-provider-jamfplatform

Release list

v0.32.0

v0.32.0 Latest
Latest

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 10 Sep 10:06
v0.32.0
a11476a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Action required: this provider has moved to the jamf namespace

v0.32.0 publishes as jamf/jamfplatform. Everything up to v0.31.2 published as
jamf-concepts/jamfplatform, and Terraform records the namespace in state alongside every
resource the provider manages, so editing source alone will not move a configuration across.

For each workspace and each state file holding jamfplatform resources, rewrite the state
first:

terraform state replace-provider jamf-concepts/jamfplatform jamf/jamfplatform

Then point source at the new namespace, leaving any version constraint as it is:

terraform {
  required_providers {
    jamfplatform = {
      source = "jamf/jamfplatform"
    }
  }
}

Then run terraform init.

OpenTofu works the same way, with tofu in place of terraform.

Full instructions, and the parts that are easy to get wrong:
Moving to the jamf namespace.

What stays the same

Nothing on the Jamf side changes. The same credentials, base_url, scope attribute, resources and
data sources apply on either side of the move.

Previous releases keep working. Everything from v0.12.1 to v0.31.2 is published under
jamf/jamfplatform as well, and the jamf-concepts/jamfplatform versions go on resolving, so
nothing breaks if you do nothing today. You can change namespace now and upgrade whenever you
like. New versions land only under jamf from v0.32.0 on.

The repository moved to
github.com/jamf/terraform-provider-jamfplatform.
Existing links and clone URLs redirect.

Also in this release

The migration warning that fired on every plan and apply is gone.

What's Changed

Full Changelog: v0.31.2...v0.32.0

Contributors

neilmartin83
Assets 18

v0.31.2

v0.31.2

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 10 Sep 07:01
v0.31.2
d7fda35
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.31.1...v0.31.2

Contributors

neilmartin83
Loading

v0.31.1

v0.31.1

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 09 Sep 09:01
v0.31.1
b5cdfcf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.31.0...v0.31.1

Contributors

neilmartin83 and dependabot
Loading

v0.31.0

v0.31.0

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 08 Sep 16:45
v0.31.0
116c08d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.30.0...v0.31.0

Contributors

neilmartin83
Loading

v0.30.0

v0.30.0

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 04 Sep 18:40
v0.30.0
414924f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.30.0: this provider is moving to the jamf namespace soon!

Advance notice of the namespace move, plus the fixes reported against v0.29.0.

The jamf namespace

A future release will publish this provider as jamf/jamfplatform in place of jamf-concepts/jamfplatform. Terraform records that namespace in state, so a version bump will not pick it up.

Change nothing today. Releases under jamf-concepts/jamfplatform keep working. From this release the provider warns you on every plan and apply.

When you upgrade to that release, in each workspace and state file holding jamfplatform resources:

  1. terraform state replace-provider jamf-concepts/jamfplatform jamf/jamfplatform
  2. Point source at jamf/jamfplatform in required_providers.
  3. terraform init -upgrade

Step 1 asks for confirmation and writes a backup; add -auto-approve for CI. OpenTofu works the same way, with tofu for terraform. Reference.

Platform API GA follow-up

v0.28.1 and earlier cannot reach the Jamf Platform API, which retired its beta gateway and revoked beta credentials at GA. Register a replacement API integration in Jamf Account, environment-scoped, and read Upgrading to the Platform API GA.

The provider now refuses the wrong integration scope at configure time, before an apply starts: a tenant-scoped credential aimed at Blueprints or Compliance Benchmarks stops in under a second with a named diagnostic, and that diagnostic names the swap, since tenant_id and environment_id are mutually exclusive. Jamf Account will not grant either family's permissions to a tenant-scoped integration. Platform devices, device groups and device actions still work under tenant_id.

Every "Required Jamf permissions" table now names the integration scope alongside the boxes to tick.

Fixes

  • An unstable upload URL failed a first apply with "Provider produced inconsistent final plan" on jamfplatform_pro_icon, jamfplatform_pro_self_service_branding_image and jamfplatform_pro_enrollment_customization. Apple's iTunes artwork CDN answers one URL with different bytes per request. All three now hash the bytes they upload, during apply. A local path is still hashed on every plan. A URL is not fetched during a plan, so the provider will not see a new image published behind an unchanged URL. Commit the file instead. (#373)
  • Import dropped attributes. jamfplatform_device_group left description and members null. jamfplatform_pro_account left the whole privileges grid null, so terraform plan -generate-config-out emitted a Full Access account with no privileges block. (#372)
  • Corrected the branding image documentation. Jamf Pro stores an uploaded branding image verbatim, so point image_file_source at your own file. The re-encode warning belongs to jamfplatform_pro_icon.
  • Fixed a nil-pointer crash on a Terraform client with no resource-identity support. Terraform 1.13 and later are unaffected.

Built on jamfplatform-go-sdk v0.22.0.

Full Changelog: v0.29.0...v0.30.0

Loading

v0.29.0: the Jamf Platform API GA release

v0.29.0: the Jamf Platform API GA release

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 04 Sep 07:59
v0.29.0
e26e9c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The Jamf Platform API reached general availability on 3 September 2026, and this release targets it.

Every configuration written against the public beta needs work before it will plan. The beta gateway has been retired and beta credentials revoked, so v0.28.1 and earlier can no longer reach the Platform API at all.

What you must do

For full details, see: Upgrading to the Platform API GA.

  1. Register a replacement API integration in Jamf Account and take its credentials. You cannot migrate a beta client. (how)
  2. Register it environment-scoped, and replace tenant_id with environment_id.
  3. Set base_url to https://{region}.api.jamfcloud.com.
  4. Back up state, then terraform state rm jamfplatform_pro_api_client and jamfplatform_pro_api_role. Until you do, every operation in the workspace fails.
  5. Delete the configuration blocks for the removed data sources, list resources and MDM command actions, listed under Breaking changes.
terraform {
  required_providers {
    jamfplatform = {
      source  = "Jamf-Concepts/jamfplatform"
      version = ">= 0.29.0"
    }
  }
}

provider "jamfplatform" {
  base_url       = "https://eu.api.jamfcloud.com" # or us., or apac.
  environment_id = var.jamf_environment_id
}

Track the latest release rather than pinning a version. The platform services behind this provider are updated on a schedule of their own, so a pinned provider drifts away from the API it talks to. A workspace pinned to a 0.29.0-rc.* candidate should move to 0.29.0.
Thank you to everyone who ran the provider during the public beta. Bug reports and feedback from beta participants shaped a substantial part of this release, including environment scope, proxy support and a range of resource behaviour.

Breaking changes

Several endpoints were unpublished at GA, so the constructs built on them have been removed: the jamfplatform_pro_api_client and jamfplatform_pro_api_role resources, with their data sources and list resources, and the jamfplatform_pro_api_role_privileges data source. Jamf Pro API roles and clients remain available through the Jamf Pro UI and API.

Fourteen MDM command actions have been removed: device_lock, enable_lost_mode, disable_lost_mode, play_lost_mode_sound, enable_remote_desktop, disable_remote_desktop, clear_restrictions_password, clear_passcode, delete_user, log_out_user, unlock_user_account, set_auto_admin_password, trigger_enhanced_log_collection and cancel_enhanced_log_collection.

environment_id joins tenant_id, and you set one or the other. Prefer environment_id: one integration covers a group of tenants across products, and it is the only scope that can hold the blueprint and compliance-benchmark permissions. Set neither to reach the new jamfplatform_account_* family, which nothing else reaches.

Four attribute changes, each covered in the guide:

  • jamfplatform_cbengine_benchmark resource and data source: target_device_group removed. Use target_device_groups.
  • jamfplatform_pro_patch_software_title resource and data source: category_name and site_name removed. On the resource, category_id and site_id no longer accept "0"; use -1 to clear.
  • jamfplatform_security_cloud_uem_connect resource: unmanaged_sync_threshold is now read-only. Delete the line from your configuration.
  • jamfplatform_pro_app_installer_titles data source: titles[*] drops thirteen attributes. Read them from the jamfplatform_pro_app_installer_title data source instead.

Two App Installer schema descriptions were corrected. quit_delay is in minutes, not seconds, so quit_delay = 300 is five hours. selected_version holds the version you pinned when update_behavior is MANUAL, and sits empty when it is AUTOMATIC.

New construct families

Jamf Security Cloud, jamfplatform_security_cloud_*: custom DNS zones, search domains and hostname mappings; ZTNA gateways, grouped gateways and access policy apps; device groups; UEM Connect; activation profiles; content categories. Read Jamf Security Cloud.

Jamf Account, jamfplatform_account_*: SSO domains and the identity provider connections that sign users in for them. The provider's first organization-scoped family, served only from the US gateway. Several behaviours come from Jamf Account rather than from the provider, including replacement on any connection change. Read Jamf Account single sign-on.

Jamf AI Governance, jamfplatform_ai_governance_*: the settings a blueprint delivers to Claude Code, Claude Desktop or OpenAI Codex, plus the product catalogue. Environment scope only. Read AI Governance policies.

Also in this release

  • Reverse proxy support: custom_headers and authorization_header_name. See Reverse proxies and custom headers.
  • A jamfplatform_pro_tenant_id data source, resolving the Jamf Pro tenant identifier from the configured scope.
  • jamfplatform_pro_patch_software_title now uses Jamf Pro's current patch configuration endpoints. App Installer gains retry and version-update actions, and a version argument for reading a historical version of a title.
  • The jamfplatform_pro_patch_policy list resource now warns about any policy it could not enumerate, instead of dropping it from the result.
  • The provider reports an incorrect base_url appropriately, rather than surfacing a generic network failure.
  • The required-permission tables on every construct page follow the GA capability model.
  • This release rewrites every schema description and example comment in a plainer voice. No attribute, value, default or behaviour changed with it.
  • The provider targets Jamf Pro 11.31.0 and builds on jamfplatform-go-sdk v0.21.0.

Full Changelog: v0.28.1...v0.29.0

Loading

v0.29.0-rc.7

v0.29.0-rc.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 12:17
v0.29.0-rc.7
d05b4b3

What's Changed

Full Changelog: v0.29.0-rc.6...v0.29.0-rc.7

Contributors

neilmartin83
Loading

v0.29.0-rc.6

v0.29.0-rc.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 18:33
v0.29.0-rc.6
ebdc846
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.29.0-rc.5...v0.29.0-rc.6

Contributors

neilmartin83 and dependabot
Loading

v0.29.0-rc.5

v0.29.0-rc.5

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 31 Aug 20:39
v0.29.0-rc.5
90d729a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: v0.29.0-rc.4...v0.29.0-rc.5

Contributors

neilmartin83
Loading

v0.29.0-rc.4

v0.29.0-rc.4

Choose a tag to compare

View all tags
@neilmartin83 neilmartin83 released this 30 Aug 20:46
v0.29.0-rc.4
5eae2c2

Preparing for the Platform API GA

This pre-release targets the GA gateway. Every configuration written against the public beta needs changes, so please read the migration guide before upgrading:

📘 Preparing for the Platform API GA

The Platform API is still moving ahead of GA. That guide is provisional and may change without notice.

⚠️ Breaking changes

  1. 31 constructs were removed — 4 resources, 10 data sources, 3 list resources and 14 MDM command actions — because the endpoints behind them were unpublished. A workspace still holding one of the removed resources in state cannot produce a plan of any kind, including plan -destroy, and the error reads like a Terraform bug. It is not. Remove the state entries with terraform state rm; the guide lists every affected type and the exact commands.
  2. base_url must change to https://{region}.api.jamfcloud.com, in the same change as the provider upgrade. The beta host is not supported on this version, and the GA host is not supported on earlier ones.
  3. Beta API integration credentials are revoked at GA and cannot be migrated. They still work until then, including against the GA host — so this release can be adopted now, and the credential swap deferred to GA.
  4. target_device_group on jamfplatform_cbengine_benchmark is replaced by target_device_groups. State migrates automatically; only the configuration needs editing.

At GA you will also register a replacement integration and, for most configurations, swap tenant_id for environment_id — mandatory if you manage blueprints or compliance benchmarks, whose permissions cannot be granted to a tenant-scoped integration. Nothing to do before then.

Installing

Terraform never resolves to a pre-release, so the version must be named exactly — ~> 0.29 and an unconstrained required_providers block both resolve to v0.28.1, which is bound to the retired beta gateway:

terraform {
  required_providers {
    jamfplatform = {
      source  = "Jamf-Concepts/jamfplatform"
      version = "0.29.0-rc.4"
    }
  }
}

Then terraform init -upgrade. A stable v0.29.0 follows shortly after GA; relax the constraint once it is out.

Also in this release

Jamf Security Cloud (custom DNS, ZTNA gateways and access policies, device groups, UEM Connect), Jamf AI Governance policies, environment_id scope, and proxy support via custom_headers. Built against Jamf Pro 11.31.0 and Classic API 11.28.0. All additive — see the guide's "Additions since v0.28.1", and the full commit log below.

Loading