|
| 1 | +--- |
| 2 | +title: Reference for the teleport_integration Terraform resource |
| 3 | +sidebar_label: integration |
| 4 | +description: This page describes the supported values of the teleport_integration resource of the Teleport Terraform provider. |
| 5 | +--- |
| 6 | + |
| 7 | +{/*Auto-generated file. Do not edit.*/} |
| 8 | +{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/} |
| 9 | + |
| 10 | +This page describes the supported values of the teleport_integration resource of the Teleport Terraform provider. |
| 11 | + |
| 12 | + |
| 13 | + |
| 14 | + |
| 15 | +## Example Usage |
| 16 | + |
| 17 | +```hcl |
| 18 | +resource "teleport_integration" "aws_oidc" { |
| 19 | + version = "v1" |
| 20 | + sub_kind = "aws-oidc" |
| 21 | + metadata = { |
| 22 | + name = "example" |
| 23 | + description = "AWS OIDC integration" |
| 24 | + labels = { |
| 25 | + env = "dev" |
| 26 | + } |
| 27 | + } |
| 28 | +
|
| 29 | + spec = { |
| 30 | + aws_oidc = { |
| 31 | + role_arn = "arn:aws:iam::123456789012:role/example-role-name" |
| 32 | + } |
| 33 | + } |
| 34 | +} |
| 35 | +
|
| 36 | +resource "teleport_integration" "azure_oidc" { |
| 37 | + version = "v1" |
| 38 | + sub_kind = "azure-oidc" |
| 39 | + metadata = { |
| 40 | + name = "azure-oidc" |
| 41 | + description = "Example Azure OIDC integration" |
| 42 | + labels = { |
| 43 | + env = "dev" |
| 44 | + } |
| 45 | + } |
| 46 | +
|
| 47 | + spec = { |
| 48 | + azure_oidc = { |
| 49 | + // Azure Entra ID tenant ID |
| 50 | + tenant_id = "a1b2c3d4-f2e4-97a8-9abc-1234567890ab" |
| 51 | + // Azure enterprise application client ID |
| 52 | + client_id = "7f12e3b5-6789-4abc-def0-112233445566" |
| 53 | + } |
| 54 | + } |
| 55 | +} |
| 56 | +
|
| 57 | +resource "teleport_integration" "aws_roles_anywhere" { |
| 58 | + version = "v1" |
| 59 | + sub_kind = "aws-ra" |
| 60 | + metadata = { |
| 61 | + name = "aws-ra" |
| 62 | + description = "Example AWS Roles Anywhere integration" |
| 63 | + labels = { |
| 64 | + env = "dev" |
| 65 | + } |
| 66 | + } |
| 67 | +
|
| 68 | + spec = { |
| 69 | + aws_ra = { |
| 70 | + profile_sync_config = { |
| 71 | + // sync AWS profiles as Teleport applications |
| 72 | + enabled = true |
| 73 | + profile_accepts_role_session_name = false |
| 74 | + profile_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/<random-uuid>" |
| 75 | + role_arn = "arn:aws:iam::123456789012:role/example-role-name" |
| 76 | + // only sync AWS profiles as Teleport applications if the profile name matches |
| 77 | + profile_name_filters = [ |
| 78 | + "teleport-*", // supports globs |
| 79 | + "^teleport-.*$", // and regex if the string is enclosed in regex anchors |
| 80 | + ] |
| 81 | + } |
| 82 | + trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/<random-uuid>" |
| 83 | + } |
| 84 | + } |
| 85 | +} |
| 86 | +``` |
| 87 | + |
| 88 | +{/* schema generated by tfplugindocs */} |
| 89 | +## Schema |
| 90 | + |
| 91 | +### Required |
| 92 | + |
| 93 | +- `metadata` (Attributes) Metadata is resource metadata (see [below for nested schema](#nested-schema-for-metadata)) |
| 94 | +- `spec` (Attributes) Spec is an Integration specification. (see [below for nested schema](#nested-schema-for-spec)) |
| 95 | +- `sub_kind` (String) SubKind is an optional resource sub kind, used in some resources |
| 96 | +- `version` (String) Version is the API version used to create the resource. It must be specified. Based on this version, Teleport will apply different defaults on resource creation or deletion. It must be an integer prefixed by "v". For example: `v1` |
| 97 | + |
| 98 | +### Nested Schema for `metadata` |
| 99 | + |
| 100 | +Required: |
| 101 | + |
| 102 | +- `name` (String) Name is an object name |
| 103 | + |
| 104 | +Optional: |
| 105 | + |
| 106 | +- `description` (String) Description is object description |
| 107 | +- `expires` (String) Expires is a global expiry time header can be set on any resource in the system. |
| 108 | +- `labels` (Map of String) Labels is a set of labels |
| 109 | + |
| 110 | + |
| 111 | +### Nested Schema for `spec` |
| 112 | + |
| 113 | +Optional: |
| 114 | + |
| 115 | +- `aws_oidc` (Attributes) AWSOIDC contains the specific fields to handle the AWS OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specaws_oidc)) |
| 116 | +- `aws_ra` (Attributes) AWSRA contains the specific fields to handle the AWS Roles Anywhere Integration subkind. (see [below for nested schema](#nested-schema-for-specaws_ra)) |
| 117 | +- `azure_oidc` (Attributes) AzureOIDC contains the specific fields to handle the Azure OIDC Integration subkind (see [below for nested schema](#nested-schema-for-specazure_oidc)) |
| 118 | + |
| 119 | +### Nested Schema for `spec.aws_oidc` |
| 120 | + |
| 121 | +Optional: |
| 122 | + |
| 123 | +- `audience` (String) Audience is used to record a name of a plugin or a discover service in Teleport that depends on this integration. Audience value can either be empty or "aws-identity-center". Preset audience may impose specific behavior on the integration CRUD API, such as preventing integration from update or deletion. Empty audience value should be treated as a default and backward-compatible behavior of the integration. |
| 124 | +- `issuer_s3_uri` (String) IssuerS3URI is the Identity Provider that was configured in AWS. This bucket/prefix/* files must be publicly accessible and contain the following: > .well-known/openid-configuration > .well-known/jwks Format: `s3://<bucket>/<prefix>` Optional. The proxy's endpoint is used if it is not specified. DEPRECATED: Thumbprint validation requires the issuer to update the IdP in AWS everytime the issuer changes the certificate. Amazon had some whitelisted providers where the thumbprint was ignored. S3 hosted providers was in that list. Amazon is now trusting all the root certificate authorities, and this workaround is no longer needed. DELETE IN 18.0. |
| 125 | +- `role_arn` (String) RoleARN contains the Role ARN used to set up the Integration. This is the AWS Role that Teleport will use to issue tokens for API Calls. |
| 126 | + |
| 127 | + |
| 128 | +### Nested Schema for `spec.aws_ra` |
| 129 | + |
| 130 | +Optional: |
| 131 | + |
| 132 | +- `profile_sync_config` (Attributes) ProfileSyncConfig contains the configuration for the AWS Roles Anywhere Profile sync. This is used to create AWS Roles Anywhere profiles as application servers. (see [below for nested schema](#nested-schema-for-specaws_raprofile_sync_config)) |
| 133 | +- `trust_anchor_arn` (String) TrustAnchorARN contains the AWS IAM Roles Anywhere Trust Anchor ARN used to set up the Integration. |
| 134 | + |
| 135 | +### Nested Schema for `spec.aws_ra.profile_sync_config` |
| 136 | + |
| 137 | +Optional: |
| 138 | + |
| 139 | +- `enabled` (Boolean) Enabled is set to true if this integration should sync profiles as application servers. |
| 140 | +- `profile_accepts_role_session_name` (Boolean) ProfileAcceptsRoleSessionName indicates whether the profile accepts a custom Role Session name. |
| 141 | +- `profile_arn` (String) ProfileARN is the ARN of the Roles Anywhere Profile used to generate credentials to access the AWS APIs. |
| 142 | +- `profile_name_filters` (List of String) ProfileNameFilters is a list of filters applied to the profile name. Only matching profiles will be synchronized as application servers. If empty, no filtering is applied. Filters can be globs, for example: profile* *name* Or regexes if they're prefixed and suffixed with ^ and $, for example: ^profile.*$ ^.*name.*$ |
| 143 | +- `role_arn` (String) RoleARN is the ARN of the IAM Role to assume when accessing the AWS APIs. |
| 144 | + |
| 145 | + |
| 146 | + |
| 147 | +### Nested Schema for `spec.azure_oidc` |
| 148 | + |
| 149 | +Optional: |
| 150 | + |
| 151 | +- `client_id` (String) ClientID specifies the ID of Azure enterprise application (client) that corresponds to this plugin. |
| 152 | +- `tenant_id` (String) TenantID specifies the ID of Entra Tenant (Directory) that this plugin integrates with. |
0 commit comments