terraform-provider/docs/resources/identity_azure_auth.md

page_title, subcategory, description

page_title	subcategory	description
kms_identity_azure_auth Resource - terraform-provider	Identities	Create and manage identity azure auth in Hanzo KMS.

kms_identity_azure_auth (Resource)

Create and manage identity azure auth in Hanzo KMS.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_identity" "machine-identity-1" {
  name   = "machine-identity-1"
  role   = "admin"
  org_id = "601815be-6884-4ee4-86c7-bfc6415f2123"
}

resource "kms_identity_azure_auth" "azure-auth" {
  identity_id                   = kms_identity.machine-identity-1.id
  tenant_id                     = "<>"
  resource_url                  = "https://management.azure.com/"
  allowed_service_principal_ids = ["<>", "<>"]
  access_token_ttl              = 2592000
  access_token_max_ttl          = 2592000
}

Schema

Required

• identity_id (String) The ID of the identity to attach the configuration onto.
• tenant_id (String) The tenant ID for the Azure AD organization.

Optional

• access_token_max_ttl (Number) The maximum lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• access_token_num_uses_limit (Number) The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses. Default:0
• access_token_trusted_ips (Attributes List) A list of IPs or CIDR ranges that access tokens can be used from. You can use 0.0.0.0/0, to allow usage from any network address.. (see below for nested schema)
• access_token_ttl (Number) The lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• allowed_service_principal_ids (List of String) List of Azure AD service principal IDs that are allowed to authenticate with Hanzo KMS
• resource_url (String) The resource URL for the application registered in Azure AD. The value is expected to match the aud claim of the access token JWT later used in the login operation against Hanzo KMS. See the resource parameter for how the audience is set when requesting a JWT access token from the Azure Instance Metadata Service (IMDS) endpoint. In most cases, this value should be https://management.azure.com/ which is the default

Read-Only

• id (String) The ID of the azure auth

Nested Schema for access_token_trusted_ips

Optional:

• ip_address (String)

Import

Import is supported using the following syntax:

# This will import the resource by its identity ID
terraform import kms_identity_azure_auth.example <identity_id>