terraform-provider/docs/resources/project_identity_specific_privilege.md

page_title, subcategory, description

page_title	subcategory	description
kms_project_identity_specific_privilege Resource - terraform-provider	Projects	Create additional privileges for identities & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

kms_project_identity_specific_privilege (Resource)

Create additional privileges for identities & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_project" "example" {
  name = "example"
  slug = "example"
}

resource "kms_project_identity" "test-identity" {
  project_id  = kms_project.example.id
  identity_id = "<identity id>"
  roles = [
    {
      role_slug = "admin"
    }
  ]
}

resource "kms_project_identity_specific_privilege" "test-privilege" {
  project_slug = kms_project.example.slug
  identity_id  = kms_project_identity.test-identity.identity_id
  permissions_v2 = [
    {
      action   = ["edit"]
      subject  = "secret-folders",
      inverted = true,
    },
    {
      action  = ["read", "edit"]
      subject = "secrets",
      conditions = jsonencode({
        environment = {
          "$in" = ["dev", "prod"]
          "$eq" = "dev"
        }
        secretPath = {
          "$eq" = "/"
        }
      })
    },
  ]
}

Schema

Required

• identity_id (String) The identity id to create identity specific privilege
• project_slug (String) The slug of the project to create identity specific privilege

Optional

• is_temporary (Boolean) Flag to indicate the assigned specific privilege is temporary or not. When is_temporary is true fields temporary_mode, temporary_range and temporary_access_start_time is required.
• permission (Attributes) (DEPRECATED, USE permissions_v2. Refer to the migration guide in https://hanzo.ai/docs/internals/permissions#migrating-from-permission-v1-to-permission-v2) The permissions assigned to the project identity specific privilege (see below for nested schema)
• permissions_v2 (Attributes List) The permissions assigned to the project identity specific privilege. Refer to the documentation here https://hanzo.ai/docs/internals/permissions for its usage. (see below for nested schema)
• slug (String) The slug for the new privilege
• temporary_access_end_time (String) ISO time for which temporary access will end. Computed based on temporary_range and temporary_access_start_time
• temporary_access_start_time (String) ISO time for which temporary access should begin. The current time is used by default.
• temporary_mode (String) Type of temporary access given. Types: relative. Default: relative
• temporary_range (String) TTL for the temporary time. Eg: 1m, 1h, 1d. Default: 1h

Read-Only

• id (String) The ID of the privilege

Nested Schema for permission

Required:

• actions (List of String) Describe what action an entity can take. Enum: create,edit,delete,read
• conditions (Attributes) The conditions to scope permissions (see below for nested schema)
• subject (String) Describe what action an entity can take. Enum: role,member,groups,settings,integrations,webhooks,service-tokens,environments,tags,audit-logs,ip-allowlist,workspace,secrets,secret-rollback,secret-approval,secret-rotation,identity,certificate-authorities,certificates,certificate-policies,kms,pki-alerts,pki-collections

Nested Schema for permission.conditions

Required:

• environment (String) The environment slug this permission should allow.

Optional:

• secret_path (String) The secret path this permission should be scoped to

Nested Schema for permissions_v2

Required:

• action (Set of String) Describe what actions an entity can take.
• subject (String) Describe the entity the permission pertains to.

Optional:

• conditions (String) When specified, only matching conditions will be allowed to access given resource. Refer to the documentation in https://hanzo.ai/docs/internals/permissions#conditions for the complete list of supported properties and operators.
• inverted (Boolean) Whether rule forbids. Set this to true if permission forbids.