Skip to content

Commit a9e66bb

Browse files
xingluwxingluw
authored
Merge pull request #103 from hashicorp/xw-basic
Quickstart Terraform example
2 parents 4243dd9 + f77daac commit a9e66bb

File tree

3 files changed

+142
-2
lines changed

3 files changed

+142
-2
lines changed

‎README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,19 @@
22
# Boundary Reference Architectures
33
This repo contains community-supported examples for deploying Boundary on different platforms - including AWS, Microsoft Azure, Google Cloud Platform, Kubernetes, and Docker Compose. Most examples use Terraform for provisioning and configuring Boundary.
44

5+
If you are looking for a simple example for HCP/OSS Boundary, see the `quickstart` folder
6+
57
Disclaimer: the examples in this repository are for demonstration purposes only to convey how to get Boundary up and running
68
on popular cloud and container platforms. They're not officially supported modules or designed to be "production" ready. They're
79
here as a starting point and assume end-users have experience with each example platform.
810

911
## Contributing
10-
Community contributions to this repository are encouraged and can be added to `deployment/`.
12+
Community contributions to this repository are encouraged and can be added to `deployment/` and `configuration/`.
1113

1214

1315
## Contents
14-
- `deployment/`: Contains example configurations for deploying and configuring Boundary.
16+
- `deployment/`: Contains example configurations for deploying and configuring Boundary.
17+
- `configuration/`: Contains examples for configuring Boundary resources assuming you already have a deployed environment, such as for HCP Boundary and Dev mode.
1518

1619
## Reference
1720
![](arch.png)

‎configuration/basic_user/main.tf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# This Terraform script for HCP/OSS Boundary sets up a new fully-privileged user with a new password auth method.
2+
# A user must be associated with an account, which belongs to an auth method. For a user to have full permissions
3+
# at each scope level, the user must be added to a role in each scope.
4+
#
5+
# Prerequisites: The Boundary cluster must be deployed.
6+
# Note: This script is only for learning purposes and is not recommended for a production deployment
7+
8+
terraform {
9+
required_providers {
10+
boundary = {
11+
source = "hashicorp/boundary"
12+
version = "1.1.4"
13+
}
14+
}
15+
}
16+
17+
# Boundary cluster information
18+
provider "boundary" {
19+
addr = "https://xxxx.boundary.hashicorp.cloud" # Replace with cluster URL
20+
auth_method_id = "ampw_xxxxxxx" # Replace with auth method ID
21+
password_auth_method_login_name = "admin" # Replace with login name
22+
password_auth_method_password = "password" # Replace with password
23+
}
24+
25+
# Org scope setup, which belongs to the global scope
26+
resource "boundary_scope" "MyOrg" {
27+
scope_id = "global"
28+
name = "MyOrgName"
29+
auto_create_admin_role = true
30+
}
31+
32+
# Project scope setup, which belongs to the MyOrg scope
33+
resource "boundary_scope" "MyProject" {
34+
scope_id = boundary_scope.MyOrg.id
35+
name = "MyProjectName"
36+
auto_create_admin_role = true
37+
}
38+
39+
40+
#======================================================================================
41+
# User Setup
42+
#======================================================================================
43+
44+
# Auth Method setup in the global scope
45+
resource "boundary_auth_method" "MyAuthMethod" {
46+
scope_id = "global"
47+
name = "MyAuthMethodName"
48+
type = "password"
49+
}
50+
51+
# Account setup with MyAuthMethod
52+
resource "boundary_account_password" "MyAccount" {
53+
auth_method_id = boundary_auth_method.MyAuthMethod.id
54+
type = "password"
55+
name = "MyAccountName"
56+
login_name = "myadmin" # Replace with desired login name
57+
password = "password" # Replace with desired password
58+
}
59+
60+
# User setup with MyAccount in the global scope
61+
resource "boundary_user" "MyUser" {
62+
name = "MyUserName"
63+
account_ids = [boundary_account_password.MyAccount.id]
64+
scope_id = "global"
65+
}
66+
67+
# Global role creation with MyUser as the principal
68+
# Principals in this role have full permissions to Global
69+
resource "boundary_role" "MyGlobalRole" {
70+
name = "MyGlobalRoleName"
71+
principal_ids = [boundary_user.MyUser.id]
72+
scope_id = "global"
73+
grant_strings = ["id=*;type=*;actions=*"]
74+
}
75+
76+
# Org role creation with MyUser as the principal
77+
# Principals in this role have full permissions to MyOrg
78+
resource "boundary_role" "MyOrgRole" {
79+
name = "MyOrgRoleName"
80+
principal_ids = [boundary_user.MyUser.id]
81+
scope_id = boundary_scope.MyOrg.id
82+
grant_strings = ["id=*;type=*;actions=*"]
83+
}
84+
85+
# Project role creation with MyUser as the principal
86+
# Principals in this role have full permissions to Global
87+
resource "boundary_role" "MyProjectRole" {
88+
name = "MyProjectRoleName"
89+
principal_ids = [boundary_user.MyUser.id]
90+
scope_id = boundary_scope.MyProject.id
91+
grant_strings = ["id=*;type=*;actions=*"]
92+
}

‎configuration/quickstart/main.tf‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# This Terraform script for HCP/OSS Boundary sets up the basic Org, Project, and Target.
2+
#
3+
# Prerequisites: The Boundary cluster must be deployed.
4+
# Note: This script is only for learning purposes and is not recommended for a production deployment
5+
6+
terraform {
7+
required_providers {
8+
boundary = {
9+
source = "hashicorp/boundary"
10+
version = "1.1.4"
11+
}
12+
}
13+
}
14+
15+
# Boundary cluster information
16+
provider "boundary" {
17+
addr = "https://xxxx.boundary.hashicorp.cloud" # Replace with cluster URL
18+
auth_method_id = "ampw_xxxxxxx" # Replace with auth method ID
19+
password_auth_method_login_name = "admin" # Replace with login name
20+
password_auth_method_password = "password" # Replace with password
21+
}
22+
23+
# Org scope setup, which belongs to the global scope
24+
resource "boundary_scope" "MyOrg" {
25+
scope_id = "global"
26+
name = "MyOrgName"
27+
auto_create_admin_role = true
28+
}
29+
30+
# Project scope setup, which belongs to the MyOrg scope
31+
resource "boundary_scope" "MyProject" {
32+
scope_id = boundary_scope.MyOrg.id
33+
name = "MyProjectName"
34+
auto_create_admin_role = true
35+
}
36+
37+
# Target setup, which belongs to the MyProject scope
38+
resource "boundary_target" "MyTarget" {
39+
scope_id = boundary_scope.MyProject.id
40+
name = "MyTargetName"
41+
type = "tcp"
42+
address = "127.0.0.1" # Replace with address
43+
default_port = "22" # Replace with port
44+
}
45+

0 commit comments

Comments
 (0)