Skip to content

Commit 090ca51

Browse files
areedareed
authored
Add smallstep_credential (#37)
1 parent d62911a commit 090ca51

File tree

13 files changed

+2615
-377
lines changed

13 files changed

+2615
-377
lines changed

‎docs/data-sources/credential.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "smallstep_credential Data Source - terraform-provider-smallstep"
4+
subcategory: ""
5+
description: |-
6+
A certificate key pair.
7+
---
8+
9+
# smallstep_credential (Data Source)
10+
11+
A certificate key pair.
12+
13+
## Example Usage
14+
15+
```terraform
16+
data "smallstep_credential" "device_cred" {
17+
id = "b63cd688-c803-4e32-babe-e5940b4bd832"
18+
}
19+
```
20+
21+
<!-- schema generated by tfplugindocs -->
22+
## Schema
23+
24+
### Required
25+
26+
- `id` (String) A UUID identifying this credential. Read only.
27+
28+
### Read-Only
29+
30+
- `certificate` (Attributes) Configuration for the certificate of a managed credential. (see [below for nested schema](#nestedatt--certificate))
31+
- `files` (Attributes) Configuration for files that will be written when a managed credential is issued. (see [below for nested schema](#nestedatt--files))
32+
- `key` (Attributes) The attributes of the cryptographic key. Key `type` and `protection` are required unless the `pubFile` is set. (see [below for nested schema](#nestedatt--key))
33+
- `policy` (Attributes) Policy to select the devices an account is assigned to. An empty policy indicates an account will be provisioned for all devices. (see [below for nested schema](#nestedatt--policy))
34+
- `slug` (String)
35+
36+
<a id="nestedatt--certificate"></a>
37+
### Nested Schema for `certificate`
38+
39+
Read-Only:
40+
41+
- `authority_id` (String) A UUID identifying the authority that issues certificates for the credential.
42+
- `duration` (String) The certificate lifetime. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
43+
- `x509` (Attributes) Populate certificate fields using using static names or device metadata. (see [below for nested schema](#nestedatt--certificate--x509))
44+
45+
<a id="nestedatt--certificate--x509"></a>
46+
### Nested Schema for `certificate.x509`
47+
48+
Read-Only:
49+
50+
- `common_name` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--common_name))
51+
- `country` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--country))
52+
- `locality` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--locality))
53+
- `organization` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--organization))
54+
- `organizational_unit` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--organizational_unit))
55+
- `postal_code` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--postal_code))
56+
- `province` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--province))
57+
- `sans` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--sans))
58+
- `street_address` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--street_address))
59+
60+
<a id="nestedatt--certificate--x509--common_name"></a>
61+
### Nested Schema for `certificate.x509.common_name`
62+
63+
Read-Only:
64+
65+
- `device_metadata` (String) A value populated from a key in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user. If no value is found in the device's metadata at the specified key then the static value will be used.
66+
- `static` (String) A literal value.
67+
68+
69+
<a id="nestedatt--certificate--x509--country"></a>
70+
### Nested Schema for `certificate.x509.country`
71+
72+
Read-Only:
73+
74+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
75+
- `static` (List of String) Literal values.
76+
77+
78+
<a id="nestedatt--certificate--x509--locality"></a>
79+
### Nested Schema for `certificate.x509.locality`
80+
81+
Read-Only:
82+
83+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
84+
- `static` (List of String) Literal values.
85+
86+
87+
<a id="nestedatt--certificate--x509--organization"></a>
88+
### Nested Schema for `certificate.x509.organization`
89+
90+
Read-Only:
91+
92+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
93+
- `static` (List of String) Literal values.
94+
95+
96+
<a id="nestedatt--certificate--x509--organizational_unit"></a>
97+
### Nested Schema for `certificate.x509.organizational_unit`
98+
99+
Read-Only:
100+
101+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
102+
- `static` (List of String) Literal values.
103+
104+
105+
<a id="nestedatt--certificate--x509--postal_code"></a>
106+
### Nested Schema for `certificate.x509.postal_code`
107+
108+
Read-Only:
109+
110+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
111+
- `static` (List of String) Literal values.
112+
113+
114+
<a id="nestedatt--certificate--x509--province"></a>
115+
### Nested Schema for `certificate.x509.province`
116+
117+
Read-Only:
118+
119+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
120+
- `static` (List of String) Literal values.
121+
122+
123+
<a id="nestedatt--certificate--x509--sans"></a>
124+
### Nested Schema for `certificate.x509.sans`
125+
126+
Read-Only:
127+
128+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
129+
- `static` (List of String) Literal values.
130+
131+
132+
<a id="nestedatt--certificate--x509--street_address"></a>
133+
### Nested Schema for `certificate.x509.street_address`
134+
135+
Read-Only:
136+
137+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
138+
- `static` (List of String) Literal values.
139+
140+
141+
142+
143+
<a id="nestedatt--files"></a>
144+
### Nested Schema for `files`
145+
146+
Read-Only:
147+
148+
- `crt_file` (String) The filepath where the certificate is to be stored.
149+
- `gid` (Number) GID of the files where the credential is stored.
150+
- `key_file` (String) The filepath where the key is to be stored.
151+
- `key_format` (String) The format used to encode the private key. For X509 keys the default format is PKCS#8. The classic format is PKCS#1 for RSA keys, SEC 1 for ECDSA keys, and PKCS#8 for ED25519 keys. For SSH keys the default format is always the OPENSSH format. When a hardware module is used to store the keys the default will be a JSON representation of the key, except on Linux tss2 will be used. Allowed values: `DEFAULT` `PKCS8` `OPENSSH` `TSS2` `CLASSIC`
152+
- `mode` (Number) Permission bits of the files where the credential is stored.
153+
- `root_file` (String) The filepath where the root certificate is to be stored.
154+
- `uid` (Number) UID of the files where the credential is stored.
155+
156+
157+
<a id="nestedatt--key"></a>
158+
### Nested Schema for `key`
159+
160+
Read-Only:
161+
162+
- `protection` (String) Whether to use a hardware module to store the private key. If set to `NONE` no hardware module will be used. `HARDWARE_WITH_FALLBACK` can only be used with the key file format `DEFAULT`. Allowed values: `NONE` `HARDWARE` `HARDWARE_WITH_FALLBACK` `HARDWARE_ATTESTED`
163+
- `pub_file` (String) A CSR or SSH public key to use instead of generating one. Cannot be used in conjunction with key type, key protection, key file or key file format.
164+
- `type` (String) The key type used. The current default type is `ECDSA_P256` but is not fixed at the time the credential resource is created - new keys generated for this credential in the future may have a different type. Allowed values: `DEFAULT` `ECDSA_P256` `ECDSA_P384` `ECDSA_P521` `RSA_2048` `RSA_3072` `RSA_4096` `ED25519`
165+
166+
167+
<a id="nestedatt--policy"></a>
168+
### Nested Schema for `policy`
169+
170+
Read-Only:
171+
172+
- `assurance` (List of String) Assurance levels that devices must match. Allowed values: `normal` `high`
173+
- `os` (List of String) Operating systems that devices must match. Allowed values: `Linux` `Windows` `macOS` `iOS` `tvOS` `watchOS` `visionOS`
174+
- `ownership` (List of String) Ownership values that devices must match. Allowed values: `company` `user`
175+
- `source` (List of String) Registration sources that devices must match. Allowed values: `End-User` `Smallstep API` `Smallstep Agent` `Jamf` `Intune`
176+
- `tags` (List of String) Tags that devices must match.

‎docs/resources/credential.md‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "smallstep_credential Resource - terraform-provider-smallstep"
4+
subcategory: ""
5+
description: |-
6+
A certificate key pair.
7+
---
8+
9+
# smallstep_credential (Resource)
10+
11+
A certificate key pair.
12+
13+
## Example Usage
14+
15+
```terraform
16+
resource "smallstep_credential" "test" {
17+
slug = "slug"
18+
19+
certificate = {
20+
authority_id = smallstep_authory.staging.id
21+
duration = "168h"
22+
x509 = {
23+
common_name = {
24+
device_metadata = "smallstep:identity"
25+
}
26+
sans = {
27+
device_metadata = ["smallstep:identity"]
28+
}
29+
}
30+
}
31+
32+
key = {
33+
type = "ECDSA_P384"
34+
protection = "HARDWARE_ATTESTED"
35+
}
36+
37+
policy = {
38+
os = ["Linux"]
39+
ownership = ["company"]
40+
}
41+
42+
files = {
43+
root_file = "/var/ssl/ca.pem"
44+
}
45+
}
46+
```
47+
48+
<!-- schema generated by tfplugindocs -->
49+
## Schema
50+
51+
### Required
52+
53+
- `certificate` (Attributes) Configuration for the certificate of a managed credential. (see [below for nested schema](#nestedatt--certificate))
54+
- `key` (Attributes) The attributes of the cryptographic key. Key `type` and `protection` are required unless the `pubFile` is set. (see [below for nested schema](#nestedatt--key))
55+
- `slug` (String)
56+
57+
### Optional
58+
59+
- `files` (Attributes) Configuration for files that will be written when a managed credential is issued. (see [below for nested schema](#nestedatt--files))
60+
- `policy` (Attributes) Policy to select the devices an account is assigned to. An empty policy indicates an account will be provisioned for all devices. (see [below for nested schema](#nestedatt--policy))
61+
62+
### Read-Only
63+
64+
- `id` (String) A UUID identifying this credential. Read only.
65+
66+
<a id="nestedatt--certificate"></a>
67+
### Nested Schema for `certificate`
68+
69+
Required:
70+
71+
- `x509` (Attributes) Populate certificate fields using using static names or device metadata. (see [below for nested schema](#nestedatt--certificate--x509))
72+
73+
Optional:
74+
75+
- `authority_id` (String) A UUID identifying the authority that issues certificates for the credential.
76+
- `duration` (String) The certificate lifetime. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
77+
78+
<a id="nestedatt--certificate--x509"></a>
79+
### Nested Schema for `certificate.x509`
80+
81+
Required:
82+
83+
- `common_name` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--common_name))
84+
85+
Optional:
86+
87+
- `country` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--country))
88+
- `locality` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--locality))
89+
- `organization` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--organization))
90+
- `organizational_unit` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--organizational_unit))
91+
- `postal_code` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--postal_code))
92+
- `province` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--province))
93+
- `sans` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--sans))
94+
- `street_address` (Attributes) (see [below for nested schema](#nestedatt--certificate--x509--street_address))
95+
96+
<a id="nestedatt--certificate--x509--common_name"></a>
97+
### Nested Schema for `certificate.x509.common_name`
98+
99+
Optional:
100+
101+
- `device_metadata` (String) A value populated from a key in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user. If no value is found in the device's metadata at the specified key then the static value will be used.
102+
- `static` (String) A literal value.
103+
104+
105+
<a id="nestedatt--certificate--x509--country"></a>
106+
### Nested Schema for `certificate.x509.country`
107+
108+
Optional:
109+
110+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
111+
- `static` (List of String) Literal values.
112+
113+
114+
<a id="nestedatt--certificate--x509--locality"></a>
115+
### Nested Schema for `certificate.x509.locality`
116+
117+
Optional:
118+
119+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
120+
- `static` (List of String) Literal values.
121+
122+
123+
<a id="nestedatt--certificate--x509--organization"></a>
124+
### Nested Schema for `certificate.x509.organization`
125+
126+
Optional:
127+
128+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
129+
- `static` (List of String) Literal values.
130+
131+
132+
<a id="nestedatt--certificate--x509--organizational_unit"></a>
133+
### Nested Schema for `certificate.x509.organizational_unit`
134+
135+
Optional:
136+
137+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
138+
- `static` (List of String) Literal values.
139+
140+
141+
<a id="nestedatt--certificate--x509--postal_code"></a>
142+
### Nested Schema for `certificate.x509.postal_code`
143+
144+
Optional:
145+
146+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
147+
- `static` (List of String) Literal values.
148+
149+
150+
<a id="nestedatt--certificate--x509--province"></a>
151+
### Nested Schema for `certificate.x509.province`
152+
153+
Optional:
154+
155+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
156+
- `static` (List of String) Literal values.
157+
158+
159+
<a id="nestedatt--certificate--x509--sans"></a>
160+
### Nested Schema for `certificate.x509.sans`
161+
162+
Optional:
163+
164+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
165+
- `static` (List of String) Literal values.
166+
167+
168+
<a id="nestedatt--certificate--x509--street_address"></a>
169+
### Nested Schema for `certificate.x509.street_address`
170+
171+
Optional:
172+
173+
- `device_metadata` (List of String) Values populated from keys in the device's metadata. The special value `smallstep:identity` refers to the device's assigned user.
174+
- `static` (List of String) Literal values.
175+
176+
177+
178+
179+
<a id="nestedatt--key"></a>
180+
### Nested Schema for `key`
181+
182+
Optional:
183+
184+
- `protection` (String) Whether to use a hardware module to store the private key. If set to `NONE` no hardware module will be used. `HARDWARE_WITH_FALLBACK` can only be used with the key file format `DEFAULT`. Allowed values: `NONE` `HARDWARE` `HARDWARE_WITH_FALLBACK` `HARDWARE_ATTESTED`
185+
- `pub_file` (String) A CSR or SSH public key to use instead of generating one. Cannot be used in conjunction with key type, key protection, key file or key file format.
186+
- `type` (String) The key type used. The current default type is `ECDSA_P256` but is not fixed at the time the credential resource is created - new keys generated for this credential in the future may have a different type. Allowed values: `DEFAULT` `ECDSA_P256` `ECDSA_P384` `ECDSA_P521` `RSA_2048` `RSA_3072` `RSA_4096` `ED25519`
187+
188+
189+
<a id="nestedatt--files"></a>
190+
### Nested Schema for `files`
191+
192+
Optional:
193+
194+
- `crt_file` (String) The filepath where the certificate is to be stored.
195+
- `gid` (Number) GID of the files where the credential is stored.
196+
- `key_file` (String) The filepath where the key is to be stored.
197+
- `key_format` (String) The format used to encode the private key. For X509 keys the default format is PKCS#8. The classic format is PKCS#1 for RSA keys, SEC 1 for ECDSA keys, and PKCS#8 for ED25519 keys. For SSH keys the default format is always the OPENSSH format. When a hardware module is used to store the keys the default will be a JSON representation of the key, except on Linux tss2 will be used. Allowed values: `DEFAULT` `PKCS8` `OPENSSH` `TSS2` `CLASSIC`
198+
- `mode` (Number) Permission bits of the files where the credential is stored.
199+
- `root_file` (String) The filepath where the root certificate is to be stored.
200+
- `uid` (Number) UID of the files where the credential is stored.
201+
202+
203+
<a id="nestedatt--policy"></a>
204+
### Nested Schema for `policy`
205+
206+
Optional:
207+
208+
- `assurance` (List of String) Assurance levels that devices must match. Allowed values: `normal` `high`
209+
- `os` (List of String) Operating systems that devices must match. Allowed values: `Linux` `Windows` `macOS` `iOS` `tvOS` `watchOS` `visionOS`
210+
- `ownership` (List of String) Ownership values that devices must match. Allowed values: `company` `user`
211+
- `source` (List of String) Registration sources that devices must match. Allowed values: `End-User` `Smallstep API` `Smallstep Agent` `Jamf` `Intune`
212+
- `tags` (List of String) Tags that devices must match.
213+
214+
## Import
215+
216+
Import is supported using the following syntax:
217+
218+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
219+
220+
```shell
221+
terraform import smallstep_credential.device_cred c1161f78-d251-401e-b17c-fe38fc26ae7b
222+
```

0 commit comments

Comments
 (0)