82 lines
3.0 KiB
HCL
82 lines
3.0 KiB
HCL
module "edisp" {
|
|
source = "github.com/philips-internal/terraform-edi-platform-secrets?ref=v0.1.2"
|
|
|
|
region = var.region
|
|
environment = var.environment
|
|
edisp_azure_vault_name = var.edisp_azure_vault_name
|
|
edisp_resource_group_name = var.edisp_resource_group_name
|
|
edisp_azure_automation_account_name = var.edisp_azure_automation_account_name
|
|
variables = ["TENANTS", "ORG-ID", "EDI-ORG-ID", "EDIPLATFORM-LOGGING-LOGDRAINER-BASE-URI"]
|
|
}
|
|
|
|
data "hsdp_iam_org" "proposition_org" {
|
|
organization_id = module.edisp.variables["ORG-ID"]
|
|
}
|
|
|
|
resource "hsdp_iam_proposition" "foundation_envoy_cicd_prop" {
|
|
name = "FOUNDATION-OAUTH-CI-TF-GATED"
|
|
description = "Proposition id Created for Envoy CD through terraform"
|
|
organization_id = hsdp_iam_org.foundation_envoy_nightly_org.id
|
|
}
|
|
|
|
resource "hsdp_iam_org" "foundation_envoy_nightly_org" {
|
|
name = "Oauth-CI-Org-TF-GATED"
|
|
description = "Envoy Nightly Organization to run envoy nightly tests, Do not modify manually"
|
|
parent_org_id = data.hsdp_iam_org.proposition_org.id
|
|
}
|
|
|
|
resource "hsdp_iam_application" "foundation_envoy_nightly_app" {
|
|
name = "OAUTH-CI-APP-TF-GATED"
|
|
description = "Envoy Nightly application for Automation Tests, Do not modify manually"
|
|
proposition_id = hsdp_iam_proposition.foundation_envoy_cicd_prop.id
|
|
}
|
|
|
|
resource "hsdp_iam_service" "envoy_ci_service" {
|
|
name = "oauth-cicd-service-GATED"
|
|
description = "Service Client for Envoy Nightly Tests, Do not modify manually"
|
|
application_id = hsdp_iam_application.foundation_envoy_nightly_app.id
|
|
|
|
validity = 12
|
|
|
|
scopes = ["openid"]
|
|
default_scopes = ["openid"]
|
|
}
|
|
|
|
resource "hsdp_iam_role" "envoy_ci_service_role" {
|
|
|
|
managing_organization = hsdp_iam_org.foundation_envoy_nightly_org.id
|
|
name = "OAUTH-CI-SERVICE-TF-GATED"
|
|
description = "Permissions to create IAM resources below the provided proposition."
|
|
permissions = [
|
|
"GROUP.READ",
|
|
"GROUP.WRITE",
|
|
"USER.READ",
|
|
"USER.WRITE",
|
|
"BASIC.READ",
|
|
"BASIC.WRITE",
|
|
"ROLE.READ",
|
|
"ROLE.WRITE",
|
|
"PERMISSION.READ",
|
|
"BASICTEST.WRITE"
|
|
]
|
|
}
|
|
|
|
resource "hsdp_iam_group" "envoy_ci_service_group" {
|
|
|
|
managing_organization = hsdp_iam_org.foundation_envoy_nightly_org.id
|
|
name = "OAUTH-CI-SERVICE-TF-GATED"
|
|
description = "Group for envoy automation service identities, Do not modify manually"
|
|
services = [hsdp_iam_service.envoy_ci_service.id]
|
|
roles = [hsdp_iam_role.envoy_ci_service_role.id]
|
|
}
|
|
|
|
module "hsdp_iam_foundation_auto_oauth2_client" {
|
|
source = "github.com/philips-internal/terraform-module-iam-client?ref=v0.1.0"
|
|
|
|
client_name = "oauth_ci_client_gated"
|
|
client_id = "oauth-ci-gted"
|
|
scopes = ["mail", "sn", "profile", "auth_iam_organization", "auth_iam_introspect"]
|
|
response_types = ["code"]
|
|
redirection_uris = []
|
|
application_id = hsdp_iam_application.foundation_envoy_nightly_app.id
|
|
} |