Set up an HCP Terraform connector

C1 provides identity governance and just-in-time provisioning for HCP Terraform. Integrate your HCP Terraform instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

HCP Terraform was formerly named Terraform Cloud. The connector repository and configuration retain the terraform-cloud name.

Capabilities

The HCP Terraform connector syncs the following resources:

Resource	Sync	Provision
Accounts		Create
Organizations		Grant, Revoke
Teams		Grant, Revoke
Projects
Workspaces
Agent tokens

Additional functionality: The HCP Terraform connector supports automatic account provisioning.

Notes:

• Account provisioning creates an organization invitation. HCP Terraform does not accept a password through the API, so C1 does not set one. The invited person receives an email from HCP Terraform and sets their own password when they accept the invitation.
• Account deprovisioning is not supported. HCP Terraform has no user-deletion API, so removing a person from an organization is done by revoking their organization membership grant.
• Agent tokens sync as secrets for visibility only. They have no entitlements or grants.
• Projects and workspaces sync for visibility and are read-only. C1 does not provision access to them directly.
• Managing organization members and teams requires an HCP Terraform paid plan. Team management is unavailable on the free tier.

Gather HCP Terraform credentials

To configure the HCP Terraform connector, you need a user API token belonging to an account with the owners team membership (organization owner) in each HCP Terraform organization you want C1 to manage. Organization owner permissions are required to read and manage organization members and teams. A token from an account without owner permissions syncs a reduced set of data and cannot provision access.

HCP Terraform issues several kinds of API tokens. Create a user token, which inherits the permissions of the account that owns it. Team tokens are limited to the workspaces their team can access, and organization tokens cannot cover multiple organizations, so neither is suitable for this connector.

Create a user API token

1. Sign in to HCP Terraform at https://app.terraform.io as a user who is a member of the owners team.

   If you run Terraform Enterprise, sign in to your own instance URL instead. You provide that URL to C1 as the Address setting.

2. Confirm that your account has owner permissions. Navigate to Organization settings > Teams and check that your account appears in the owners team.

3. Click your user icon in the top-right corner and select Account settings.

4. In the left sidebar, click Tokens.

5. Click Create an API token.

6. Configure the token:

   1. Enter a Description: ConductorOne
   2. Choose an Expiration for the token.

   This token is used by C1 when automatically provisioning and deprovisioning access. If you do not want C1 to perform these tasks, use an account without owner permissions and do not enable provisioning.

   If you set an expiration date, record it and rotate the token in C1 before it expires. An expired token causes syncs to fail.

7. Click Generate token, then copy and save the token value securely. HCP Terraform displays the token only once.

That’s it! You now have the token you need to configure the connector.

For more information, see the HashiCorp documentation on API tokens.

Configure the HCP Terraform connector

To configure a connector in C1, you must have the Connector Administrator or Super Administrator role. You also need the HCP Terraform API token you created above.

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for HCP Terraform and click Add.

3. Choose how to set up the new HCP Terraform connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
   • Add the connector to a managed app (select from the list of existing managed apps)
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the required configuration:

   • API Token (required): The API token used to authenticate with Terraform Cloud.
   • Address (optional): The address of the Terraform instance. Default: https://app.terraform.io
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your HCP Terraform connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the baton-terraform-cloud connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

• Download the connector from the ConductorOne download center.
• View the source code in the baton-terraform-cloud repository.

Step 1: Set up a new HCP Terraform connector

1. In C1, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new HCP Terraform connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
   • Add the connector to a managed app (select from the list of existing managed apps)
   • Create a new managed app
4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

   If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your HCP Terraform connector deployment:

Secrets configuration

# baton-terraform-cloud-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-terraform-cloud-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # HCP Terraform credentials
  BATON_TOKEN: <Your HCP Terraform user API token>

  # Optional: set only for Terraform Enterprise or a regional host.
  # Defaults to https://app.terraform.io
  BATON_ADDRESS: <Your HCP Terraform address>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-terraform-cloud.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-terraform-cloud
  labels:
    app: baton-terraform-cloud
spec:
  selector:
    matchLabels:
      app: baton-terraform-cloud
  template:
    metadata:
      labels:
        app: baton-terraform-cloud
        baton: true
        baton-app: terraform-cloud
    spec:
      containers:
      - name: baton-terraform-cloud
        image: public.ecr.aws/conductorone/baton-terraform-cloud:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-terraform-cloud
        envFrom:
        - secretRef:
            name: baton-terraform-cloud-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the HCP Terraform connector to. HCP Terraform data should be found on the Entitlements and Accounts tabs.

Done. Your HCP Terraform connector is now pulling access data into C1.

Looking for the latest release, checksums, or an older version of this connector? Visit the ConductorOne download center.