deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

arpit-jain

Arpit is a skilled engineering manager and software developer who specializes in Java, JS, and cloud-native technologies. He actively contributes to the developer community and focuses on enhancing the developer experience. Arpit also mentors aspiring developers.

Senior Engineering Manager

Arpit Jain

The Auth0 Terraform provider has many new features and updates. Learn all about what's new.

The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

**Check out our blog post to get started with Auth0 and Terraform.**

<include 
    src="LinkCard" 
    title="Get Started with the Auth0 Terraform Provider" 
    link="https://auth0.com/blog/get-started-with-auth0-terraform-provider/" 
    description="Learn how to get started with the Auth0 Terraform Provider to automate your identity infrastructure." 
    img="https://images.ctfassets.net/23aumh6u8s0i/315vJcTNAjaIgQZWxlovOf/a1839ed3bff28c3da8969642252c86a6/terraform-auth0-logo"
/>

## What's New in the Auth0 Terraform Provider

The latest versions (1.4 to 1.7) of the Auth0 Terraform provider have many new features and updates. Here are the top **six** features to look out for.

### Auth0 Forms

[Auth0 Forms](https://auth0.com/features/forms) is a robust visual editor that enables you to create custom, dynamic forms seamlessly integrating with your authentication workflows.

> [Available from v1.7.3](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/form)

<AmpContent>
  <amp-youtube
      data-videoid="jkzwN2xwO5w"
      layout="responsive"
      width="480" height="270">
  </amp-youtube>
</AmpContent>
<NonAmpContent>
  <div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/jkzwN2xwO5w' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Forms offer a secure and controlled experience within your tenant's domain, eliminating the need for external site redirects. You can manage Auth0 Forms and [Flows](https://auth0.com/docs/customize/forms/flows) via Terraform, enabling you to automate the creation and management of forms and flows.

```hcl
# Create an Auth0 Form
resource "auth0_form" "sample_form" {
  name = "KYC Form"

  start = jsonencode({
    coordinates = { x = 0, y = 0 }
    next_node = "username_step"
  })

  nodes = jsonencode([{
    id   = "username_step"
    type = "STEP"
    config = {
      components = [{
        category = "FIELD"
        config = {
          max_length = 50
          min_length = 1
          multiline  = false
        }
        id        = "full_name"
        label     = "Your Name"
        required  = true
        sensitive = false
        type      = "TEXT"
        },
        {
          category = "BLOCK"
          config = { text = "Continue" }
          id   = "next_button_3FbA"
          type = "NEXT_BUTTON"
      }]
      next_node = "$ending"
    }
    coordinates = { x = 500, y = 0 }
  }])

  ending = jsonencode({
    after_submit = {
      flow_id = auth0_flow.sample_flow.id
    }
    coordinates = { x = 1250, y = 0 }
    resume_flow = true
  })

  style = jsonencode({ css = "h1 { color: white; text-align: center; }" })
}

# Create an Auth0 Flow to use the Form
resource "auth0_flow" "sample_flow" {
  actions = jsonencode([{
    action = "UPDATE_USER"
    allow_failure = false
    id            = "update_user_metadata"
    mask_output   = false
    params = {
      changes = {
        user_metadata = { full_name = "{{fields.full_name}}" }
      }
      connection_id = auth0_flow_vault_connection.sample_connection.id
      user_id       = "{{context.user.user_id}}"
    }
    type = "AUTH0"
  }])
  name = "Flow KYC update data"
}

# Create a Flow Vault Connection to use in a Flow
resource "auth0_flow_vault_connection" "sample_connection" {
  app_id = "AUTH0"
  name   = "Auth0 M2M Connection"
  setup = {
    client_id     = var.auth0_client_id # The M2M app must be authorized to use the Auth0 Management API
    client_secret = var.auth0_client_secret
    domain        = var.auth0_domain # without https:// in the domain
    type          = "OAUTH_APP"
  }
}
```

### Machine-to-Machine Access for Organizations

[Machine-to-Machine (M2M) Access for Organizations](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) enables you to define the organizations that a given application can access for each API using the Client Credentials Flow. This enables customers to sell and operate their services in M2M environments properly, cover scenarios with consumption devices with limited user experience capabilities, and simplify configuration and usage.

This is being implemented so that M2M Apps can be associated with a given organization, as currently done for Connections. This will enable that application to request an access token for that specific Organization.

> Note: This feature is available from B2B Professional, Enterprise, and Enterprise premium plans.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/organization_client_grant)

```hcl
# Create an Auth0 Organization
resource "auth0_organization" "my_organization" {
  name         = "auth0-inc"
  display_name = "Auth0 Inc."

  branding {
    logo_url = "https://example.com/assets/icons/icon.png"
    colors = {
      primary         = "#f2f2f2"
      page_background = "#e1e1e1"
    }
  }
}

# Create a new Auth0 M2M application
resource "auth0_client" "sample_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "non_interactive"
}

# Create a Client Grant for the Client
resource "auth0_client_grant" "my_client_grant" {
  client_id = auth0_client.sample_client.id
  audience  = "https://passkeys-demo.eu.auth0.com/api/v2/"
  scopes    = ["create:foo", "create:bar"]
}

# Create a Client Grant for the Organization
resource "auth0_organization_client_grant" "sample_organization_client_grant" {
  organization_id = auth0_organization.my_organization.id
  grant_id       = auth0_client_grant.my_client_grant.id
}
```

## Bring Your Own Key (BYOK)

[Bring Your Own Key](https://auth0.com/docs/secure/highly-regulated-identity/customer-managed-keys/customer-managed-keys-management-api) allows you to securely replace your tenant’s top-level encryption key with a key of your own, hence gaining control of your key material in Auth0’s hardware security module (HSM). It allows compliance with specific secret custody and key provenance requirements. Once you have uploaded your key, data encryption and decryption operations use that key to encrypt your tenant's secrets and data.

> Note: This feature is available as Early Access on Enterprise plans with the Highly Regulated Identity add-on.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/encryption_key_manager)

```hcl
# Modifying the key_rotation_id causes the keys to be rotated/rekeyed.
resource "auth0_encryption_key_manager" "sample_key_manager_initial" {
  key_rotation_id = "da9f2f3b-1c7e-4245-8982-9a25da8407c4"
}

resource "auth0_encryption_key_manager" "sample_key_manager_rekey" {
  key_rotation_id = "68feba2c-7768-40f3-9d71-4b91e0233abf"
}

# To initialize the process of providing the root key by the customer, create a
# `customer_provided_root_key` block.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
  }
}

# The public_wrapping_key and wrapping_algorithm should be available to
# be used to wrap the new key by the customer
output "key_manager" {
  depends_on = [auth0_encryption_key_manager.sample_key_manager]
  value = {
    public_wrapping_key = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.public_wrapping_key
    wrapping_algorithm  = auth0_encryption_key_manager.sample_key_manager.customer_provided_root_key.*.wrapping_algorithm
  }
}

# The root key should be wrapped using the specified algorithm by the customer and Base64 encoded.
resource "auth0_encryption_key_manager" "sample_key_manager" {
  customer_provided_root_key {
    wrapped_key = "your_base64_encoded_wrapped_root_key"
  }
}
```

## Customize Signup and Login Prompts

[Customize Signup and Login Prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts) is a feature that allows customers with a Custom Domain and Custom Page Template enabled to add custom fields and content to their app’s signup and login prompts.

> [Available from v1.7.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt_screen_partial)

Customize Signup and Login Prompts supports two use cases.

- **Custom content**: Custom content is static content like text, links, or images placed directly on the signup and login prompts.
- **Data capture**: Data capture uses form elements dynamically added to the signup and login prompts, which is useful for collecting and validating user consent or user-produced data like a surname.

```hcl
# For managing a single prompt screen
resource "auth0_prompt_screen_partial" "login" {
  prompt_type = "login"
  screen_name = "login"
  insertion_points {
    form_content_start = "<div>Form Content Start</div>"
    form_content_end   = "<div>Form Content End</div>"
  }
}

# For managing multiple prompt screens
resource "auth0_prompt_screen_partials" "prompt_screen_partials" {
  prompt_type = "login-passwordless"

  screen_partials {
    screen_name = "login-passwordless-email-code"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }

  screen_partials {
    screen_name = "login-passwordless-sms-otp"
    insertion_points {
      form_content_start = "<div>Form Content Start</div>"
      form_content_end   = "<div>Form Content End</div>"
    }
  }
}
```

## Self-Service Single Sign-On

[Self-Service Single-Sign On (SSO)](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) provides business-to-business (B2B) customers with the tools needed to delegate SSO setup to their enterprise customers. This enables your B2B customers to configure and manage their own ways of logging in to your SaaS application.

Self-Service SSO provides a packaged experience that Auth0 customers can offer to their business customers so that they can set up their own SSO access. Customers can take advantage of this time-saving feature to reduce support costs and time-to-value for their business customers.

> Note: This feature is available as limited Early Access on Enterprise plans.

> [Available from v1.5.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/self_service_profile)

```hcl
resource "auth0_self_service_profile" "my_self_service_profile" {
  user_attributes {
    name        = "sample-name"
    description = "sample-description"
    is_optional = true
  }
  branding {
    logo_url = "https://mycompany.org/v2/logo.png"
    colors {
      primary = "#0059d6"
    }
  }
}
```

## SCIM Configuration

[System for Cross-domain Identity Management (SCIM)](http://www.simplecloud.info/), is a [protocol](https://tools.ietf.org/html/rfc7644) and [schema](https://tools.ietf.org/html/rfc7643) used by enterprise organizations for provisioning, de-provisioning, and managing user identity-related information across systems in a standardized way. SaaS developers selling their SaaS apps and services to large enterprises may be asked, or even required, by those customers to implement a SCIM-based API to integrate with the user provisioning tooling they use.

With support for [inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim), SaaS application builders will be able to:

- Use the Auth0 Dashboard or APIs to quickly and easily enable support inbound SCIM user provisioning and de-provisioning workflows to their Auth0 user identity stores
- Get out-of-box support for top Workforce IDPs that implement outbound SCIM (including Okta Workforce Identity Cloud and Azure AD) without needing to build or self-host any custom endpoints

> Note: This feature is available on Enterprise plans.

> [Available from v1.4.0](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/connection_scim_configuration)

```hcl
resource "auth0_connection" "my_enterprise_connection" {
  name         = "my-enterprise-connection"
  display_name = "My Enterprise Connection"
  strategy     = "okta"

  options {
    client_id              = "1234567"
    client_secret          = "1234567"
    issuer                 = "https://example.okta.com"
    jwks_uri               = "https://example.okta.com/oauth2/v1/keys"
    token_endpoint         = "https://example.okta.com/oauth2/v1/token"
    authorization_endpoint = "https://example.okta.com/oauth2/v1/authorize"
  }
}

# A resource for configuring an Auth0 Connection SCIM Configuration, specifying `user_id_attribute` and `mapping`.
# Only one can be specified for a connection.
resource "auth0_connection_scim_configuration" "my_conn_scim_configuration" {
  connection_id     = auth0_connection.my_enterprise_connection.id
  user_id_attribute = "attribute1"
  mapping {
    auth0 = "auth0_attribute1"
    scim  = "sacim_attribute1"
  }
  mapping {
    auth0 = "auth0_attribute2"
    scim  = "sacim_attribute2"
  }
}
```

## Learn More

I hope that you found this article helpful. Here are some additional resources to learn more about Auth0 and DevOps.

- [Get Started with the Auth0 Terraform Provider](https://auth0.com/blog/get-started-with-auth0-terraform-provider/)
- Be a DevOps Hero\! Automate Your Identity Infrastructure with Auth0 CLI and Ansible
- [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
- [Shhhh... Kubernetes Secrets Are Not Really Secret\!](https://auth0.com/blog/kubernetes-secrets-management/)
- [Auth0 CLI Basics \- Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything about identity and security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@auth0 on Twitter](https://twitter.com/auth0) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.


What's New in the Auth0 Terraform Provider?

jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Google GKE using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Google GKE Using Terraform and Kubernetes

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Azure AKS using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Azure AKS Using Terraform and Kubernetes

Learn how to get started with the Auth0 Terraform Provider to automate your Auth0 configuration.

When managing infrastructure for any large enough organization, you will need to automate the provisioning and configuration of resources, services, and applications. [Terraform](https://www.terraform.io/) has been the de facto standard for infrastructure as code (IaC) for a while now. Terraform's declarative syntax and cross-platform support make it a great choice for managing infrastructure. Terraform is cloud-agnostic and supports all major cloud providers and on-premise setups. It also supports a lot of other services and applications using [providers](https://registry.terraform.io/browse/providers).

If you use Terraform in your organization and want to configure and manage your Auth0 tenants with Terraform, you are in luck because Auth0 has a Terraform Provider. The [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs) allows you to automate the configuration of Auth0 resources like applications, connections, actions, and more. You can also use it to manage users and groups. With the Auth0 Terraform provider, you can automate almost everything you can do via the management UI.

## Overview

So here is what you will learn to do today:

-   Setup the Auth0 Terraform Provider with Auth0 CLI
-   Create a new Auth0 application for OpenID Connect (OIDC) authentication
-   Create roles and users for Auth0
-   Create an action to customize the authentication flow
-   Generate terraform configurations from your existing Auth0 tenant using Auth0 CLI

**Prerequisites:**

-   [Terraform CLI](https://www.terraform.io/downloads) version 1.5+
-   [Auth0 CLI](https://auth0.github.io/auth0-cli/) version 1.1+
-   [jq](https://jqlang.github.io/jq/download/)

## Setup the Auth0 Terraform Provider

Before you can set up the Auth0 Terraform Provider, you need to create a machine-to-machine application in Auth0 so that Terraform can communicate with the Auth0 management API. This can be done using the Auth0 CLI. Install the Auth0 CLI and login to your tenant with the `create:client_grants`.

```bash
auth0 login --scopes create:client_grants
```

> If you don't already have an Auth0 tenant, you can [sign up for a free Auth0 account](https://a0.to/blog_signup) and create a tenant.

Run the following commands to create a machine-to-machine application and extract the client ID and secret from the output.

```bash
# Create a machine-to-machine application on Auth0
export AUTH0_M2M_APP=$(auth0 apps create \
  --name "Auth0 Terraform Provider" \
  --description "Auth0 Terraform Provider M2M" \
  --type m2m \
  --reveal-secrets \
  --json | jq -r '. | {client_id: .client_id, client_secret: .client_secret}')

# Extract the client ID and client secret from the output.
export AUTH0_CLIENT_ID=$(echo $AUTH0_M2M_APP | jq -r '.client_id')
export AUTH0_CLIENT_SECRET=$(echo $AUTH0_M2M_APP | jq -r '.client_secret')
```

> The environment variable names should be exactly as above, as the Terraform provider expects these variables to be set.

The commands above will create the application and set environment variables for the client ID and secret.

This application needs to be authorized to use the Auth0 management API. This can be done using the commands below:

```bash
# Get the ID and IDENTIFIER fields of the Auth0 Management API
export AUTH0_MANAGEMENT_API_ID=$(auth0 apis list --json | jq -r 'map(select(.name == "Auth0 Management API"))[0].id')
export AUTH0_MANAGEMENT_API_IDENTIFIER=$(auth0 apis list --json | jq -r 'map(select(.name == "Auth0 Management API"))[0].identifier')
# Get the SCOPES to be authorized
export AUTH0_MANAGEMENT_API_SCOPES=$(auth0 apis scopes list $AUTH0_MANAGEMENT_API_ID --json | jq -r '.[].value' | jq -ncR '[inputs]')

# Authorize the Auth0 Terraform Provider application to use the Auth0 Management API
auth0 api post "client-grants" --data='{"client_id": "'$AUTH0_CLIENT_ID'", "audience": "'$AUTH0_MANAGEMENT_API_IDENTIFIER'", "scope":'$AUTH0_MANAGEMENT_API_SCOPES'}'
```

> If you don't want to authorize all scopes for the Terraform Provider, you can filter the required scopes from the output of `auth0 apis scopes list` and pass it to the `auth0 api post` command in place of `$AUTH0_MANAGEMENT_API_SCOPES`. Make sure to pass a valid JSON array of strings.

Now, you can set up the Auth0 Terraform Provider. First, make sure you use a specific version of the providers, as different versions might use different attributes and features. Create a `versions.tf` file:

```bash
mkdir terraform
cd terraform
touch versions.tf
```

Add the following to the file:

```hcl
terraform {
  required_version = ">= 1.7.0"

  required_providers {
    auth0 = {
      source  = "auth0/auth0"
      version = "~> 1.1.2" # Refer to docs for latest version
    }
    ## Add other providers here
  }
}
```

Next, you need to define variables and [configure the provider](https://registry.terraform.io/providers/auth0/auth0/latest/docs#schema). Create a `config.tf` file:

```bash
touch config.tf
```

Add the following to the file:

```hcl
variable "auth0_domain" {
  default     = "https://<your_auth0_domain_uri>"
  description = "Auth0 domain"
}

provider "auth0" {
  domain        = var.auth0_domain
  debug         = false
}
```

You can find your Auth0 domain in the [Auth0 dashboard](https://manage.auth0.com/) or by running the `auth0 tenants list` command.

Now, you can initialize the Terraform workspace and test the provider by running the following commands:

```bash
terraform init
```

## Create an Auth0 Application

Let's get into business. Create a Terraform script that creates an Auth0 web application and required customizations. Create a file named `auth0.tf` in the `terraform` folder and add the following content:

```hcl
# Create a new Auth0 application for OIDC authentication
resource "auth0_client" "oidc_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "regular_web"
  callbacks           = ["http://localhost:8080/callback"]
  allowed_logout_urls = ["http://localhost:8080"]
  oidc_conformant     = true

  jwt_configuration {
    alg = "RS256"
  }
}

# Configuring client_secret_post as an authentication method.
resource "auth0_client_credentials" "oidc_client_creds" {
  client_id = auth0_client.oidc_client.id
  authentication_method = "client_secret_post"
}
```

The script above does the following:

-   The `auth0_client` resource definition creates an Auth0 Web application client conforming to the OIDC standard.
-   The `auth0_client_credentials` resource definition configures the client to use the `client_secret_post` authentication method (confidential client using HTTP POST parameters). Other supported methods are:
    -   `none`: Public client without a client secret
    -   `client_secret_basic`: Confidential client using HTTP Basic
    -   `private_key_jwt`: Confidential client using a Private Key JWT

> Refer to the [`auth0_client` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/client) and [`auth0_client_credentials` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/client_credentials) for all possible configurations.

Next, you can also define some outputs to be captured. Create a `outputs.tf` file:

```bash
touch outputs.tf
```

Add the following to the file:

```hcl
output "auth0_webapp_client_id" {
  description = "Auth0 JavaMicroservices Client ID"
  value       = auth0_client.oidc_client.client_id
}

output "auth0_webapp_client_secret" {
  description = "Auth0 JavaMicroservices Client Secret"
  value       = auth0_client_credentials.oidc_client_creds.client_secret
  sensitive   = true
}
```

Now, you can run the Terraform script to create the Auth0 application. Run the following commands to plan and apply it.

```bash
# see a preview of what will be done
terraform plan
```

Review the plan and make sure everything is correct.

Now you can apply the changes:

```bash
terraform apply
```

You will see the configurations being applied and the output variables printed to the console.

Go to [Auth0 dashboard](https://manage.auth0.com/) and check **Applications** > **Applications**. You should see the application created. You can also find the application using the Auth0 CLI with the `auth0 apps list` command.

If you want to get the client ID and secret from the output, you can run the following command:

```bash
# Client ID
terraform output --json | jq -r '.auth0_webapp_client_id.value'
# Client Secret
terraform output --json | jq -r '.auth0_webapp_client_secret.value'
```

You can update the allowed callback URLs and allowed logout URLs in the Auth0 web application. You can do this by adding the values to the `callbacks` and `allowed_logout_urls` array in the `oidc_client` resource in the `auth0.tf` file like below:

```hcl
resource "auth0_client" "oidc_client" {
  name                = "MyCoolApp"
  description         = "My Cool App Client Created Through Terraform"
  app_type            = "regular_web"
  callbacks           = ["http://localhost:8080/callback", "http://another-domain/callback"]
  allowed_logout_urls = ["http://localhost:8080", "http://another-domain"]
  oidc_conformant     = true

  jwt_configuration {
    alg = "RS256"
  }
}
```

Run `terraform apply -target="auth0_client.oidc_client"` to update the configuration in your Auth0 tenant.

## Create Roles and Users

You can create roles and users using the Auth0 Terraform provider. Let's create some roles and users, and then let's assign the roles to the users.

Add the following content to the `config.tf` file to get a default password while applying the Terraform script:

```hcl
variable "default_password" {
  # Should be a strong password. Example: lkjhasdf$12$12
  description = "Default password for all users"
  sensitive   = true
}
```

Add the following content to the `auth0.tf` file:

```hcl
# Create a role for admin users
resource "auth0_role" "admin" {
  name        = "ROLE_ADMIN"
  description = "Administrator"
}

# Create a role for regular users
resource "auth0_role" "user" {
  name        = "ROLE_USER"
  description = "User"
}

# Create an admin user
resource "auth0_user" "admin_user" {
  connection_name = "Username-Password-Authentication"
  name            = "Jane Doe"
  email           = "jane@test.com"
  email_verified  = true
  password        = var.default_password
}

# Assign roles to the admin user
resource "auth0_user_roles" "admin_user_roles" {
  user_id = auth0_user.admin_user.id
  roles   = [auth0_role.admin.id, auth0_role.user.id]
}

# Create a regular user
resource "auth0_user" "regular_user" {
  connection_name = "Username-Password-Authentication"
  name            = "John Doe"
  email           = "john@test.com"
  email_verified  = false
  password        = var.default_password
}

# Assign roles to the regular user
resource "auth0_user_roles" "regular_user_roles" {
  user_id = auth0_user.regular_user.id
  roles   = [auth0_role.user.id]
}
```

Refer to the [`auth0_role` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role) and [`auth0_user` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/user) for all possible configurations. [`auth0_role_permission`](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role_permission) and [`auth0_role_permissions`](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/role_permissions) resources can be used to manage permissions for roles.

Run the following commands to plan and apply the changes:

```bash
terraform plan
#  Verify the plan
terraform apply
```

Provide a default password when prompted. You can find the user IDs in the output.

## Create an Action to Customize the Authentication Flow

One of the most powerful features of Auth0 is the ability to customize the authentication flow using [Actions](https://auth0.com/docs/actions). Actions are custom code that runs during the authentication flow. Actions can be used to add custom claims to the ID and access tokens, custom logic to the authentication flow, and more. You can use the Auth0 Terraform provider to create and manage actions.

Let's create an action that adds the roles to the ID and access tokens. Add the following content to the `auth0.tf` file:

```hcl
# Create an action to add the roles to the ID/access token claims.
resource "auth0_action" "roles_action" {
  name    = "add_roles_claim"
  runtime = "node18"
  deploy  = true
  code    = <<-EOT
  /**
   * Handler that will be called during the execution of a PostLogin flow.
   *
   * @param {Event} event - Details about the user and the context in which they are logging in.
   * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
   */
   exports.onExecutePostLogin = async (event, api) => {
     const namespace = 'https://www.cooldomain.com';
     if (event.authorization) {
         api.idToken.setCustomClaim(namespace + '/roles', event.authorization.roles);
         api.accessToken.setCustomClaim(namespace + '/roles', event.authorization.roles);
     }
   };
  EOT

  supported_triggers {
    id      = "post-login"
    version = "v3"
  }
}

# Attach the action to the login flow
resource "auth0_trigger_actions" "login_flow" {
  trigger = "post-login"

  actions {
    id           = auth0_action.roles_action.id
    display_name = auth0_action.roles_action.name
  }
}
```

Refer to the [`auth0_action` schema](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/action) for all possible configurations.

Plan and apply the changes:

```bash
terraform plan
#  Verify the plan
terraform apply
```

## Generate Terraform Configurations from Your Existing Auth0 Tenant Using Auth0 CLI

You may already have an existing Auth0 tenant with applications, connections, users, and more. You can use the [Auth0 CLI to generate Terraform configurations](https://registry.terraform.io/providers/auth0/auth0/latest/docs/guides/generate_terraform_config) from your existing Auth0 tenant. Run the following command to generate the Terraform configurations from the above setup:

```bash
export AUTH0_DOMAIN=<your-auth0-domain>
auth0 tf generate --output-dir tmp-auth0-tf
```

This will create the below files in the `tmp-auth0-tf` folder:

-   `auth0_import.tf`: [Terraform configurations to import](https://developer.hashicorp.com/terraform/language/import) the existing resources into the Terraform state.
-   `auth0_main.tf`: Terraform configurations for the Auth0 Terraform Provider. _You may want to update the `required_version` to match the Terraform CLI version you are using._
-   `auth0_generated.tf`: Terraform configurations for the resources in the Auth0 tenant.
-   `terraform`: A specific version of the Terraform binary used for the import. _You can use this binary to run terraform commands if you don't want to update `required_version` in `auth0_main.tf`._
-   `.terraform*`: Terraform state files.

Now, you can import the existing resources into the Terraform state. Run the following commands:

```bash
cd tmp-auth0-tf
terraform apply # You can use your local Terraform CLI if you have updated `required_version` in `auth0_main.tf` else run `./terraform apply`
```

You can verify the generated configurations by running `terraform plan`.

```bash
# You can remove the import file as it's no longer needed.
rm auth0_import.tf
terraform plan
```

The output should be `No changes. Your infrastructure matches the configuration.`

> Note that the `auth0 tf generate` command cannot import sensitive values like secrets and keys.

> Note that this feature is available only from version 1.1+ of the Auth0 CLI, and Terraform import is supported only from Terraform version 1.5+.

## Tear Down the Cluster with Terraform

Once you are done with the tutorial, you can delete all the resources created using Terraform by running the following command:

```bash
terraform destroy
```

## Learn More about Terraform, Auth0, and DevOps

If you want to learn more about Terraform, Auth0 Actions, and DevOps, check out these additional resources.

-   [Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes](https://auth0.com/blog/terraform-eks-java-microservices/)
-   [Shhhh... Kubernetes Secrets Are Not Really Secret!](https://auth0.com/blog/kubernetes-secrets-management/)
-   [Auth0 CLI Basics - Lab](https://developer.auth0.com/resources/labs/tools/auth0-cli-basics#introduction)
-   [Assigning a Default Role to Users on Sign-Up with Auth0 Actions](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/)
-   [Ensure Users Log in from Trusted Networks with Auth0 Actions](https://auth0.com/blog/ensure-users-log-in-trusted-networks-auth0-actions/)

You can also sign up for our [newsletter](https://a0.to/nl-signup/java) to stay updated on everything related to Identity and Security.

If you liked this tutorial, chances are you'll enjoy the others we publish. Please follow [@oktadev on Twitter](https://twitter.com/oktadev) and [subscribe to our YouTube channel](https://youtube.com/oktadev) to get notified when we publish new developer tutorials.

Get Started with the Auth0 Terraform Provider

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Amazon EKS using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Amazon EKS Using Terraform and Kubernetes

john-brennan

John is an R&D Content Engineer at Auth0. He has nearly a decade’s experience in full-stack software development in a variety of environments, languages, and frameworks. He relishes the challenge of learning hard-to-grasp technical concepts and helping others understand them in a clear, concise manner. His current technical interests are in API design and scalability, Ruby on Rails, accessibility, single-page app architecture, and the ever-changing JavaScript ecosystem. When he's not working, John is usually cooking, doing creative writing, running, or wrangling a toddler.

R&D Content Engineer

John Brennan

How to use HashiCorp Terraform and the Auth0 Provider to maintain your critical infrastructure, including your Auth0 configuration, in code.

Use HashiCorp Terraform to Manage Your Auth0 Configuration

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Product Marketing Manager

Shafiq Shivji

Learn how Alex Kalyvitis created Auth0 as Code for Terraform


Infrastructure-as-code is a powerful tool to help alleviate the pain of maintaining cloud architecture. DevOps engineers simply have to code a configuration file, feed it into a solution like HashiCorp Terraform, and viola! Changes occur to the appropriate cloud resources. Auth0's Terraform integration came from our developer community, written by Alex Kalyvitis, a software engineer. We sat down with Alex to talk about his experience and what he learned from it.

What Developers and DevOps engineers will learn from this interview:

* Why infrastructure-as-code for authentication
* What it takes to create a successful open-source project

<br>
Shafiq: **How did you first learn about Auth0?**

**Alex**: Like every engineer, you have to deal with the 300-pound authentication gorilla at a certain point. It's not core to your business, but you must get it right or end up with an insecure app. The consensus in the developer world is to let people who it is their core business do that. In my previous experience at Yieldr, we started with basic authentication to ensure only certain people had access. However, we realized early on that we needed more, and it became clear that we had to implement best practices, such as OAuth2 and Open ID connect, and not try to invent our own.

Luckily, some of the best authentication resources come from Auth0. I learned quite a bit from Auth0's documentation and thought that maybe I should use it instead of building one. I gave Auth0 a try, and after exploring features such as social providers, I realized that it was a robust product. I've been happily using it since.

Shafiq: **Why did you write the Auth0 Terraform Provider?**

**Alex**: Creating the Terraform provider started from an internal organizational philosophy of having all of our cloud infrastructures checked in as code. Doing this gives you the ability to manage all the things that support your infrastructures, such as Amazon AWS, Cloudflare, New Relic, Pagerduty, or other infrastructure or service providers. You can treat it with the same level of scrutiny as your product code. So if I make a change to my infrastructure, it's not by signing into a console and toggling the switch off or on. It makes moves more deliberate and safe. 

![terraform-graphic](https://images.ctfassets.net/23aumh6u8s0i/19lCmccl6pWJ2XL2WX0BO6/46384c1eea33b7692e314b9b6ade2588/terraform-graphic)

As an example, once one of our engineers, while developing a new feature, he had toggled a flag in our Auth0 tenant. This broke our login flow. But we didn't immediately make the connection and instead wasted our time looking for a bug in our codebase. It took us about a day to figure out what happened. So at that point, we said, "All right, this has to be managed with code." Unfortunately, there was no Terraform provider for Auth0 at the time. So we decided to build one. I started by looking through the client libraries offered by Auth0, and unfortunately, a Go SDK was not available, so I had to make one as well to support the provider. Fast forward a couple of years, people are using it to provide their authentication infrastructure, with lots of contributions from the community.

Shafiq: **Did you encounter any challenges, and how did you manage them?**

**Alex**: Challenges. Yeah, I mean, there's always a challenge with any project with significant size or complexity. Building the plan, I started by drawing a line in the sand, so to speak, with whatever is supported by Auth0 and whatever is publicly-documented by Auth0. I used Auth0's management documentation, the API documentation, and that was my golden standard. If it wasn't there, it wasn't in the provider. So that's where I based off a lot of the original work.

Later on, of course, people started using it for things that were not necessarily detailed in the API documentation. So with some reverse engineering and by checking out what changes occurred in the dashboard, we managed to add additional functionality. That was challenging in a sense, but it wasn't rocket science, slightly a bit of guesswork. We built an API that, you know, approximates how it should behave.

Also, time, time is critical. I had to balance how much time I could allocate for this project. I had a demanding schedule at work, as we were building a complex product. Therefore building and maintaining the project was done during weekends and afternoons. Balancing that with home-life was a bit of a challenge. I suspect that some users may get frustrated by that, but there's only so much a single person can do, and I've done the best that I could.

Shafiq: **What was your reaction when demand increased for the provider?**

**Alex**: I was thrilled and delighted to see people finding it useful. I had built something people cared about. It's cool. Even though it's not on the level of developing the next Kafka or precious open-source technology, it's building on the shoulders of that. It's super exciting to see people care about your work and finding it so useful that they want to contribute to it. And some people are passionate about it that they feel that it's even their own even though I haven't yet met them in-person.

<p>
<img src="https://images.ctfassets.net/23aumh6u8s0i/uf8X8pIDwiPy3zXcLo2ON/8dffdab99a5612ceb4719a39b1edfe2b/terraform-github" alt="terraform-github" width="410" height="200"/>
</p>

Shafiq: **What did you learn from the experience?**

**Alex**: You always have to be a good host to everybody. It can be easy to get frustrated by a comment or a request that might seem irrational or too far-reaching. But it's important to be level-headed and treat everybody with respect and point them in the right direction. If I think they're wrong, I try to be helpful because, in the end, what you do people see, and they act in kind. So, if you want people to act respectfully, then you'll have to be respectful and earn respect for yourself. And I see that quality in a lot of people, especially around isolated incidents. So, yeah, be a role model in the community that you want to support.

Shafiq: **Why did you decide to make it open-source and not keep it proprietary?**

**Alex**: Well, for starters, it's not something core to our business, as we're focused on building our product. Open-source is a great way to give back to a community as well as enlist the community to contribute. These are two sides of the same coin. So, on the one hand, you put a lot of effort and give something out for free, but you get more eyes and more scrutiny. This is a good thing, especially when you're dealing with something as sensitive as infrastructure. Crowdsourcing via open-source helps to surface issues we would not have foreseen or would not have the time to deal with.

Shafiq: **What would you say to somebody who is considering writing open-source code?**

**Alex**: Do it. Absolutely do it! The process will teach you a bunch of stuff because people, often smarter than you, may find what you do use and be inclined to share their knowledge with you. So in a way, this is a way to learn. For us, engineers, open-source is hugely valuable as we get to read and understand the world's best codebases written by some of the most brilliant people. That's a huge learning opportunity. I don't know why a developer would do something close-sourced unless it's critical to their business. Unless it's a core piece of software that is intellectual property and you wouldn't want your competitors to see, I don't know why not do open-source.

A special thank you to Alex for allowing us to interview him and for the incredible work he's done with Auth0's Terraform Provider. We highly value and appreciate the contribution our developer community continues to make and for the partnership cultivated over the years.

<include src="asides/AboutAuth0" />


Community Developer Brings HashiCorp Terraform to Auth0

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Terraform users can now configure and manage Auth0 with code



**BELLEVUE, Wash. — June 17, 2020 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its partnership with [HashiCorp](https://www.hashicorp.com/), the leader in multi-cloud infrastructure automation software, and integration with HashiCorp Terraform, a tool for centrally deploying and managing cloud infrastructure, safely and efficiently, with code. 

HashiCorp Terraform works with vetted and approved infrastructure and service providers to alleviate the pain of maintaining a large number of cloud assets with a single interface. Now available is the [Auth0 Provider for HashiCorp Terraform](https://www.terraform.io/docs/providers/auth0/index.html), enabling Terraform users to set and update common identity configurations for any applications and APIs using Auth0. 

Thousands of Auth0 customers use infrastructure as code solutions to maintain their cloud architecture at scale, including managing their Auth0 environments. This reduces the risk of making manual mistakes while increasing speed and consistency. The Auth0 Provider allows developers to manage clients, resource servers, rules and rule variables, users, roles, tenants, and custom domains as part of a Terraform deployment.

“Auth0 and HashiCorp customers are rapidly adopting cloud services and delivering innovative customer experiences with speed and reliability,” said Bill Lapcevic, VP of Business Development at Auth0. “Auth0 has been working closely with HashiCorp to offer a reliable and fully supported integration of Terraform with our platform.”

Since the company’s inception, Auth0 has relied upon its loyal and widespread developer community. The Auth0 Provider for Terraform, came from one of Auth0’s Community members, Alex Kalyvitis, who played an invaluable role in facilitating this integration. Solving a need within his company, Kalyvitis created an SDK to connect Auth0’s management API with HashiCorp and wrote the Auth0 Provider for Terraform to complete the integration. Auth0 then worked with HashiCorp to get the Provider listing on Terraform.

The Auth0 Provider for Terraform is now fully supported by Auth0. Please see the [_Use Terraform to Manage Your Auth0 Configuration_](https://auth0.com/blog/use-terraform-to-manage-your-auth0-configuration/) technical blog post to learn how to get started. Auth0 and HashiCorp will also be co-hosting a [webinar on June 30, 2020, at 10 am PT](https://auth0.com/resources/upcoming-webinars/auth0-as-code-with-terraform-webinar?utm_source=auth0blog&utm_medium=announcement&utm_campaign=terraform_webinar), where a technology demo and best practices will be shared.

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)


"terraform"