# Terraform for Okta

GitHub Repo: <https://github.com/vangchar/okta_terraform>

This is a sample project to showcase how Terraform can be leveraged to create Okta resources. This project will:

* Create an Okta Application (native)
* Create an Authorization Server
  * Access Policy
  * Claims
  * Scopes
* Create a new Okta Group

### Prerequisites

* Okta Tenant - Free Developer Tenant (<https://developer.okta.com/>).
* Terraform Install Documentation (<https://learn.hashicorp.com/tutorials/terraform/install-cli>)

### Steps

#### Setup

Setup a developer Okta Org and create an API Token.

1. Setup a developer Okta Org at [developer.okta.com](https://developer.okta.com/).
2. Activate your Okta Org and navigate to the Dashboard.

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FONvZM8HTgxTAVwl9ZFkG%2Fimage.png?alt=media&#x26;token=a24d813c-7dbc-4d92-8cd3-e4e3e79760c7" alt=""><figcaption></figcaption></figure>

3. On the left side bar menu navigate `API` menu and select `Tokens`.
4. Click `Create Token` and name the API Token.

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2F4CUwl02Uv4M0Y42VAUYA%2Fimage.png?alt=media&#x26;token=14240420-8a20-4efa-8755-5d6afcfcca80" alt=""><figcaption></figcaption></figure>

5. Copy and store the generated token so it can used for the `terraform.tfvars` file later.\
   NOTE: You will only be able to view the token once.
6. Make note of the Okta Org url. (ie. `dev-123456.okta.com`) for the `terraform.tfvars` file.

### Terraform File Structure

The file structure for this project has been developed using modules for organization, reuse, and consistency purposes. Each Okta resource has its own module and is called by the main module block.

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2F2oyJdU8xy0MJRCQrFZbL%2Fimage.png?alt=media&#x26;token=0ce9089d-fee8-4663-b4a5-3baf4cc984bf" alt=""><figcaption></figcaption></figure>

### Init

After cloning the [GitHub Repo](https://github.com/vangchar/okta_terraform), navigate to the tfvars file and update the okta\_org\_url, okta\_base\_url, and okta\_api\_token with your specific values. Ensure to save the file so it updates.

Navigate to the terminal of your IDE and initialize the configuration. The init command initializes the working directory. It ensures that the necessary provider plugins are installed, the backend is initialized (state file), and modules are downloaded (.terraform directory).

{% embed url="<https://developer.hashicorp.com/terraform/cli/commands/init>" %}

```
terraform init
```

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FLD7kdIAzsgXASPx8enhT%2Fimage.png?alt=media&#x26;token=e33b2fe2-4225-4d10-9730-99a296901786" alt=""><figcaption></figcaption></figure>

### Plan

Once Terraform is initialized, we need to create an execution plan and understand what changes will be made. It is important to understand the changes that will be made to the infrastructure. This is done using the plan command.&#x20;

{% embed url="<https://developer.hashicorp.com/terraform/cli/commands/plan>" %}

```
terraform plan
```

&#x20;Below is a snippet of the terraform plan output

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FsNEi4kcuPPOg5VHrGKSf%2Fimage.png?alt=media&#x26;token=572ac436-4ccb-4170-bec0-71cc9c3f7fbc" alt=""><figcaption></figcaption></figure>

### Apply

If the output matches what you want, the apply command can be used to execute the actions.

{% embed url="<https://developer.hashicorp.com/terraform/cli/commands/apply>" %}

```
terraform apply
```

Note: When you run the apply command, it will also output the plan. Then you will have to enter "yes" to accept or approve the actions.&#x20;

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FdwjCLf5B67QjgtHz4BoN%2Fimage.png?alt=media&#x26;token=d0dc8e95-8680-417b-9dc5-0d581b7788a0" alt=""><figcaption></figcaption></figure>

It looks like the resources were successfully created in Okta. Let's go to Okta and verify that it was done correctly.

### Result

**Application**

Okta Application was created "Terraform Test App"

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FZytiJdXeOWe9DGpehlxc%2Fimage.png?alt=media&#x26;token=ba73ff46-708f-480b-bed7-08489d2d5599" alt=""><figcaption></figcaption></figure>

**Authorization Server**

Created a new auth server "terraform\_test\_auth\_server"

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FWeo35yBw2E8x6AtOhJdu%2Fimage.png?alt=media&#x26;token=d5152c64-fa84-4981-a96f-65d28e34a5e5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FGcvrFxYHBdweO9gIi2ns%2Fimage.png?alt=media&#x26;token=f1cef24a-bf6f-4cdb-8f28-c1af4a01a88b" alt=""><figcaption></figcaption></figure>

Two custom scopes

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FOsiLWfRqlvKL72KZToi7%2Fimage.png?alt=media&#x26;token=ace8566e-531e-4540-b34c-17e2b231e91d" alt=""><figcaption></figcaption></figure>

Custom claims tied to the new scopes

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FoVs9xlTUHj1bAThrb1Sm%2Fimage.png?alt=media&#x26;token=cc284dcf-4d30-43a2-8171-c09d8a9009c2" alt=""><figcaption></figcaption></figure>

Access rules and assigned to Terraform Test App

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2F9JiebvXMaxhPM4n8zVNh%2Fimage.png?alt=media&#x26;token=7e30d511-31f7-48f1-8d50-8b50b7b74548" alt=""><figcaption></figcaption></figure>

**Group**

Created a new group "terraform\_test\_group"

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FB8GNNlu8oMmTsLaGnbYq%2Fimage.png?alt=media&#x26;token=c6a2784c-3f01-447a-b34e-7bd7f758acfd" alt=""><figcaption></figcaption></figure>

It looks like everything checked out and was created accordingly!

### Destroy

The final step is to tear down the resources and clean up Okta. To do this, we use the destroy command.

{% embed url="<https://developer.hashicorp.com/terraform/cli/commands/destroy>" %}

```
terraform destroy
```

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FXMfPEUvrB2OO4AztJqrZ%2Fimage.png?alt=media&#x26;token=9deaf4e5-ff97-499d-9774-192c8e878d50" alt=""><figcaption></figcaption></figure>

Similar to the plan command, destroy will give you an output of the resources that will be destroyed. It will also prompt you to type in "yes" to confirm.

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2Fw2tGLHBvYsw3dBYieTvC%2Fimage.png?alt=media&#x26;token=a486e9bc-ca8a-42bc-af33-d15ca9b2573e" alt=""><figcaption></figcaption></figure>

Just like that, Okta is all cleaned up!

### Conclusion

In summary, using Terraform for Okta allows you to manage Okta configuration as code, enabling a more systematic, reliable, and secure approach to managing identities, access policies, and application integrations for organizations.&#x20;

The use of Terraform brings several benefits:

1. **Version Control**: Okta configurations can be stored in version control systems alongside application and infrastructure code, improving collaboration and change management.
2. **Automation**: Automate the provisioning and management of Okta resources, reducing manual errors and operational overhead.
3. **Consistency**: Ensure consistent configurations across different environments (development, staging, production), reducing configuration drift and promoting reliability.
4. **Auditability**: Track changes to Okta configurations over time, improving audit trails and compliance with security policies.
5. **Integration**: Integrate Okta configuration changes into broader CI/CD pipelines, aligning identity and access management (IAM) changes with application and infrastructure updates.

### Additional information

* Okta
  * [Developer.okta.com](https://developer.okta.com)
  * [Okta + Terraform](https://www.okta.com/blog/2019/08/better-together-using-the-okta-integration-with-hashicorp-terraform)
* Terraform
  * [Introduction to Terraform](https://www.terraform.io/intro/index.html)
  * [Terraform Tutorial](https://learn.hashicorp.com/terraform)
  * [Terraform Okta Provider](https://www.terraform.io/docs/providers/okta/index.html)