Terraform Provider

# main.tf
terraform {
  required_version = ">= 1.5"

  required_providers {
    tigeridentity = {
      source  = "tigeridentity/tigeridentity"
      version = "~> 1.0"
    }
  }
}

# Configure the provider
provider "tigeridentity" {
  # API endpoint (defaults to production)
  endpoint = "https://api.tigeridentity.com"

  # Authentication
  api_key = var.tigeridentity_api_key  # From environment variable

  # Optional: Organization ID (if managing multiple orgs)
  organization_id = "org_abc123"
}

# Set API key
export TF_VAR_tigeridentity_api_key="ti_prod_a1b2c3d4e5f6..."

# Or use .env file (don't commit!)
echo 'tigeridentity_api_key = "ti_prod_..."' > terraform.tfvars

terraform init

# Output:
# Initializing provider plugins...
# - Finding tigeridentity/tigeridentity versions matching "~> 1.0"...
# - Installing tigeridentity/tigeridentity v1.0.0...
# Terraform has been successfully initialized!

# Look up existing principal
data "tigeridentity_principal" "alice" {
  email = "[email protected]"
}

# Look up existing policy
data "tigeridentity_policy" "existing_policy" {
  name = "prod-database-access"
}

# Use in other resources
resource "tigeridentity_policy" "new_policy" {
  name = "derived-policy"

  rule {
    principals {
      id = data.tigeridentity_principal.alice.id
    }
    # ...
  }
}

# Query all principals by type
data "tigeridentity_principals" "ai_agents" {
  filter {
    type = "ai_agent"
  }
}

output "agent_count" {
  value = length(data.tigeridentity_principals.ai_agents.principals)
}

# variables.tf
variable "tigeridentity_api_key" {
  type      = string
  sensitive = true
}

variable "environment" {
  type    = string
  default = "production"
}

# main.tf
terraform {
  required_providers {
    tigeridentity = {
      source  = "tigeridentity/tigeridentity"
      version = "~> 1.0"
    }
  }

  # Remote state
  backend "s3" {
    bucket = "mycompany-terraform-state"
    key    = "tigeridentity/prod/terraform.tfstate"
    region = "us-east-1"
  }
}

provider "tigeridentity" {
  api_key = var.tigeridentity_api_key
}

# Okta connector
resource "tigeridentity_connector" "okta" {
  name = "okta-${var.environment}"
  type = "scim"

  config = {
    endpoint      = "https://mycompany.okta.com/api/v1/scim/v2"
    auth_type     = "oauth2"
    client_id     = var.okta_client_id
    client_secret = var.okta_client_secret
    token_url     = "https://mycompany.okta.com/oauth2/v1/token"
  }

  sync_settings {
    sync_interval_minutes = 15
    sync_users            = true
    sync_groups           = true
  }
}

# Production database policy
resource "tigeridentity_policy" "prod_database" {
  name        = "prod-database-jit"
  description = "JIT access to production databases"

  resources {
    type        = "database"
    environment = "production"
  }

  default_decision = "deny"

  rule {
    name   = "engineer-access"
    effect = "allow_with_approval"

    principals {
      department = "engineering"
    }

    actions = ["query", "admin"]

    approval {
      required = true
      approver {
        type = "manager"
      }
      timeout_minutes = 60
    }

    session {
      max_duration_hours    = 2
      require_justification = true
    }
  }
}

# AWS production policy
resource "tigeridentity_policy" "aws_prod" {
  name        = "aws-production-access"
  description = "Access to AWS production account"

  resources {
    type     = "aws_account"
    account_id = "123456789012"
  }

  default_decision = "deny"

  rule {
    name   = "platform-team-access"
    effect = "allow_with_approval"

    principals {
      groups = ["platform-team"]
    }

    actions = ["admin"]

    approval {
      required = true
      approver {
        type = "role"
        role = "security_lead"
      }
    }

    session {
      max_duration_hours = 4
    }
  }
}

# Customer support AI agent
resource "tigeridentity_principal" "support_agent" {
  type = "ai_agent"
  name = "customer-support-agent"

  attributes = {
    agent_type = "assistant"
    model      = "claude-3-5-sonnet"
    department = "customer_success"
  }

  relationships {
    owner = "user_alice"
  }
}

# Policy for AI agent
resource "tigeridentity_policy" "support_agent_policy" {
  name = "customer-support-agent-access"

  resources {
    type = "customer_data"
    sensitivity = ["public", "internal"]  # Not confidential
  }

  default_decision = "deny"

  rule {
    name   = "read-customer-data"
    effect = "allow"

    principals {
      id = tigeridentity_principal.support_agent.id
    }

    actions = ["read", "search"]

    context {
      time_of_day = "business_hours"
    }

    data_masking {
      enabled = true
      fields  = ["ssn", "credit_card"]
    }
  }
}

# Outputs
output "okta_connector_id" {
  value = tigeridentity_connector.okta.id
}

output "support_agent_id" {
  value = tigeridentity_principal.support_agent.id
}

output "policy_count" {
  value = 3
}

# .github/workflows/terraform.yml
name: Terraform TigerIdentity

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  TF_VAR_tigeridentity_api_key: ${{ secrets.TIGERIDENTITY_API_KEY }}

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.5.0

      - name: Terraform Init
        run: terraform init

      - name: Terraform Format Check
        run: terraform fmt -check

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color
        continue-on-error: true

      - name: Comment PR with Plan
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v6
        with:
          script: |
            const output = `#### Terraform Plan 📖
            <details><summary>Show Plan</summary>

            \`\`\`
            ${{ steps.plan.outputs.stdout }}
            \`\`\`

            </details>`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve

      - name: Notify on Failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
          payload: |
            {
              "text": "Terraform deployment failed for TigerIdentity"
            }