Support BYOK in Terraform provider #1041

acwest · 2024-10-04T14:20:04Z

This PR brings support of the Bring Your Own Key (BYOK) functionality in the Auth0 Management API.

🔧 Changes

A new block customer_provided_root_key has been added to the auth0_encryption_key_manager resource.
When this block is added, this initiates the process of adding a customer provided root key to the tenant. The block will at this point be filled with attributes from the Auth0 tenant key_id, type, state, created_at, and updated_at which describe the new key, as well as public_wrapping_key and wrapping_algorithm, which will be used by the customer to wrap the new key they generate in their KSM/HSM.
Once the key is generated and wrapped, the Base64 encoded key is supplied by the customer in the wrapped_key attribute.
If the customer_provided_root_key block is removed, the key provisioning is stopped and Auth0 reverts to using a root key generated internally.

📚 References

Customer Managed Keys

API Docuimentation

🔬 Testing

📝 Checklist

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

codecov-commenter · 2024-10-04T14:22:52Z

Codecov Report

Attention: Patch coverage is 84.10042% with 38 lines in your changes missing coverage. Please review.

Project coverage is 89.37%. Comparing base (3abe81a) to head (e4e8838).

Files with missing lines	Patch %	Lines
internal/auth0/encryptionkeymanager/resource.go	79.12%	26 Missing and 12 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1041      +/-   ##
==========================================
- Coverage   89.43%   89.37%   -0.07%     
==========================================
  Files         125      126       +1     
  Lines       17244    17462     +218     
==========================================
+ Hits        15423    15606     +183     
- Misses       1293     1317      +24     
- Partials      528      539      +11

Files with missing lines	Coverage Δ
internal/auth0/encryptionkeymanager/flatten.go	`100.00% <100.00%> (ø)`
internal/wait/wait.go	`100.00% <100.00%> (ø)`
internal/auth0/encryptionkeymanager/resource.go	`83.92% <79.12%> (-8.85%)`	⬇️

Co-authored-by: KunalOfficial <[email protected]>

Co-authored-by: KunalOfficial <[email protected]> Signed-off-by: BryanLewis-AtOkta <[email protected]>

… for Verify. Patch: Removed MinItems validation for precedence on Connection Resource (auth0#1017) * Removed min/max validation on precendence slice * reverted maxItems validation Add support for all languages for Universal Login (auth0#1016) * Fetch list of languages from CDN instead of hardcoding them * Updated linting --------- Co-authored-by: KunalOfficial <[email protected]> Add Support for `auth0_prompt_screen_partial` and `auth0_prompt_screen_partials` in Prompt Resources (auth0#1013) * Add-Support-for-Prompt-Screen-Partials * Add auth0_prompt_screen_partial Resource and Required Docs * Fix Linting * Updated Go-auth0 Version 1.9.0 to 1.10.0 * Added Testcases for other insertionpoints as well * Fixed Linting * Added More testcases * Correct depends on for datasource of prompt partials Bump github.com/hashicorp/terraform-plugin-testing from 1.9.0 to 1.10.0 (auth0#999) Bumps [github.com/hashicorp/terraform-plugin-testing](https://github.com/hashicorp/terraform-plugin-testing) from 1.9.0 to 1.10.0. - [Release notes](https://github.com/hashicorp/terraform-plugin-testing/releases) - [Changelog](https://github.com/hashicorp/terraform-plugin-testing/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-plugin-testing@v1.9.0...v1.10.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/terraform-plugin-testing dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Add Organizations for Client Credentials (auth0#1009) * Updated schema and added relevant test cases for client with default_organization * Added test recordings * Updated the resource schema and added new test recordinging * Added validation on required arguments * Fixed linting and updated test recording * Deleted a test recording * Updated go.mod Add Sorting to `screen_partials` Flattening Logic to Resolve Indexing Issues with Prompt Screen Partials (auth0#1019) * Change screen_partials to TypeSet for consistent ordering in prompt screen partials * Add Sorting to screen_partials Flattening Logic to Resolve Indexing Issues Add changelog for v1.6.0 (auth0#1020) * Added the changelog * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> --------- Co-authored-by: KunalOfficial <[email protected]> Patch: default_organization on Client Creds (auth0#1021) * Updated flow of importing default_organization * Updated logic for handling default Orgs * Updated test recordings * Updated the conditional check Add changelog for v1.6.1 (auth0#1022) * Added changelog * linting fixes * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> --------- Co-authored-by: KunalOfficial <[email protected]> Add HRI related changes to Terraform provider (auth0#1015) * Add HRI related changes to Terraform provider * Fix broken HasChange behaviour * Change ConflictWith to explicit validation in code * Move validation to plan instead of apply * Fix validation for default resources Add strategy_version support to all connections that use it (auth0#1024) * ESD-39527: Add strategy_version support to all connections that use it * Update go-auth0 dependency * Add examples for strategy_version Add user_id_attribute support to AzureAD connection options (auth0#1028) Add user_id_attribute to AzureAD connection options Bump github.com/auth0/go-auth0 from 1.10.1-0.20240920131149-720c3a081e03 to 1.11.0 (auth0#1036) Bump github.com/auth0/go-auth0 Bumps [github.com/auth0/go-auth0](https://github.com/auth0/go-auth0) from 1.10.1-0.20240920131149-720c3a081e03 to 1.11.0. - [Release notes](https://github.com/auth0/go-auth0/releases) - [Changelog](https://github.com/auth0/go-auth0/blob/main/CHANGELOG.md) - [Commits](https://github.com/auth0/go-auth0/commits/v1.11.0) --- updated-dependencies: - dependency-name: github.com/auth0/go-auth0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Added some minor updates Updated recordings docs updated Add auth0_encryption_keys resource to allow rekeying of encryption keys (auth0#1031) * Add auth0_encryption_key resource to allow rekeying of tenant encryption keys * Slight renaming, and use key_rotation_id instead of rekey attribute * Rename auth0_encryption_key to auth0_encryption_key_manager Add new resource to manage Organization Client Grants (auth0#1027) * Added new resource and data source for org client grants * minor refactoring * Added test case * Updated test recordings * Updated the test name * Fix some timing issues in resourceserver, and add terraform version to server logs * Remove unneeded lint config * rebased * minor refactoring * Added test case * Updated test recordings * Updated the test name * Fix some timing issues in resourceserver, and add terraform version to server logs * Remove unneeded lint config --------- Co-authored-by: A. Craig West <[email protected]> Add support for Form, Flow and Flow Vault Connection (auth0#1039) * form resource * flow resource * flow resource, data source added * update forms * update flow * update go-auth0 v1.11.0 * added flow vault connection * Added flow expand/flatten + tests + recordings * update flow vault connection * form, flow vault connection added unit test, recordings * form, flow vault connection doc update * form, flow vault connection examples added * form, flow vault connection examples added example, data source * form, flow vault connection examples docs updated * lint fix * form, flow unit test added * form flatten unit test added * lint * Updated recordings --------- Co-authored-by: kushalshit27 <[email protected]> PATCH: Ensure Removal of Insertion Points in `auth0_prompt_screen_partial` Resource (auth0#1043) Fix: Ensure Removal of Insertion Points in Resource API Support BYOK in Terraform provider (auth0#1041) Co-authored-by: KunalOfficial <[email protected]> Bump github.com/auth0/go-auth0 from 1.11.0 to 1.11.1 (auth0#1042) Bumps [github.com/auth0/go-auth0](https://github.com/auth0/go-auth0) from 1.11.0 to 1.11.1. - [Release notes](https://github.com/auth0/go-auth0/releases) - [Changelog](https://github.com/auth0/go-auth0/blob/main/CHANGELOG.md) - [Commits](auth0/go-auth0@v1.11.0...v1.11.1) --- updated-dependencies: - dependency-name: github.com/auth0/go-auth0 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Add changelog for 1.7.0 (auth0#1044) * Added changelog for 1.7.0 * Added further changes * removed . * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * removed . * minor refactor --------- Co-authored-by: KunalOfficial <[email protected]> Fix docs for user_id_attribute for AzureAD connection options (auth0#1047) ESD-40277: Fix docs for user_id_attribute for AzureAD connection options PATCH: Add graceful error handling for `auth0_organization` data source when using client grants (auth0#1049) * Added check on tenants which has insufficient scopes and return a empty slice * Updated test case * minor refactoring * minor refactor * linting * linting Updated example for Form (auth0#1046) * Updated example for form PATCH: Implemented checkpoint pagination for retrieving Role users (auth0#1048) * Implemented checkpoint pagination on role users * added tests Add changelog for 1.7.1 (auth0#1050) * Added changelog * refac * refac * refac * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * Added changelog * refac * refac * refac * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * refac * Apply suggestions from code review Co-authored-by: KunalOfficial <[email protected]> * Added changelog * refac * refac * refac * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> * refac * Added changelog * Update CHANGELOG.md Co-authored-by: KunalOfficial <[email protected]> --------- Co-authored-by: KunalOfficial <[email protected]> Fix: Updated `TestAccConnectionAzureAD` test recording (auth0#1052) Updated recording + auth0 version bump Added a check on provider's configuration for required env vars (auth0#1053) * Added a check on provider's configuration for reqd env vars * Added linting

Support BYOK in Terraform provider

d77ad15

acwest force-pushed the DXCDT-651-support-byok-in-terraform branch from e0f8b55 to d77ad15 Compare October 4, 2024 14:22

acwest marked this pull request as ready for review October 4, 2024 15:03

acwest requested a review from a team as a code owner October 4, 2024 15:03

duedares-rvj approved these changes Oct 8, 2024

View reviewed changes

Merge branch 'main' into DXCDT-651-support-byok-in-terraform

e4e8838

acwest merged commit 145d6ae into main Oct 8, 2024
9 checks passed

acwest deleted the DXCDT-651-support-byok-in-terraform branch October 8, 2024 15:52

BryanLewis-AtOkta pushed a commit to BryanLewis-AtOkta/terraform-provider-auth0 that referenced this pull request Oct 24, 2024

Support BYOK in Terraform provider (auth0#1041)

b4c3375

Co-authored-by: KunalOfficial <[email protected]>

BryanLewis-AtOkta pushed a commit to BryanLewis-AtOkta/terraform-provider-auth0 that referenced this pull request Oct 24, 2024

Support BYOK in Terraform provider (auth0#1041)

01bf0fd

Co-authored-by: KunalOfficial <[email protected]> Signed-off-by: BryanLewis-AtOkta <[email protected]>

BryanLewis-AtOkta pushed a commit to BryanLewis-AtOkta/terraform-provider-auth0 that referenced this pull request Oct 24, 2024

Support BYOK in Terraform provider (auth0#1041)

791b1ff

Co-authored-by: KunalOfficial <[email protected]> Signed-off-by: BryanLewis-AtOkta <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support BYOK in Terraform provider #1041

Support BYOK in Terraform provider #1041

acwest commented Oct 4, 2024 •

edited

Loading

codecov-commenter commented Oct 4, 2024 •

edited

Loading

Support BYOK in Terraform provider #1041

Support BYOK in Terraform provider #1041

Conversation

acwest commented Oct 4, 2024 • edited Loading

🔧 Changes

📚 References

Customer Managed Keys

API Docuimentation

🔬 Testing

📝 Checklist

codecov-commenter commented Oct 4, 2024 • edited Loading

Codecov Report

acwest commented Oct 4, 2024 •

edited

Loading

codecov-commenter commented Oct 4, 2024 •

edited

Loading