descope-terraform

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Descope Terraform Provider

Manage Descope authentication projects as infrastructure-as-code using the official Terraform provider.

使用官方Terraform Provider将Descope认证项目作为基础设施即代码进行管理。

Prerequisites

前提条件

Terraform CLI installed
Paid Descope License (Pro +)
Management Key from Company Settings (https://app.descope.com/company)
Management Key must be scoped for all projects if creating new projects

已安装Terraform CLI
付费Descope许可证（Pro及以上版本）
来自公司设置的Management Key（地址：https://app.descope.com/company）
若要创建新项目，Management Key必须拥有所有项目的权限范围

Provider Setup

提供商配置

hcl

terraform {
  required_providers {
    descope = {
      source = "descope/descope"
    }
  }
}

provider "descope" {
  management_key = var.descope_management_key
}

variable "descope_management_key" {
  type      = string
  sensitive = true
}

hcl

terraform {
  required_providers {
    descope = {
      source = "descope/descope"
    }
  }
}

provider "descope" {
  management_key = var.descope_management_key
}

variable "descope_management_key" {
  type      = string
  sensitive = true
}

Resources

资源

Resource	Purpose
`descope_project`	Full project configuration (auth methods, roles, connectors, flows, settings)
`descope_management_key`	Management keys with RBAC scoping
`descope_descoper`	Console user accounts with role assignments

See

references/project-resource.md

for the full

descope_project

schema. See

references/other-resources.md

for

descope_management_key

and

descope_descoper

schemas.

资源	用途
`descope_project`	完整项目配置（认证方式、角色、连接器、流程、设置）
`descope_management_key`	带有RBAC权限范围的Management Key
`descope_descoper`	分配了角色的控制台用户账户

查看

references/project-resource.md

获取完整的

descope_project

schema。查看

references/other-resources.md

获取

descope_management_key

和

descope_descoper

的schema。

Quick Start - New Project

快速开始 - 新项目

hcl

resource "descope_project" "myproject" {
  name = "my-project"
  tags = ["staging"]
}

hcl

resource "descope_project" "myproject" {
  name = "my-project"
  tags = ["staging"]
}

Common Configurations

常见配置

Authentication Methods

认证方式

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  authentication = {
    magic_link = {
      expiration_time = "1 hour"
    }
    password = {
      lock          = true
      lock_attempts = 3
      min_length    = 8
    }
    sso = {
      merge_users  = true
      redirect_url = var.descope_redirect_url
    }
  }
}

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  authentication = {
    magic_link = {
      expiration_time = "1 hour"
    }
    password = {
      lock          = true
      lock_attempts = 3
      min_length    = 8
    }
    sso = {
      merge_users  = true
      redirect_url = var.descope_redirect_url
    }
  }
}

Roles & Permissions (RBAC)

角色与权限（RBAC）

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  authorization = {
    permissions = [
      { name = "read:data", description = "Read access" },
      { name = "write:data", description = "Write access" },
    ]
    roles = [
      {
        name        = "viewer"
        permissions = ["read:data"]
      },
      {
        name        = "editor"
        permissions = ["read:data", "write:data"]
      },
    ]
  }
}

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  authorization = {
    permissions = [
      { name = "read:data", description = "Read access" },
      { name = "write:data", description = "Write access" },
    ]
    roles = [
      {
        name        = "viewer"
        permissions = ["read:data"]
      },
      {
        name        = "editor"
        permissions = ["read:data", "write:data"]
      },
    ]
  }
}

Connectors

连接器

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  connectors = {
    http = [{
      name         = "My Webhook"
      base_url     = var.webhook_url
      bearer_token = var.webhook_secret
    }]
    aws_s3 = [{
      name     = "Audit Logs"
      role_arn = "arn:aws:iam::YOUR_ACCOUNT:role/connector-role"
      region   = "us-east-1"
      bucket   = "audit-logs-bucket"
    }]
  }
}

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  connectors = {
    http = [{
      name         = "My Webhook"
      base_url     = var.webhook_url
      bearer_token = var.webhook_secret
    }]
    aws_s3 = [{
      name     = "Audit Logs"
      role_arn = "arn:aws:iam::YOUR_ACCOUNT:role/connector-role"
      region   = "us-east-1"
      bucket   = "audit-logs-bucket"
    }]
  }
}

Project Settings

项目设置

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  project_settings = {
    refresh_token_expiration = "3 weeks"
    enable_inactivity        = true
    inactivity_time          = "1 hour"
  }
}

hcl

resource "descope_project" "myproject" {
  name = "my-project"

  project_settings = {
    refresh_token_expiration = "3 weeks"
    enable_inactivity        = true
    inactivity_time          = "1 hour"
  }
}

What Terraform Manages vs. What It Does NOT

Terraform 管理范围与非管理范围

Managed by Terraform:

Project settings, authentication methods, authorization (roles/permissions)
Connectors, applications (OIDC/SAML), flows, JWT templates
Custom attributes, styles, widgets

NOT managed by Terraform (use Console/SDK/API instead):

Individual users and tenants
SSO connections and SCIM configurations
Dynamic per-tenant settings

Terraform管理的内容：

项目设置、认证方式、授权（角色/权限）
连接器、应用（OIDC/SAML）、流程、JWT模板
自定义属性、样式、组件

Terraform不管理的内容（请改用控制台/SDK/API）：

单个用户和租户
SSO连接和SCIM配置
动态的租户专属设置

DO NOT

注意事项

DO NOT hardcode
```
management_key
```
in
```
.tf
```
files - use variables or environment variables (
```
DESCOPE_MANAGEMENT_KEY
```
)
DO NOT commit
```
.tfstate
```
files to version control - they contain sensitive data
DO NOT skip
```
terraform plan
```
before
```
terraform apply
```
DO NOT use the deprecated
```
project_id
```
provider argument

请勿在
```
.tf
```
文件中硬编码
```
management_key
```
- 请使用变量或环境变量（
```
DESCOPE_MANAGEMENT_KEY
```
）
请勿将
```
.tfstate
```
文件提交到版本控制系统 - 这些文件包含敏感数据
在执行
```
terraform apply
```
前请勿跳过
```
terraform plan
```
请勿使用已弃用的
```
project_id
```
提供商参数

Workflow

工作流程

bash

terraform init      # Install provider
terraform plan      # Preview changes
terraform apply     # Apply changes
terraform destroy   # Remove managed resources

bash

terraform init      # Install provider
terraform plan      # Preview changes
terraform apply     # Apply changes
terraform destroy   # Remove managed resources

References

参考资料

```
references/project-resource.md
```
- Full descope_project schema and all nested blocks
```
references/other-resources.md
```
- descope_management_key and descope_descoper schemas
```
references/connectors.md
```
- All supported connector types and configuration

```
references/project-resource.md
```
- 完整的descope_project schema及所有嵌套块
```
references/other-resources.md
```
- descope_management_key和descope_descoper的schema
```
references/connectors.md
```
- 所有支持的连接器类型及配置