Skip to main content
Version: 16.x

Reference for the teleport_workload_identity Terraform data-source

Schema​

Optional​

  • metadata (Attributes) Common metadata that all resources share. (see below for nested schema)
  • spec (Attributes) The configured properties of the WorkloadIdentity (see below for nested schema)
  • sub_kind (String) Differentiates variations of the same kind. All resources should contain one, even if it is never populated.
  • version (String) The version of the resource being represented.

Nested Schema for metadata​

Optional:

  • description (String) description is object description.
  • expires (String) expires is a global expiry time header can be set on any resource in the system.
  • labels (Map of String) labels is a set of labels.
  • name (String) name is an object name.

Nested Schema for spec​

Optional:

  • rules (Attributes) The rules which are evaluated before the WorkloadIdentity can be issued. (see below for nested schema)
  • spiffe (Attributes) Configuration pertaining to the issuance of SPIFFE-compatible workload identity credentials. (see below for nested schema)

Nested Schema for spec.rules​

Optional:

  • allow (Attributes List) A list of rules used to determine if a WorkloadIdentity can be issued. If none are provided, it will be considered a pass. If any are provided, then at least one must pass for the rules to be considered passed. (see below for nested schema)

Nested Schema for spec.rules.allow​

Optional:

  • conditions (Attributes List) The conditions that must be met for this rule to be considered passed. (see below for nested schema)

Nested Schema for spec.rules.allow.conditions​

Optional:

  • attribute (String) The name of the attribute to evaluate the condition against.
  • eq (Attributes) The attribute casted to a string must be equal to the value. (see below for nested schema)
  • in (Attributes) The attribute casted to a string must be in the list of values. (see below for nested schema)
  • not_eq (Attributes) The attribute casted to a string must not be equal to the value. (see below for nested schema)
  • not_in (Attributes) The attribute casted to a string must not be in the list of values. (see below for nested schema)

Nested Schema for spec.rules.allow.conditions.eq​

Optional:

  • value (String) The value to compare the attribute against.

Nested Schema for spec.rules.allow.conditions.in​

Optional:

  • values (List of String) The list of values to compare the attribute against.

Nested Schema for spec.rules.allow.conditions.not_eq​

Optional:

  • value (String) The value to compare the attribute against.

Nested Schema for spec.rules.allow.conditions.not_in​

Optional:

  • values (List of String) The list of values to compare the attribute against.

Nested Schema for spec.spiffe​

Optional:

  • hint (String) A freeform text field which is provided to workloads along with a credential produced by this WorkloadIdentity. This can be used to provide additional context that can be used to select between multiple credentials.
  • id (String) The path of the SPIFFE ID that will be issued to the workload. This should be prefixed with a forward-slash ("/"). This field supports templating using attributes.
  • x509 (Attributes) Configuration specific to X509-SVIDs. (see below for nested schema)

Nested Schema for spec.spiffe.x509​

Optional:

  • dns_sans (List of String) The DNS Subject Alternative Names (SANs) that should be included in an X509-SVID issued using this WorkloadIdentity. Each entry in this list supports templating using attributes.
  • subject_template (Attributes) Used to configure the Subject Distinguished Name (DN) of the X509-SVID. In most circumstances, it is recommended to prefer relying on the SPIFFE ID encoded in the URI SAN. However, the Subject DN may be needed to support legacy systems designed for X509 and not SPIFFE/WIMSE. If not provided, the X509-SVID will be issued with an empty Subject DN. (see below for nested schema)

Nested Schema for spec.spiffe.x509.subject_template​

Optional:

  • common_name (String) Common Name (CN) - 2.5.4.3 If empty, the RDN will be omitted from the DN.
  • organization (String) Organization (O) - 2.5.4.10 If empty, the RDN will be omitted from the DN.
  • organizational_unit (String) Organizational Unit (OU) - 2.5.4.11 If empty, the RDN will be omitted from the DN.