Is it possible to deploy terraform resources with different access levels, if so how?

user_11593771 0
Viewed 125

I am very new to terraform and looking for suggestion.

we have a use case to maintain and deploy resources using same provider but with different access levels. meaning

  1. Create ABC resources (it requires account administrator privileges)
  2. Create XYZ resources (it requires lower privileges than account admin)

All my resources maintained in one repo sub directories, but we can deploy resources independently using different access level.

snowflake-cloud-data-platform terraform
1 Answers

Typically you would instantiate one provider per login used. You could use the same provider library, but in your terraform you would refer to them separately:

provider "aws" {
    profile = "limited-access-profile"
}

provider "aws" {
    alias   = "admin"
    profile = "high-access-profile"
}


resource "aws_s3_bucket" {
    //This bucket is created with minimal access
    ...
}

resource "aws_s3_bucket" {
    //This bucket is created with high access
    provider = aws.admin
    ...
}

This multiple provider pattern is most commonly used for cross account access, although your use case is doable.

A more common pattern is to run terraform at a high access level to create and add permissions to resources, and then have other tasks and scripts at a low access level to update those resources in place.

Dan_Monego_327710
Related