Terrateam has been hard at work on our latest feature Access Control. We’re happy to announce that it’s ready for the public!
Access Control capabilities define who can do what when. For example, a capability could define who can trigger a Terrateam Plan or Apply operation.
Capabilities are included in each policy. Here are the main capabilities:
apply: Define who can trigger a
apply_autoapprove: Define who can trigger a
terraform apply -auto-approve.
apply_force: Define who can trigger a
terraform applybypassing Apply Requirements.
plan: Define who can trigger a
There are many reasons why an organization would want to implement access controls against their Terraform resources. Whether it be compliance, best practices, or other concerns, our Access Control feature is flexible enough to control selective restriction of access against Terraform resources.
Using the Terrateam runtime configuration, many Access Control policies can be defined.
access_control: enabled: true policies: - tag_query: '' # Match all Terraform resources plan: ['*'] apply: ['team:sre']
# Tag ./ec2/qa and ./ec2/production directories so we # can reference them later. dirs: ec2/qa: tags: [ec2, qa] ec2/production: tags: [ec2, production] access_control: enabled: true policies: - tag_query: ec2 qa # Match Terraform resources in ./ec2/qa plan: ['*'] apply: ['*'] - tag_query: ec2 production # Match Terraform resources in ./ec2/production plan: ['*'] apply: ['team:sre']
access_control: enabled: true policies: - tag_query: '' # Match all Terraform resources plan: ['*'] apply: ['*'] apply_force: ['team:sre']
access_control: policies: - tag_query: '' apply:  superapproval: ['team:sre'] apply_with_superapproval: ['team:engineering']
GitHub people, teams, and roles can be used in a ruleset for a policy. This includes:
Referencing these subjects in the Access Control section of your Terrateam runtime configuration file makes it possible to quickly create rules for who is capable of triggering a Terrateam operation against specific Terraform resources.
When someone comments on a pull request with a Terrateam command, the Terrateam backend will determine if the user attempting to trigger the operation is permitted to do so.
The Access Control configuration is always sourced from the GitHub repository default branch. This is to prevent a user from circumventing Access Control policies in their feature branch.
Every capability has a rule. Every rule has a list of rulesets. If any rule matches the user attempting to trigger the operation, the user is granted access.
|Match a GitHub username.|
|Match a GitHub teamname.|
|Match a GitHub rolename defined in the repository.|
See the Access Control documentation for all available configuration options and capabilities.