Configuring Terraform for Delinea Platform Integration

To integrate Terraform with Delinea Platform, you must copy and update required files from the Terraform provider GitHub repository:

• Terraform configuration files (.tf)

• Terraform variable files (.tfvars)

Step 1: Copy and Update the Terraform Configuration Files (.tf)

1. Go to the Delinea Terraform provider GitHub repository terraform-provider-tss/examples/secrets.

2. Copy the relevant example .tf file into your Terraform working directory. Rename them if needed (e.g., main.tf).

Use Case	Example File
Retrieve a single secret	secret_get.tf
Retrieve multiple secrets	secrets_get.tf
Create or update a secret	secret_create.tf
Retrieve ephemeral secret	ephemeral_secret_get.tf
Retrieve multiple ephemeral secrets	ephemeral_secrets_get.tf
Delete Secret by id	secret_delete.tf
Delete multiple secrets by their id	secrets_delete.tf

3. Update each file with the required configuration definition.

• The required Terraform version

• The Delinea provider version (terraform-provider-tss)

• References to variables

• The type of secret-management operation to perform

4. Inside your copied .tf file, update the required provider block. This ensures Terraform uses the correct provider and version to communicate with Delinea Platform

Copy

terraform {
                required_version = "> 1.10.5"
                required_providers {
                tss = {
                source  = "DelineaXPM/tss"
                version = "3.0.0"
                }
                }
        }

                tss_username   = "username"
                tss_password   = "password"
                tss_server_url = "https://yourtenantname.delinea.app"
                tss_secret_id  = 1

                tss_token      = "token"
                tss_server_url = "https://yourtenantname.delinea.app"
                tss_secret_id  = 1

                tss_username   = "username"
                tss_password   = "password"
                tss_server_url = "https://yourtenantname.delinea.app"
                tss_secret_id  = ["1", "2", "3"]

                tss_token      = "token"
                tss_server_url = "https://yourtenantname.delinea.app"
                tss_secret_id  = ["1", "2", "3"]

ephemeral "tss_secret" "my_username" {
id    = var.tss_secret_id
field = "username"
}
ephemeral "tss_secret" "my_password" {
id    = var.tss_secret_id
field = "password"
}

resource "print_resource" "print_username" {
secret = ephemeral.tss_secret.my_username.secret_value
}
resource "print_resource" "print_usernames" {
secret = ephemeral.tss_secrets.my_usernames.secrets
}

SSH Keys and Passphrase Generation in Terraform Provider for TSS

To generate SSH keys and a passphrase when creating a secret using templates that include SSH key and passphrase fields, you need to set the generate_passphrase and generate_ssh_keys flags to true. By default, these flags are set to false.

To Pass SSH Key and Passphrase Generation Arguments from Terraform Variable File:

fields = [
					{
					fieldname = "Public Key"
					itemvalue = null
					},
					{
					fieldname = "Private Key"
					itemvalue = null
					},
					{
					fieldname = "Private Key Passphrase"
					itemvalue = null
					}
					]

					# SSH Key Generation Settings
					generate_passphrase = true
					generate_ssh_keys   = true
		

Important Notes

1. Set itemvalue to null for SSH key fields.
2. Set the appropriate boolean values for generate_passphrase and generate_ssh_keys.

Limitations and Considerations

1. Creation Only: SSH key generation is only supported during secret creation, not during updates.
2. Field Values: When updating a secret with previously generated SSH keys, the provider will automatically preserve the generated values.

Delete Secret

This functionality deactivates the secret in Delinea Secret Server. It does not permanently delete the secret, but renders it inaccessible.

Delete Secret by ID

The tss_secret_deletion resource allows you to delete a secret by its ID, even if it is not managed by Terraform state. Use the following block in your .tf file:

resource "tss_secret_deletion" "delete_secret" {
				secret_id = var.tss_secret_id
				}
		

Apply this configuration to delete the secret with the ID provided in your Terraform variable file. After deletion, run terraform destroy to remove the resource from state before deleting another secret.

Delete Multiple Secrets

The tss_secret_deletion resource also supports deleting multiple secrets by their IDs, even if they are not managed by Terraform state. Use the following block in your .tf file:

resource "tss_secret_deletion" "delete_secrets" {
				for_each  = toset(var.tss_secret_ids)
				secret_id = tonumber(each.key)
				}
		

This configuration deletes all secrets listed in the set provided from the Terraform variable file. Each deletion is tracked separately in state.

Important Notes

• After deleting, run terraform destroy to clean up the state before deleting new secrets.
• Deletion is performed during the terraform apply phase.
• The resource is tracked in state to prevent repeated deletion attempts.
• Creating... in logs indicates the deletion is being performed.

Step 3: Complete Configuration

After completing the configuration, your Terraform executable directory should include:

• The .tf configuration file

• The .tfvars variable file

• Terraform executable (terraform)