This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | +| [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | +| [auth0\_app\_connections](#input\_auth0\_app\_connections) | The list of Auth0 apps to add to this connection |
list(object({
component = optional(string, "auth0/app")
environment = optional(string, "")
stage = optional(string, "")
tenant = optional(string, "")
})) | `[]` | no |
+| [auth0\_debug](#input\_auth0\_debug) | Enable debug mode for the Auth0 provider | `bool` | `true` | no |
+| [auth0\_tenant\_component\_name](#input\_auth0\_tenant\_component\_name) | The name of the component | `string` | `"auth0/tenant"` | no |
+| [auth0\_tenant\_environment\_name](#input\_auth0\_tenant\_environment\_name) | The name of the environment where the Auth0 tenant component is deployed. Defaults to the environment of the current stack. | `string` | `""` | no |
+| [auth0\_tenant\_stage\_name](#input\_auth0\_tenant\_stage\_name) | The name of the stage where the Auth0 tenant component is deployed. Defaults to the stage of the current stack. | `string` | `""` | no |
+| [auth0\_tenant\_tenant\_name](#input\_auth0\_tenant\_tenant\_name) | The name of the tenant where the Auth0 tenant component is deployed. Yes this is a bit redundant, since Auth0 also calls this resource a tenant. Defaults to the tenant of the current stack. | `string` | `""` | no |
+| [auth\_params](#input\_auth\_params) | Query string parameters to be included as part of the generated passwordless email link. | object({
scope = optional(string, null)
response_type = optional(string, null)
}) | `{}` | no |
+| [brute\_force\_protection](#input\_brute\_force\_protection) | Indicates whether to enable brute force protection, which will limit the number of signups and failed logins from a suspicious IP address. | `bool` | `true` | no |
+| [connection\_name](#input\_connection\_name) | The name of the connection | `string` | `""` | no |
+| [context](#input\_context) | Single object for setting entire context at once.See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` |
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
} | no |
+| [create\_auth0\_ssm\_parameters\_enabled](#input\_create\_auth0\_ssm\_parameters\_enabled) | Whether or not to create a duplicate of the AWS SSM parameter for the Auth0 domain, client ID, and client secret in this account. | `bool` | `false` | no |
+| [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | +| [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | +| [disable\_signup](#input\_disable\_signup) | Indicates whether to allow user sign-ups to your application. | `bool` | `false` | no | +| [email\_from](#input\_email\_from) | When using an email strategy, the address to use as the sender | `string` | `null` | no | +| [email\_subject](#input\_email\_subject) | When using an email strategy, the subject of the email | `string` | `null` | no | +| [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | +| [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | +| [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | +| [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | +| [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | +| [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | +| [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` |
[| no | +| [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
"default"
]
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | +| [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | +| [non\_persistent\_attrs](#input\_non\_persistent\_attrs) | If there are user fields that should not be stored in Auth0 databases due to privacy reasons, you can add them to the DenyList here. | `list(string)` | `[]` | no | +| [options\_name](#input\_options\_name) | The name of the connection options. Required for the email strategy. | `string` | `""` | no | +| [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | +| [region](#input\_region) | AWS Region | `string` | n/a | yes | +| [set\_user\_root\_attributes](#input\_set\_user\_root\_attributes) | Determines whether to sync user profile attributes at each login or only on the first login. Options include: `on_each_login`, `on_first_login`. | `string` | `null` | no | +| [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | +| [strategy](#input\_strategy) | The strategy to use for the connection | `string` | `"auth0"` | no | +| [syntax](#input\_syntax) | The syntax of the template body | `string` | `null` | no | +| [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | +| [template](#input\_template) | The template to use for the connection. If not provided, the `template_file` variable must be set. | `string` | `""` | no | +| [template\_file](#input\_template\_file) | The path to the template file. If not provided, the `template` variable must be set. | `string` | `""` | no | +| [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | +| [totp](#input\_totp) | The TOTP settings for the connection |
object({
time_step = optional(number, 900)
length = optional(number, 6)
}) | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| [auth0\_connection\_id](#output\_auth0\_connection\_id) | The Auth0 Connection ID |
+
+
+
+## References
+
+- [cloudposse/terraform-aws-components](https://github.com/cloudposse/terraform-aws-components/tree/main/modules/auth0/connection) -
+ Cloud Posse's upstream component
+- [Auth0 Terraform Provider](https://registry.terraform.io/providers/auth0/auth0/latest/)
+- [Auth0 Documentation](https://auth0.com/docs/)
+
+[
](https://cpco.io/component)
diff --git a/modules/auth0/connection/context.tf b/modules/auth0/connection/context.tf
new file mode 100644
index 000000000..5e0ef8856
--- /dev/null
+++ b/modules/auth0/connection/context.tf
@@ -0,0 +1,279 @@
+#
+# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
+# All other instances of this file should be a copy of that one
+#
+#
+# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
+# and then place it in your Terraform module to automatically get
+# Cloud Posse's standard configuration inputs suitable for passing
+# to Cloud Posse modules.
+#
+# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
+#
+# Modules should access the whole context as `module.this.context`
+# to get the input variables with nulls for defaults,
+# for example `context = module.this.context`,
+# and access individual variables as `module.this.`,
+# with final values filled in.
+#
+# For example, when using defaults, `module.this.context.delimiter`
+# will be null, and `module.this.delimiter` will be `-` (hyphen).
+#
+
+module "this" {
+ source = "cloudposse/label/null"
+ version = "0.25.0" # requires Terraform >= 0.13.0
+
+ enabled = var.enabled
+ namespace = var.namespace
+ tenant = var.tenant
+ environment = var.environment
+ stage = var.stage
+ name = var.name
+ delimiter = var.delimiter
+ attributes = var.attributes
+ tags = var.tags
+ additional_tag_map = var.additional_tag_map
+ label_order = var.label_order
+ regex_replace_chars = var.regex_replace_chars
+ id_length_limit = var.id_length_limit
+ label_key_case = var.label_key_case
+ label_value_case = var.label_value_case
+ descriptor_formats = var.descriptor_formats
+ labels_as_tags = var.labels_as_tags
+
+ context = var.context
+}
+
+# Copy contents of cloudposse/terraform-null-label/variables.tf here
+
+variable "context" {
+ type = any
+ default = {
+ enabled = true
+ namespace = null
+ tenant = null
+ environment = null
+ stage = null
+ name = null
+ delimiter = null
+ attributes = []
+ tags = {}
+ additional_tag_map = {}
+ regex_replace_chars = null
+ label_order = []
+ id_length_limit = null
+ label_key_case = null
+ label_value_case = null
+ descriptor_formats = {}
+ # Note: we have to use [] instead of null for unset lists due to
+ # https://github.com/hashicorp/terraform/issues/28137
+ # which was not fixed until Terraform 1.0.0,
+ # but we want the default to be all the labels in `label_order`
+ # and we want users to be able to prevent all tag generation
+ # by setting `labels_as_tags` to `[]`, so we need
+ # a different sentinel to indicate "default"
+ labels_as_tags = ["unset"]
+ }
+ description = <<-EOT
+ Single object for setting entire context at once.
+ See description of individual variables for details.
+ Leave string and numeric variables as `null` to use default value.
+ Individual variable settings (non-null) override settings in context object,
+ except for attributes, tags, and additional_tag_map, which are merged.
+ EOT
+
+ validation {
+ condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
+ error_message = "Allowed values: `lower`, `title`, `upper`."
+ }
+
+ validation {
+ condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
+ error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+ }
+}
+
+variable "enabled" {
+ type = bool
+ default = null
+ description = "Set to false to prevent the module from creating any resources"
+}
+
+variable "namespace" {
+ type = string
+ default = null
+ description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
+}
+
+variable "tenant" {
+ type = string
+ default = null
+ description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
+}
+
+variable "environment" {
+ type = string
+ default = null
+ description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
+}
+
+variable "stage" {
+ type = string
+ default = null
+ description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
+}
+
+variable "name" {
+ type = string
+ default = null
+ description = <<-EOT
+ ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
+ This is the only ID element not also included as a `tag`.
+ The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
+ EOT
+}
+
+variable "delimiter" {
+ type = string
+ default = null
+ description = <<-EOT
+ Delimiter to be used between ID elements.
+ Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
+ EOT
+}
+
+variable "attributes" {
+ type = list(string)
+ default = []
+ description = <<-EOT
+ ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
+ in the order they appear in the list. New attributes are appended to the
+ end of the list. The elements of the list are joined by the `delimiter`
+ and treated as a single ID element.
+ EOT
+}
+
+variable "labels_as_tags" {
+ type = set(string)
+ default = ["default"]
+ description = <<-EOT
+ Set of labels (ID elements) to include as tags in the `tags` output.
+ Default is to include all labels.
+ Tags with empty values will not be included in the `tags` output.
+ Set to `[]` to suppress all generated tags.
+ **Notes:**
+ The value of the `name` tag, if included, will be the `id`, not the `name`.
+ Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
+ changed in later chained modules. Attempts to change it will be silently ignored.
+ EOT
+}
+
+variable "tags" {
+ type = map(string)
+ default = {}
+ description = <<-EOT
+ Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
+ Neither the tag keys nor the tag values will be modified by this module.
+ EOT
+}
+
+variable "additional_tag_map" {
+ type = map(string)
+ default = {}
+ description = <<-EOT
+ Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
+ This is for some rare cases where resources want additional configuration of tags
+ and therefore take a list of maps with tag key, value, and additional configuration.
+ EOT
+}
+
+variable "label_order" {
+ type = list(string)
+ default = null
+ description = <<-EOT
+ The order in which the labels (ID elements) appear in the `id`.
+ Defaults to ["namespace", "environment", "stage", "name", "attributes"].
+ You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
+ EOT
+}
+
+variable "regex_replace_chars" {
+ type = string
+ default = null
+ description = <<-EOT
+ Terraform regular expression (regex) string.
+ Characters matching the regex will be removed from the ID elements.
+ If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
+ EOT
+}
+
+variable "id_length_limit" {
+ type = number
+ default = null
+ description = <<-EOT
+ Limit `id` to this many characters (minimum 6).
+ Set to `0` for unlimited length.
+ Set to `null` for keep the existing setting, which defaults to `0`.
+ Does not affect `id_full`.
+ EOT
+ validation {
+ condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
+ error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
+ }
+}
+
+variable "label_key_case" {
+ type = string
+ default = null
+ description = <<-EOT
+ Controls the letter case of the `tags` keys (label names) for tags generated by this module.
+ Does not affect keys of tags passed in via the `tags` input.
+ Possible values: `lower`, `title`, `upper`.
+ Default value: `title`.
+ EOT
+
+ validation {
+ condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
+ error_message = "Allowed values: `lower`, `title`, `upper`."
+ }
+}
+
+variable "label_value_case" {
+ type = string
+ default = null
+ description = <<-EOT
+ Controls the letter case of ID elements (labels) as included in `id`,
+ set as tag values, and output by this module individually.
+ Does not affect values of tags passed in via the `tags` input.
+ Possible values: `lower`, `title`, `upper` and `none` (no transformation).
+ Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
+ Default value: `lower`.
+ EOT
+
+ validation {
+ condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
+ error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+ }
+}
+
+variable "descriptor_formats" {
+ type = any
+ default = {}
+ description = <<-EOT
+ Describe additional descriptors to be output in the `descriptors` output map.
+ Map of maps. Keys are names of descriptors. Values are maps of the form
+ `{
+ format = string
+ labels = list(string)
+ }`
+ (Type is `any` so the map values can later be enhanced to provide additional options.)
+ `format` is a Terraform format string to be passed to the `format()` function.
+ `labels` is a list of labels, in order, to pass to `format()` function.
+ Label values will be normalized before being passed to `format()` so they will be
+ identical to how they appear in `id`.
+ Default is `{}` (`descriptors` output will be empty).
+ EOT
+}
+
+#### End of copy of cloudposse/terraform-null-label/variables.tf
diff --git a/modules/auth0/connection/main.tf b/modules/auth0/connection/main.tf
new file mode 100644
index 000000000..2451cf70d
--- /dev/null
+++ b/modules/auth0/connection/main.tf
@@ -0,0 +1,41 @@
+locals {
+ enabled = module.this.enabled
+
+ # If var.template is set, use it.
+ # Otherwise, if var.template_file is set, use that file content.
+ # Otherwise, use null.
+ template = length(var.template) > 0 ? var.template : length(var.template_file) > 0 ? file("${path.module}/${var.template_file}") : null
+}
+
+resource "auth0_connection" "this" {
+ count = local.enabled ? 1 : 0
+
+ strategy = var.strategy
+ name = length(var.connection_name) > 0 ? var.connection_name : module.this.name
+
+ options {
+ name = var.options_name
+ from = var.email_from
+ subject = var.email_subject
+ syntax = var.syntax
+ template = local.template
+
+ disable_signup = var.disable_signup
+ brute_force_protection = var.brute_force_protection
+ set_user_root_attributes = var.set_user_root_attributes
+ non_persistent_attrs = var.non_persistent_attrs
+ auth_params = var.auth_params
+
+ totp {
+ time_step = var.totp.time_step
+ length = var.totp.length
+ }
+ }
+}
+
+resource "auth0_connection_clients" "this" {
+ count = local.enabled ? 1 : 0
+
+ connection_id = auth0_connection.this[0].id
+ enabled_clients = length(module.auth0_apps) > 0 ? [for auth0_app in module.auth0_apps : auth0_app.outputs.auth0_client_id] : []
+}
diff --git a/modules/auth0/connection/outputs.tf b/modules/auth0/connection/outputs.tf
new file mode 100644
index 000000000..e1a0f06f1
--- /dev/null
+++ b/modules/auth0/connection/outputs.tf
@@ -0,0 +1,4 @@
+output "auth0_connection_id" {
+ value = auth0_connection.this[0].id
+ description = "The Auth0 Connection ID"
+}
diff --git a/modules/auth0/connection/provider-auth0-client.tf b/modules/auth0/connection/provider-auth0-client.tf
new file mode 100644
index 000000000..1b35cf9b5
--- /dev/null
+++ b/modules/auth0/connection/provider-auth0-client.tf
@@ -0,0 +1,149 @@
+#
+# Fetch the Auth0 tenant component deployment in some stack
+#
+variable "auth0_tenant_component_name" {
+ description = "The name of the component"
+ type = string
+ default = "auth0/tenant"
+}
+
+variable "auth0_tenant_environment_name" {
+ description = "The name of the environment where the Auth0 tenant component is deployed. Defaults to the environment of the current stack."
+ type = string
+ default = ""
+}
+
+variable "auth0_tenant_stage_name" {
+ description = "The name of the stage where the Auth0 tenant component is deployed. Defaults to the stage of the current stack."
+ type = string
+ default = ""
+}
+
+variable "auth0_tenant_tenant_name" {
+ description = "The name of the tenant where the Auth0 tenant component is deployed. Yes this is a bit redundant, since Auth0 also calls this resource a tenant. Defaults to the tenant of the current stack."
+ type = string
+ default = ""
+}
+
+locals {
+ auth0_tenant_environment_name = length(var.auth0_tenant_environment_name) > 0 ? var.auth0_tenant_environment_name : module.this.environment
+ auth0_tenant_stage_name = length(var.auth0_tenant_stage_name) > 0 ? var.auth0_tenant_stage_name : module.this.stage
+ auth0_tenant_tenant_name = length(var.auth0_tenant_tenant_name) > 0 ? var.auth0_tenant_tenant_name : module.this.tenant
+}
+
+module "auth0_tenant" {
+ source = "cloudposse/stack-config/yaml//modules/remote-state"
+ version = "1.5.0"
+
+ count = local.enabled ? 1 : 0
+
+ component = var.auth0_tenant_component_name
+
+ environment = local.auth0_tenant_environment_name
+ stage = local.auth0_tenant_stage_name
+ tenant = local.auth0_tenant_tenant_name
+}
+
+#
+# Set up the AWS provider to access AWS SSM parameters in the same account as the Auth0 tenant
+#
+
+provider "aws" {
+ alias = "auth0_provider"
+ region = var.region
+
+ # Profile is deprecated in favor of terraform_role_arn. When profiles are not in use, terraform_profile_name is null.
+ profile = module.iam_roles_auth0_provider.terraform_profile_name
+
+ dynamic "assume_role" {
+ # module.iam_roles_auth0_provider.terraform_role_arn may be null, in which case do not assume a role.
+ for_each = compact([module.iam_roles_auth0_provider.terraform_role_arn])
+ content {
+ role_arn = assume_role.value
+ }
+ }
+}
+
+module "iam_roles_auth0_provider" {
+ source = "../../account-map/modules/iam-roles"
+
+ environment = local.auth0_tenant_environment_name
+ stage = local.auth0_tenant_stage_name
+ tenant = local.auth0_tenant_tenant_name
+
+ context = module.this.context
+}
+
+data "aws_ssm_parameter" "auth0_domain" {
+ provider = aws.auth0_provider
+ name = module.auth0_tenant[0].outputs.domain_ssm_path
+}
+
+data "aws_ssm_parameter" "auth0_client_id" {
+ provider = aws.auth0_provider
+ name = module.auth0_tenant[0].outputs.client_id_ssm_path
+}
+
+data "aws_ssm_parameter" "auth0_client_secret" {
+ provider = aws.auth0_provider
+ name = module.auth0_tenant[0].outputs.client_secret_ssm_path
+}
+
+#
+# Initialize the Auth0 provider with the Auth0 domain, client ID, and client secret from that deployment
+#
+
+variable "auth0_debug" {
+ type = bool
+ description = "Enable debug mode for the Auth0 provider"
+ default = true
+}
+
+provider "auth0" {
+ domain = data.aws_ssm_parameter.auth0_domain.value
+ client_id = data.aws_ssm_parameter.auth0_client_id.value
+ client_secret = data.aws_ssm_parameter.auth0_client_secret.value
+ debug = var.auth0_debug
+}
+
+#
+# Finally if enabled, create a duplicate of the AWS SSM parameters for Auth0 in this account.
+#
+variable "create_auth0_ssm_parameters_enabled" {
+ description = "Whether or not to create a duplicate of the AWS SSM parameter for the Auth0 domain, client ID, and client secret in this account."
+ type = bool
+ default = false
+}
+
+module "auth0_ssm_parameters" {
+ source = "cloudposse/ssm-parameter-store/aws"
+ version = "0.13.0"
+
+ enabled = local.enabled && var.create_auth0_ssm_parameters_enabled
+
+ parameter_write = [
+ {
+ name = module.auth0_tenant[0].outputs.domain_ssm_path
+ value = data.aws_ssm_parameter.auth0_domain.value
+ type = "SecureString"
+ overwrite = "true"
+ description = "Auth0 domain value for the Auth0 ${local.auth0_tenant_tenant_name}-${local.auth0_tenant_environment_name}-${local.auth0_tenant_stage_name} tenant"
+ },
+ {
+ name = module.auth0_tenant[0].outputs.client_id_ssm_path
+ value = data.aws_ssm_parameter.auth0_client_id.value
+ type = "SecureString"
+ overwrite = "true"
+ description = "Auth0 client ID for the Auth0 ${local.auth0_tenant_tenant_name}-${local.auth0_tenant_environment_name}-${local.auth0_tenant_stage_name} tenant"
+ },
+ {
+ name = module.auth0_tenant[0].outputs.client_secret_ssm_path
+ value = data.aws_ssm_parameter.auth0_client_secret.value
+ type = "SecureString"
+ overwrite = "true"
+ description = "Auth0 client secret for the Auth0 ${local.auth0_tenant_tenant_name}-${local.auth0_tenant_environment_name}-${local.auth0_tenant_stage_name} tenant"
+ },
+ ]
+
+ context = module.this.context
+}
diff --git a/modules/auth0/connection/providers.tf b/modules/auth0/connection/providers.tf
new file mode 100644
index 000000000..89ed50a98
--- /dev/null
+++ b/modules/auth0/connection/providers.tf
@@ -0,0 +1,19 @@
+provider "aws" {
+ region = var.region
+
+ # Profile is deprecated in favor of terraform_role_arn. When profiles are not in use, terraform_profile_name is null.
+ profile = module.iam_roles.terraform_profile_name
+
+ dynamic "assume_role" {
+ # module.iam_roles.terraform_role_arn may be null, in which case do not assume a role.
+ for_each = compact([module.iam_roles.terraform_role_arn])
+ content {
+ role_arn = assume_role.value
+ }
+ }
+}
+
+module "iam_roles" {
+ source = "../../account-map/modules/iam-roles"
+ context = module.this.context
+}
diff --git a/modules/auth0/connection/remote-state.tf b/modules/auth0/connection/remote-state.tf
new file mode 100644
index 000000000..068ecc6b7
--- /dev/null
+++ b/modules/auth0/connection/remote-state.tf
@@ -0,0 +1,11 @@
+module "auth0_apps" {
+ source = "cloudposse/stack-config/yaml//modules/remote-state"
+ version = "1.5.0"
+
+ for_each = local.enabled ? { for app in var.auth0_app_connections : "${app.tenant}-${app.environment}-${app.stage}-${app.component}" => app } : {}
+
+ component = each.value.component
+ tenant = length(each.value.tenant) > 0 ? each.value.tenant : module.this.tenant
+ environment = length(each.value.environment) > 0 ? each.value.environment : module.this.environment
+ stage = length(each.value.stage) > 0 ? each.value.stage : module.this.stage
+}
diff --git a/modules/auth0/connection/templates/.gitkeep b/modules/auth0/connection/templates/.gitkeep
new file mode 100644
index 000000000..e69de29bb
diff --git a/modules/auth0/connection/variables.tf b/modules/auth0/connection/variables.tf
new file mode 100644
index 000000000..748d3bb19
--- /dev/null
+++ b/modules/auth0/connection/variables.tf
@@ -0,0 +1,105 @@
+variable "region" {
+ type = string
+ description = "AWS Region"
+}
+
+variable "auth0_app_connections" {
+ type = list(object({
+ component = optional(string, "auth0/app")
+ environment = optional(string, "")
+ stage = optional(string, "")
+ tenant = optional(string, "")
+ }))
+ default = []
+ description = "The list of Auth0 apps to add to this connection"
+}
+
+variable "strategy" {
+ type = string
+ description = "The strategy to use for the connection"
+ default = "auth0"
+}
+
+variable "connection_name" {
+ type = string
+ description = "The name of the connection"
+ default = ""
+}
+
+variable "options_name" {
+ type = string
+ description = "The name of the connection options. Required for the email strategy."
+ default = ""
+}
+
+variable "email_from" {
+ type = string
+ description = "When using an email strategy, the address to use as the sender"
+ default = null
+}
+
+variable "email_subject" {
+ type = string
+ description = "When using an email strategy, the subject of the email"
+ default = null
+}
+
+variable "syntax" {
+ type = string
+ description = "The syntax of the template body"
+ default = null
+}
+
+variable "disable_signup" {
+ type = bool
+ description = "Indicates whether to allow user sign-ups to your application."
+ default = false
+}
+
+variable "brute_force_protection" {
+ type = bool
+ description = "Indicates whether to enable brute force protection, which will limit the number of signups and failed logins from a suspicious IP address."
+ default = true
+}
+
+variable "set_user_root_attributes" {
+ type = string
+ description = "Determines whether to sync user profile attributes at each login or only on the first login. Options include: `on_each_login`, `on_first_login`."
+ default = null
+}
+
+variable "non_persistent_attrs" {
+ type = list(string)
+ description = "If there are user fields that should not be stored in Auth0 databases due to privacy reasons, you can add them to the DenyList here."
+ default = []
+}
+
+variable "auth_params" {
+ type = object({
+ scope = optional(string, null)
+ response_type = optional(string, null)
+ })
+ description = "Query string parameters to be included as part of the generated passwordless email link."
+ default = {}
+}
+
+variable "totp" {
+ type = object({
+ time_step = optional(number, 900)
+ length = optional(number, 6)
+ })
+ description = "The TOTP settings for the connection"
+ default = {}
+}
+
+variable "template_file" {
+ type = string
+ description = "The path to the template file. If not provided, the `template` variable must be set."
+ default = ""
+}
+
+variable "template" {
+ type = string
+ description = "The template to use for the connection. If not provided, the `template_file` variable must be set."
+ default = ""
+}
diff --git a/modules/auth0/connection/versions.tf b/modules/auth0/connection/versions.tf
new file mode 100644
index 000000000..3894f08a9
--- /dev/null
+++ b/modules/auth0/connection/versions.tf
@@ -0,0 +1,14 @@
+terraform {
+ required_version = ">= 1.0.0"
+
+ required_providers {
+ auth0 = {
+ source = "auth0/auth0"
+ version = ">= 1.0.0"
+ }
+ aws = {
+ source = "hashicorp/aws"
+ version = ">= 4.9.0"
+ }
+ }
+}
diff --git a/modules/auth0/tenant/README.md b/modules/auth0/tenant/README.md
index e165ca834..afc9fffd3 100644
--- a/modules/auth0/tenant/README.md
+++ b/modules/auth0/tenant/README.md
@@ -98,11 +98,14 @@ add the following parameters to the `plat-prod` account in `us-west-2`:
|------|------|
| [auth0_custom_domain.this](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/custom_domain) | resource |
| [auth0_custom_domain_verification.this](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/custom_domain_verification) | resource |
+| [auth0_email_provider.this](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/email_provider) | resource |
+| [auth0_prompt.this](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/prompt) | resource |
| [auth0_tenant.this](https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/tenant) | resource |
| [aws_route53_record.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
| [aws_ssm_parameter.auth0_client_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
| [aws_ssm_parameter.auth0_client_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
| [aws_ssm_parameter.auth0_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
+| [aws_ssm_parameter.sendgrid_api_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
## Inputs
@@ -112,6 +115,7 @@ add the following parameters to the `plat-prod` account in `us-west-2`:
| [allowed\_logout\_urls](#input\_allowed\_logout\_urls) | The URLs that Auth0 can redirect to after logout. | `list(string)` | `[]` | no |
| [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | | [auth0\_debug](#input\_auth0\_debug) | Enable debug mode for the Auth0 provider | `bool` | `true` | no | +| [auth0\_prompt\_experience](#input\_auth0\_prompt\_experience) | Which prompt login experience to use. Options include classic and new. | `string` | `"new"` | no | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` |
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
} | no |
| [default\_redirection\_uri](#input\_default\_redirection\_uri) | The default redirection URI. | `string` | `""` | no |
| [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | @@ -119,6 +123,8 @@ add the following parameters to the `plat-prod` account in `us-west-2`: | [disable\_clickjack\_protection\_headers](#input\_disable\_clickjack\_protection\_headers) | Whether to disable clickjack protection headers. | `bool` | `true` | no | | [disable\_fields\_map\_fix](#input\_disable\_fields\_map\_fix) | Whether to disable fields map fix. | `bool` | `false` | no | | [disable\_management\_api\_sms\_obfuscation](#input\_disable\_management\_api\_sms\_obfuscation) | Whether to disable management API SMS obfuscation. | `bool` | `false` | no | +| [email\_provider\_default\_from\_address](#input\_email\_provider\_default\_from\_address) | The default from address for the email provider. | `string` | `""` | no | +| [email\_provider\_name](#input\_email\_provider\_name) | The name of the email provider. If not defined, no email provider will be created. | `string` | `""` | no | | [enable\_public\_signup\_user\_exists\_error](#input\_enable\_public\_signup\_user\_exists\_error) | Whether to enable public signup user exists error. | `bool` | `true` | no | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | | [enabled\_locales](#input\_enabled\_locales) | The enabled locales. | `list(string)` |
[| no | @@ -139,6 +145,7 @@ add the following parameters to the `plat-prod` account in `us-west-2`: | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
"en"
]
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | [region](#input\_region) | AWS Region | `string` | n/a | yes | | [sandbox\_version](#input\_sandbox\_version) | The sandbox version. | `string` | `"18"` | no | +| [sendgrid\_api\_key\_ssm\_path](#input\_sendgrid\_api\_key\_ssm\_path) | The SSM path to the SendGrid API key. Only required if `email_provider_name` is `sendgrid`. | `string` | `""` | no | | [session\_cookie\_mode](#input\_session\_cookie\_mode) | The session cookie mode. | `string` | `"persistent"` | no | | [session\_lifetime](#input\_session\_lifetime) | The session lifetime in hours. | `number` | `168` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | diff --git a/modules/auth0/tenant/main.tf b/modules/auth0/tenant/main.tf index 570cff8dc..79687d1c8 100644 --- a/modules/auth0/tenant/main.tf +++ b/modules/auth0/tenant/main.tf @@ -1,5 +1,6 @@ locals { - enabled = module.this.enabled + enabled = module.this.enabled + email_provider_enabled = length(var.email_provider_name) > 0 && local.enabled name = length(module.this.name) > 0 ? module.this.name : "auth0" domain_name = format("%s.%s", local.name, module.dns_gbl_delegated.outputs.default_domain_name) @@ -87,3 +88,30 @@ resource "auth0_custom_domain_verification" "this" { aws_route53_record.this, ] } + +resource "auth0_prompt" "this" { + count = local.enabled ? 1 : 0 + + universal_login_experience = var.auth0_prompt_experience +} + +data "aws_ssm_parameter" "sendgrid_api_key" { + count = local.email_provider_enabled ? 1 : 0 + + name = var.sendgrid_api_key_ssm_path +} + +resource "auth0_email_provider" "this" { + count = local.email_provider_enabled ? 1 : 0 + + name = var.email_provider_name + enabled = local.email_provider_enabled + default_from_address = var.email_provider_default_from_address + + dynamic "credentials" { + for_each = var.email_provider_name == "sendgrid" ? ["1"] : [] + content { + api_key = data.aws_ssm_parameter.sendgrid_api_key[0].value + } + } +} diff --git a/modules/auth0/tenant/variables.tf b/modules/auth0/tenant/variables.tf index 24a9c2696..960647ab6 100644 --- a/modules/auth0/tenant/variables.tf +++ b/modules/auth0/tenant/variables.tf @@ -108,3 +108,27 @@ variable "oidc_logout_prompt_enabled" { description = "Whether the OIDC logout prompt is enabled." default = false } + +variable "email_provider_name" { + type = string + description = "The name of the email provider. If not defined, no email provider will be created." + default = "" +} + +variable "email_provider_default_from_address" { + type = string + description = "The default from address for the email provider." + default = "" +} + +variable "sendgrid_api_key_ssm_path" { + type = string + description = "The SSM path to the SendGrid API key. Only required if `email_provider_name` is `sendgrid`." + default = "" +} + +variable "auth0_prompt_experience" { + type = string + description = "Which prompt login experience to use. Options include classic and new." + default = "new" +}