Create a CloudSSO user by using Terraform-CloudSSO(CloudSSO)-阿里云帮助中心

Terraform is an open source tool that is used to securely and efficiently configure and manage cloud resources. You can use Terraform to manage CloudSSO resources. This topic describes how to use Terraform to create a CloudSSO user.

Note

You can run the sample code in this tutorial with a single click. Run Now

Prerequisites

We recommend that you use a RAM user to perform the operations described in this tutorial and grant the AliyunCloudSSOFullAccess permission to the RAM user. For more information, see Create a RAM user and Grant permissions to a RAM user.
The runtime environment for Terraform is prepared by using one of the following methods:
- Use Terraform in Terraform Explorer: Alibaba Cloud provides an online runtime environment for Terraform. You can log on to the Terraform Explorer environment to use Terraform without the need to install Terraform. This method is suitable for scenarios where you need to use and debug Terraform in a zero-cost, efficient, and convenient manner.
- Use Terraform in Cloud Shell: Terraform is preinstalled in Cloud Shell and identity credentials are configured. You can directly run Terraform commands in Cloud Shell. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at low costs.
- Install and configure Terraform on your on-premises machine: This method is suitable for scenarios in which network connections are unstable or a custom development environment is required.

Resources used

alicloud_cloud_sso_directory : A CloudSSO directory.
alicloud_cloud_sso_user : A CloudSSO user.

Create a CloudSSO user

Create a Terraform working directory. In this directory, create a configuration file named main.tf and copy the following code into main.tf.

variable "region" {
  default = "cn-shanghai"
}

provider "alicloud" {
  region = var.region
}

resource "random_integer" "default" {
  min = 10000
  max = 99999
}

# Obtain CloudSSO directories.
data "alicloud_cloud_sso_directories" "default" {}

# Create a directory. You can create only one directory for each Alibaba Cloud account.
resource "alicloud_cloud_sso_directory" "default" {
  directory_name = "sso-directory-${random_integer.default.result}"
  # If a directory exists, you do not need to create a directory. If no directory exists, create a directory.
  count          = length(data.alicloud_cloud_sso_directories.default.ids) > 0 ?  0 : 1
}

# The value of directory_id is the ID of the globally unique directory.
locals {
  directory_id = length(data.alicloud_cloud_sso_directories.default.ids) > 0 ?  data.alicloud_cloud_sso_directories.default.ids[0] : concat(alicloud_cloud_sso_directory.default.*.id, [""])[0]
}

# Create a CloudSSO user.
resource "alicloud_cloud_sso_user" "default" {
  user_name    = "sso-user-${random_integer.default.result}"
  directory_id = local.directory_id
}

Run the following command to initialize the Terraform runtime environment:

terraform init

If the following information is returned, Terraform is initialized.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Run the following command to run the code.

terraform apply

During the code execution, enter yes as prompted and press the Enter key. Wait until the execution is complete. The following command output indicates that the code is run:

You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Verify the result.

Run the terraform show command

Run the following command in the working directory to query the details of the resource that is created by using Terraform:

terraform show

shell@Alicloud:~/sso$ terraform show
# alicloud_cloud_sso_user.default:
resource "alicloud_cloud_sso_user" "default" {
    directory_id = "d-00xxx"
    id           = "d-00xxx:u-00ijrjp1yxxx"
    status       = "Enabled"
    user_id      = "u-00ijrjp1yxxx"
    user_name    = "sso-user-xxx"
}

# data.alicloud_cloud_sso_directories.default:
data "alicloud_cloud_sso_directories" "default" {
    directories    = [
        {
            create_time                    = "2021-06-30T08:35:26Z"
            directory_id                   = "d-00xxx"
            directory_name                 = "xxx"
            id                             = "d-00fc2xxx"
            mfa_authentication_status      = ""
            region                         = "cn-shanghai"
            saml_identity_provider_configuration = []
            scim_synchronization_status    = ""
            tasks                          = []
        },
    ]
    enable_details = false
    id             = "301xxx"
    ids            = [
        "d-00fc2xxx",
    ]
    names          = [
        "new-example",
    ]
}

# random_integer.default:
resource "random_integer" "default" {
    id     = "xxx"
    max    = 99999
    min    = 10000
    result = xxx
}

Log on to the console

Log on to the CloudSSO console and view the created user.

Release resources

If you no longer require the preceding resources that are created or managed by using Terraform, run the following command to release the resources. For more information about the terraform destroy command, see Common commands.

terraform destroy

Complete sample code