Skip to content

swa_server.md

Latest commit

 

History

History
106 lines (82 loc) · 3.43 KB

swa_server.md

File metadata and controls

106 lines (82 loc) · 3.43 KB
Raw
page_title conjur_swa_server Resource - CyberArk Secrets Manager
subcategory
description Manages an SWA Server (agent).

conjur_swa_server (Resource)

Manages an SWA Server (agent).

Example Usage

# Server authenticated via a remote JWKS endpoint
resource "conjur_swa_server" "jwks" {
  name            = "my-swa-server"
  server_group_id = "prod.example.org/prod-servers"

  auth = {
    type     = "JWT"
    subject  = "system:serviceaccount:swa-ns:swa-server"
    issuer   = "https://issuer.example.org"
    jwks_uri = "https://issuer.example.org/.well-known/jwks.json"
    audience = "https://api.example.org"
  }
}

# Server authenticated via inline public keys (JWKS embedded in Terraform config)
resource "conjur_swa_server" "inline_keys" {
  name            = "inline-swa-server"
  server_group_id = "prod.example.org/prod-servers"

  auth = {
    type    = "JWT"
    subject = "system:serviceaccount:swa-ns:swa-server"
    issuer  = "https://issuer.example.org"
    public_keys = jsonencode({
      type  = "jwks"
      value = {
        keys = [
          {
            kty = "EC"
            crv = "P-256"
            x   = "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU"
            y   = "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"
            kid = "key-1"
          }
        ]
      }
    })
  }
}

Schema

Required

  • auth (Attributes) Authentication configuration for the server. (see below for nested schema)
  • name (String) The name of the server.
  • server_group_id (String) The ID of the server group this server belongs to.

Read-Only

  • authn_id (String) Opaque Base64-encoded authenticator identifier for this server.
  • id (String) The unique identifier of the server.

Nested Schema for auth

Required:

  • subject (String) The expected subject claim value from the workload JWT. Changing this forces a new server to be created.
  • type (String) The authentication type (e.g., 'JWT'). Changing this forces a new server to be created.

Optional:

  • audience (String) The expected audience for JWT authentication.
  • ca_cert (String) PEM-encoded CA certificate for validating the JWKS provider's TLS certificate. Changing this forces a new server to be created.
  • identity (Attributes) Identity mapping configuration for the JWT authenticator. Changing this forces a new server to be created. (see below for nested schema)
  • issuer (String) The expected issuer for JWT authentication.
  • jwks_uri (String) The JWKS URI for JWT verification.
  • public_keys (String) Inline JWKS as a JSON string. Sent to the server as compact, canonical JSON.

Nested Schema for auth.identity

Optional:

  • claim_aliases (Map of String) A map of claim aliases to JWT claim names.
  • enforced_claims (List of String) A list of enforced claims.
  • identity_path (String) The workload's policy ID in Secrets Manager.
  • token_app_property (String) The name of the JWT claim whose value identifies the workload.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

terraform import conjur_swa_server.my_server prod.example.org/prod-servers/my-workload