Managing Identity Platform with Terraform

In this guide, we’ll explore how to manage Google Cloud Identity Platform using Terraform.

Video Tutorial

Learn more about managing Google Cloud Identity Platform with Terraform in this comprehensive video tutorial:

Prerequisites

• Google Cloud SDK installed and configured
• Terraform installed (version 1.0.0 or later)
• A GCP project with billing enabled

Project Structure

.
├── main.tf                   # Main Terraform configuration file
├── variables.tf              # Variable definitions
├── outputs.tf               # Output definitions
├── terraform.tfvars         # Variable values
└── modules/
    └── identity/
        ├── main.tf          # Cloud Identity specific configurations
        ├── variables.tf      # Module variables
        ├── groups.tf        # Group configurations
        └── outputs.tf       # Module outputs

Provider Configuration

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

Variables

variable "project_id" {
  description = "The ID of the GCP project"
  type        = string
}

variable "region" {
  description = "The region to deploy resources to"
  type        = string
  default     = "us-central1"
}

Identity Platform Configuration

resource "google_identity_platform_config" "default" {
  project = var.project_id

  autodelete_anonymous_users = true

  sign_in {
    allow_duplicate_emails = false
    
    email {
      enabled           = true
      password_required = true
    }

    anonymous {
      enabled = true
    }

    phone_number {
      enabled = true
      test_phone_numbers = {
        "+11234567890" = "123456"
      }
    }
  }
}

OAuth Configuration

resource "google_identity_platform_oauth_idp_config" "google" {
  provider_id  = "google.com"
  display_name = "Google"
  enabled      = true

  client_id     = var.google_oauth_client_id
  client_secret = var.google_oauth_client_secret
}

resource "google_identity_platform_oauth_idp_config" "facebook" {
  provider_id  = "facebook.com"
  display_name = "Facebook"
  enabled      = true

  client_id     = var.facebook_app_id
  client_secret = var.facebook_app_secret
}

resource "google_identity_platform_oauth_idp_config" "github" {
  provider_id  = "github.com"
  display_name = "GitHub"
  enabled      = true

  client_id     = var.github_client_id
  client_secret = var.github_client_secret
}

SAML Configuration

resource "google_identity_platform_tenant_oauth_idp_config" "saml" {
  tenant         = google_identity_platform_tenant.tenant.name
  display_name   = "SAML"
  enabled        = true
  idp_entity_id = "https://idp.example.com/saml2/idp"

  idp_certificates {
    x509_certificate = file("path/to/cert.pem")
  }

  sso_url = "https://idp.example.com/saml2/sso"
}

Tenant Configuration

resource "google_identity_platform_tenant" "tenant" {
  display_name          = "My Organization"
  allow_password_signup = true

  enable_email_link_signin = true
  disable_auth            = false
}

resource "google_identity_platform_tenant_default_supported_idp_config" "idp" {
  enabled       = true
  tenant        = google_identity_platform_tenant.tenant.name
  idp_id        = "google.com"
  client_id     = var.google_oauth_client_id
  client_secret = var.google_oauth_client_secret
}

Email Template Configuration

resource "google_identity_platform_tenant_default_supported_idp_config" "email_template" {
  tenant = google_identity_platform_tenant.tenant.name

  email_template {
    sender_local_part = "noreply"
    sender_display_name = "My App"
    
    reset_password {
      subject = "Reset your password"
      body    = file("templates/reset_password.html")
    }
    
    verify_email {
      subject = "Verify your email"
      body    = file("templates/verify_email.html")
    }
  }
}

Security Configuration

resource "google_identity_platform_project_default_config" "security" {
  project = var.project_id

  sign_in {
    hash_config {
      algorithm = "SCRYPT"
      
      signerKey = base64encode(random_string.signer_key.result)
      saltSeparator = base64encode(random_string.salt_separator.result)
      rounds = 8
      memoryCost = 14
    }
  }

  quota {
    sign_up_quota_burst = 100
    sign_up_quota_limit = "1000/d"
  }
}

Monitoring Configuration

resource "google_monitoring_alert_policy" "auth_failures" {
  display_name = "Authentication Failures Alert"
  combiner     = "OR"

  conditions {
    display_name = "High Auth Failures"
    condition_threshold {
      filter     = "metric.type=\"identityplatform.googleapis.com/auth/error_count\" AND resource.type=\"identity-platform\""
      duration   = "300s"
      comparison = "COMPARISON_GT"
      threshold_value = 100

      trigger {
        count = 1
      }

      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
      }
    }
  }

  notification_channels = [google_monitoring_notification_channel.email.name]
}

Outputs

output "tenant_name" {
  value       = google_identity_platform_tenant.tenant.name
  description = "The name of the Identity Platform tenant"
}

output "oauth_configs" {
  value = {
    google    = google_identity_platform_oauth_idp_config.google.name
    facebook  = google_identity_platform_oauth_idp_config.facebook.name
    github    = google_identity_platform_oauth_idp_config.github.name
  }
  description = "The names of the OAuth configurations"
}

Best Practices

1. Authentication Setup:

   • Enable MFA
   • Configure providers
   • Set password policy
   • Regular review

2. Security:

   • Monitor access
   • Enable logging
   • Regular audits
   • Update policies

3. Performance:

   • Monitor latency
   • Track usage
   • Optimize flows
   • Regular testing

4. Cost Optimization:

   • Monitor usage
   • Track quotas
   • Clean up unused
   • Regular review

Common Operations

Creating Resources

terraform init
terraform plan
terraform apply

User Management

# Create user
gcloud identity-platform users create \
  --uid=user123 \
  --display-name="John Doe" \
  --email="john@example.com"

# List users
gcloud identity-platform users list

Best Practices and Tips

1. Identity Management:

   • Plan providers
   • Document flows
   • Regular review
   • Monitor usage

2. Security:

   • Enable MFA
   • Monitor access
   • Regular audits
   • Update policies

3. Operations:

   • Monitor metrics
   • Track usage
   • Set up alerts
   • Regular maintenance

Conclusion

You’ve learned how to set up and manage Google Cloud Identity Platform using Terraform. This setup provides:

• Secure authentication
• Multiple providers
• Custom branding
• Best practices implementation