Okta User 생성 + Group 맵핑 자동화

User 생성 및 Group 맵핑 자동화

 

# main.tf 에 아래 내용 추가

resource "okta_user" "user_admin" {
  first_name = "K8s"
  last_name  = "Admin"
  login      = "k8s.admin@example.com"
  email      = "k8s.admin@example.com"
}

resource "okta_user" "user_readonly" {
  first_name = "K8s"
  last_name  = "Readonly"
  login      = "k8s.readonly@example.com"
  email      = "k8s.readonly@example.com"
}

resource "okta_group_memberships" "admin_membership" {
  group_id = okta_group.k8s_admins.id
  users    = [okta_user.user_admin.id]
}

resource "okta_group_memberships" "readonly_membership" {
  group_id = okta_group.k8s_readonly.id
  users    = [okta_user.user_readonly.id]
}

 

# OpenToFu 실행

[root@k8s-master terraform-access-control]# tofu plan
okta_group.k8s_admins: Refreshing state... [id=00gypu0d5yYlmpq6d697]
okta_group.k8s_readonly: Refreshing state... [id=00gypu3w4aLdzWj86697]

OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

OpenTofu will perform the following actions:

  # okta_group_memberships.admin_membership will be created
  + resource "okta_group_memberships" "admin_membership" {
      + group_id        = "00gypu0d5yYlmpq6d697"
      + id              = (known after apply)
      + track_all_users = false
      + users           = (known after apply)
    }

  # okta_group_memberships.readonly_membership will be created
  + resource "okta_group_memberships" "readonly_membership" {
      + group_id        = "00gypu3w4aLdzWj86697"
      + id              = (known after apply)
      + track_all_users = false
      + users           = (known after apply)
    }

  # okta_user.user_admin will be created
  + resource "okta_user" "user_admin" {
      + custom_profile_attributes = (known after apply)
      + email                     = "k8s.admin@example.com"
      + expire_password_on_create = false
      + first_name                = "K8s"
      + id                        = (known after apply)
      + last_name                 = "Admin"
      + login                     = "k8s.admin@example.com"
      + raw_status                = (known after apply)
      + skip_roles                = false
      + status                    = "ACTIVE"
    }

  # okta_user.user_readonly will be created
  + resource "okta_user" "user_readonly" {
      + custom_profile_attributes = (known after apply)
      + email                     = "k8s.readonly@example.com"
      + expire_password_on_create = false
      + first_name                = "K8s"
      + id                        = (known after apply)
      + last_name                 = "Readonly"
      + login                     = "k8s.readonly@example.com"
      + raw_status                = (known after apply)
      + skip_roles                = false
      + status                    = "ACTIVE"
    }

Plan: 4 to add, 0 to change, 0 to destroy.

[root@k8s-master terraform-access-control]# tofu apply
okta_group.k8s_admins: Refreshing state... [id=00gypu0d5yYlmpq6d697]
okta_group.k8s_readonly: Refreshing state... [id=00gypu3w4aLdzWj86697]

OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

OpenTofu will perform the following actions:

  # okta_group_memberships.admin_membership will be created
  + resource "okta_group_memberships" "admin_membership" {
      + group_id        = "00gypu0d5yYlmpq6d697"
      + id              = (known after apply)
      + track_all_users = false
      + users           = (known after apply)
    }

  # okta_group_memberships.readonly_membership will be created
  + resource "okta_group_memberships" "readonly_membership" {
      + group_id        = "00gypu3w4aLdzWj86697"
      + id              = (known after apply)
      + track_all_users = false
      + users           = (known after apply)
    }

  # okta_user.user_admin will be created
  + resource "okta_user" "user_admin" {
      + custom_profile_attributes = (known after apply)
      + email                     = "k8s.admin@example.com"
      + expire_password_on_create = false
      + first_name                = "K8s"
      + id                        = (known after apply)
      + last_name                 = "Admin"
      + login                     = "k8s.admin@example.com"
      + raw_status                = (known after apply)
      + skip_roles                = false
      + status                    = "ACTIVE"
    }

  # okta_user.user_readonly will be created
  + resource "okta_user" "user_readonly" {
      + custom_profile_attributes = (known after apply)
      + email                     = "k8s.readonly@example.com"
      + expire_password_on_create = false
      + first_name                = "K8s"
      + id                        = (known after apply)
      + last_name                 = "Readonly"
      + login                     = "k8s.readonly@example.com"
      + raw_status                = (known after apply)
      + skip_roles                = false
      + status                    = "ACTIVE"
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  OpenTofu will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

okta_user.user_readonly: Creating...
okta_user.user_admin: Creating...
okta_user.user_readonly: Creation complete after 1s [id=00uyqkkr0zYwrqaiA697]
okta_user.user_admin: Creation complete after 1s [id=00uyqkipnrb2GMobo697]
okta_group_memberships.readonly_membership: Creating...
okta_group_memberships.admin_membership: Creating...
okta_group_memberships.admin_membership: Creation complete after 2s [id=00gypu0d5yYlmpq6d697]
okta_group_memberships.readonly_membership: Creation complete after 4s [id=00gypu3w4aLdzWj86697]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

 

# Console 확인

 

# README.md

## User & Access Control Automation

- OpenTofu를 사용해 Okta 사용자 계정 자동 생성
- 역할 기반 그룹(k8s-admins / k8s-readonly) 설계
- 사용자 → 그룹 매핑 자동화
- 접근제어 정책을 그룹 중심으로 관리