Managing Identity Platform with Terraform

Learn how to set up and manage Google Cloud Identity Platform using Terraform

In this guide, we’ll explore how to manage Google Cloud Identity Platform using Terraform.

Video Tutorial

Learn more about managing Google Cloud Identity Platform with Terraform in this comprehensive video tutorial:

Prerequisites

  • Google Cloud SDK installed and configured
  • Terraform installed (version 1.0.0 or later)
  • A GCP project with billing enabled

Project Structure

.
├── main.tf                   # Main Terraform configuration file
├── variables.tf              # Variable definitions
├── outputs.tf               # Output definitions
├── terraform.tfvars         # Variable values
└── modules/
    └── identity/
        ├── main.tf          # Cloud Identity specific configurations
        ├── variables.tf      # Module variables
        ├── groups.tf        # Group configurations
        └── outputs.tf       # Module outputs

Provider Configuration

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

Variables

variable "project_id" {
  description = "The ID of the GCP project"
  type        = string
}

variable "region" {
  description = "The region to deploy resources to"
  type        = string
  default     = "us-central1"
}

Identity Platform Configuration

resource "google_identity_platform_config" "default" {
  project = var.project_id

  autodelete_anonymous_users = true

  sign_in {
    allow_duplicate_emails = false
    
    email {
      enabled           = true
      password_required = true
    }

    anonymous {
      enabled = true
    }

    phone_number {
      enabled = true
      test_phone_numbers = {
        "+11234567890" = "123456"
      }
    }
  }
}

OAuth Configuration

resource "google_identity_platform_oauth_idp_config" "google" {
  provider_id  = "google.com"
  display_name = "Google"
  enabled      = true

  client_id     = var.google_oauth_client_id
  client_secret = var.google_oauth_client_secret
}

resource "google_identity_platform_oauth_idp_config" "facebook" {
  provider_id  = "facebook.com"
  display_name = "Facebook"
  enabled      = true

  client_id     = var.facebook_app_id
  client_secret = var.facebook_app_secret
}

resource "google_identity_platform_oauth_idp_config" "github" {
  provider_id  = "github.com"
  display_name = "GitHub"
  enabled      = true

  client_id     = var.github_client_id
  client_secret = var.github_client_secret
}

SAML Configuration

SAML is a different resource from the OAuth/OIDC idp_config resources above - tenant_oauth_idp_config takes client_id/client_secret for OAuth providers, while SAML federation (idp_entity_id, certificates, sso_url) uses tenant_inbound_saml_config instead:

resource "google_identity_platform_tenant_inbound_saml_config" "saml" {
  name         = "saml-idp"
  tenant       = google_identity_platform_tenant.tenant.name
  display_name = "SAML"
  enabled      = true

  idp_config {
    idp_entity_id = "https://idp.example.com/saml2/idp"
    sso_url       = "https://idp.example.com/saml2/sso"

    idp_certificates {
      x509_certificate = file("path/to/cert.pem")
    }
  }

  sp_config {
    sp_entity_id = "https://${var.project_id}.firebaseapp.com"
  }
}

Tenant Configuration

resource "google_identity_platform_tenant" "tenant" {
  display_name          = "My Organization"
  allow_password_signup = true

  enable_email_link_signin = true
  disable_auth            = false
}

resource "google_identity_platform_tenant_default_supported_idp_config" "idp" {
  enabled       = true
  tenant        = google_identity_platform_tenant.tenant.name
  idp_id        = "google.com"
  client_id     = var.google_oauth_client_id
  client_secret = var.google_oauth_client_secret
}

Email Template Configuration

google_identity_platform_tenant_default_supported_idp_config is for configuring a default third-party IDP (idp_id/client_id/client_secret, the same shape used in the Tenant Configuration section above) - it has no email_template block. Identity Platform’s email template customization (sender name, reset/verify email subject and body) isn’t exposed as a distinct Terraform resource; configure it through the Cloud Console or the Identity Toolkit Admin API/gcloud identity-platform commands instead.

Security Configuration

resource "google_identity_platform_project_default_config" "security" {
  project = var.project_id

  sign_in {
    hash_config {
      algorithm = "SCRYPT"

      signer_key     = base64encode(random_string.signer_key.result)
      salt_separator = base64encode(random_string.salt_separator.result)
      rounds         = 8
      memory_cost    = 14
    }
  }

  quota {
    sign_up_quota_burst = 100
    sign_up_quota_limit = "1000/d"
  }
}

Monitoring Configuration

resource "google_monitoring_notification_channel" "email" {
  display_name = "Identity Platform Alerts Email"
  type         = "email"

  labels = {
    email_address = var.alert_email
  }
}

resource "google_monitoring_alert_policy" "auth_failures" {
  display_name = "Authentication Failures Alert"
  combiner     = "OR"

  conditions {
    display_name = "High Auth Failures"
    condition_threshold {
      filter     = "metric.type=\"identityplatform.googleapis.com/auth/error_count\" AND resource.type=\"identity-platform\""
      duration   = "300s"
      comparison = "COMPARISON_GT"
      threshold_value = 100

      trigger {
        count = 1
      }

      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
      }
    }
  }

  notification_channels = [google_monitoring_notification_channel.email.name]
}

Outputs

output "tenant_name" {
  value       = google_identity_platform_tenant.tenant.name
  description = "The name of the Identity Platform tenant"
}

output "oauth_configs" {
  value = {
    google    = google_identity_platform_oauth_idp_config.google.name
    facebook  = google_identity_platform_oauth_idp_config.facebook.name
    github    = google_identity_platform_oauth_idp_config.github.name
  }
  description = "The names of the OAuth configurations"
}

Best Practices

  1. Authentication Setup:

    • Enable MFA
    • Configure providers
    • Set password policy
    • Regular review

  2. Security:

    • Monitor access
    • Enable logging
    • Regular audits
    • Update policies

  3. Performance:

    • Monitor latency
    • Track usage
    • Optimize flows
    • Regular testing

  4. Cost Optimization:

    • Monitor usage
    • Track quotas
    • Clean up unused
    • Regular review

Common Operations

Creating Resources

terraform init
terraform plan
terraform apply

User Management

# Create user
gcloud identity-platform users create \
  --uid=user123 \
  --display-name="John Doe" \
  --email="john@example.com"

# List users
gcloud identity-platform users list

Best Practices and Tips

  1. Identity Management:

    • Plan providers
    • Document flows
    • Regular review
    • Monitor usage

  2. Security:

    • Enable MFA
    • Monitor access
    • Regular audits
    • Update policies

  3. Operations:

    • Monitor metrics
    • Track usage
    • Set up alerts
    • Regular maintenance

Conclusion

You’ve learned how to set up and manage Google Cloud Identity Platform using Terraform. This setup provides:

  • Secure authentication
  • Multiple providers
  • Custom branding
  • Best practices implementation