Package: terraform-cloud-okta-warden
Terraform Cloud Okta WardenWhat is this?If you use Terraform Cloud and have configured SSO for it via Okta (or any other IdP), it's critical
to be aware of the fact that login via SSO is not always enforced by Terraform Cloud.In certain scenarios (as tested in February 2024), one can still access your Terraform Cloud
organization even if their account in the IdP is de-provisioned:If you have not taken steps to ensure when a user is de-provisioned your IdP, their TFC account is
also removed from your Terraform Cloud organization. This does not happen automatically as TFC
does not support SCIM, so it has to be a manual process as part of users' off-boarding flow, or
you must implement a custom solution using your IdP's API/Workflows and TFC API.If the user had set the password (with optional TOTP as 2FA) to their TFC account and they might
still have the credentials stored.Then they can login to Terraform Cloud, but cannot access your Organization via UI (they
will be prompted to re-login with SSO). However,they can create an API tokenand regain the
same level of access they had before their account was de-provisioned. Any API tokens they had
created before would also keep working (and, for example, allow them toterraform destroyany
infra they had access to).If the user was a member of theownerteam of your TFC organization, they can bypass SSO
entirely and regain their access both via the UI and API.This behaviour is working "as designed" by HashiCorp - presumably as a break-glass measure.
Check out theirSSO documentationfor more details.If you use Okta as your IdP, and any of the above scenarios apply to you, this small CLI would help
you flag the user accounts which are de-provisioned in Okta, but are still active in your TFC
organization.RequirementsAPI tokens for Okta and Terraform Cloud (or Enterprise) with access to list users.
These can be provided via environment variables (see Usage).InstallationYou can installTerraform Cloud Okta WardenviapipfromPyPI:$pipinstallterraform-cloud-okta-wardenUsage❯terraform-cloud-okta-warden--helpUsage:terraform-cloud-okta-warden[OPTIONS]OKTA_TOKENTFC_TOKENChecksforexistenceofnon-activeOktausersinTerraformCloudorganization.Non-activeusersarethosewhoaremissingorde-provisionedinOkta.

╭─Arguments─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*okta_tokenTEXTOktaAPItokenwithaccesstolistusers[envvar:OKTA_TOKEN][default:None][required]│
│*tfc_tokenTEXTTerraformCloudtokenwithaccesstolistusers[envvar:TFC_TOKEN][default:None][required]│
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─Options───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*--okta-org-urlTEXTYourOktadomainurl(e.g.https://mycompany.okta.com)[default:None][required]│
│*--tfc-org-nameTEXTTerraformCloudOrganizationname[default:None][required]│
│--tfc-urlTEXTDefaultstoTerraformCloud,providetheURLifyouuseTerraformEnterprise[default:https://app.terraform.io]│
│--version│
│--log-levelTEXT[default:INFO]│
│--install-completionInstallcompletionforthecurrentshell.│
│--show-completionShowcompletionforthecurrentshell,tocopyitorcustomizetheinstallation.│
│--helpShowthismessageandexit.│
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ContributingContributions are very welcome.
To learn more, see theContributor Guide.LicenseDistributed under the terms of theApache 2.0 license,Terraform Cloud Okta Wardenis free and open source software.IssuesIf you encounter any problems,
pleasefile an issuealong with a detailed description.CreditsThis project was generated from [@cjolowicz]'sHypermodern Python Cookiecuttertemplate.