Terraform Integration

Terraform Provider for TigerTrust

The TigerTrust Terraform provider enables infrastructure-as-code practices for certificate lifecycle management. Define, deploy, and manage certificates alongside your infrastructure using familiar Terraform workflows.

Provider Configuration

Configure the TigerTrust provider:

hcl
1terraform {
2  required_providers {
3    tigertrust = {
4      source  = "tigertrust/tigertrust"
5      version = "~> 1.0"
6    }
7  }
8}
9
10provider "tigertrust" {
11  api_key    = var.tigertrust_api_key
12  api_url    = "https://api.tigertrust.io"
13  org_id     = var.tigertrust_org_id
14}

Certificate Resources

Define certificates as Terraform resources:

hcl
1resource "tigertrust_certificate" "api_gateway" {
2  name        = "api-gateway-cert"
3  common_name = "api.example.com"
4
5  san_dns_names = [
6    "api.example.com",
7    "api-v2.example.com"
8  ]
9
10  issuer = "enterprise-ca"
11
12  validity {
13    duration_days = 365
14  }
15
16  auto_renewal {
17    enabled      = true
18    days_before  = 30
19  }
20
21  deployment {
22    type = "aws-acm"
23    region = "us-east-1"
24  }
25
26  tags = {
27    environment = "production"
28    team        = "platform"
29  }
30}

Policy Resources

Define certificate policies as code:

hcl
1resource "tigertrust_policy" "production_certs" {
2  name        = "production-certificate-policy"
3  description = "Policy for production certificates"
4
5  requirements {
6    min_key_size     = 2048
7    allowed_key_types = ["RSA", "ECDSA"]
8    max_validity_days = 365
9    require_san      = true
10  }
11
12  allowed_issuers = [
13    tigertrust_issuer.enterprise_ca.id
14  ]
15
16  notification {
17    channels = ["slack", "email"]
18    days_before_expiry = [30, 14, 7, 1]
19  }
20
21  enforcement {
22    mode = "enforce"  # or "audit"
23  }
24}

Data Sources

Query existing certificates and resources:

hcl
1data "tigertrust_certificate" "existing" {
2  common_name = "app.example.com"
3}
4
5data "tigertrust_certificates" "expiring_soon" {
6  filter {
7    expires_within_days = 30
8    environment         = "production"
9  }
10}
11
12output "expiring_certificates" {
13  value = data.tigertrust_certificates.expiring_soon.certificates
14}

Integration with Other Providers

Use TigerTrust certificates with other Terraform providers:

hcl
1# AWS ALB with TigerTrust certificate
2resource "aws_lb_listener" "https" {
3  load_balancer_arn = aws_lb.main.arn
4  port              = 443
5  protocol          = "HTTPS"
6  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
7  certificate_arn   = tigertrust_certificate.api_gateway.aws_acm_arn
8
9  default_action {
10    type             = "forward"
11    target_group_arn = aws_lb_target_group.main.arn
12  }
13}
14
15# Kubernetes secret with TigerTrust certificate
16resource "kubernetes_secret" "tls" {
17  metadata {
18    name      = "app-tls"
19    namespace = "production"
20  }
21
22  type = "kubernetes.io/tls"
23
24  data = {
25    "tls.crt" = tigertrust_certificate.api_gateway.certificate_pem
26    "tls.key" = tigertrust_certificate.api_gateway.private_key_pem
27  }
28}

Modules

Create reusable certificate modules:

hcl
1module "web_certificate" {
2  source = "./modules/tigertrust-certificate"
3
4  name        = "web-app"
5  domain      = "app.example.com"
6  environment = "production"
7
8  deploy_to = {
9    aws_acm    = true
10    kubernetes = true
11  }
12}

State Management

TigerTrust provider supports all Terraform state operations:

• Import existing certificates
• State refresh for certificate updates
• Proper resource dependencies
• Sensitive data handling

OpenTofu Compatibility

The TigerTrust provider is fully compatible with OpenTofu, the open-source Terraform alternative.

Achieve infrastructure-as-code for your entire certificate lifecycle with TigerTrust and Terraform.