Skip to main content

Get Started with Terraform for Lacework

This topic describes how to get started using Hashicorp Terraform to configure and manage Lacework.

Configuration​

The Terraform provider for Lacework must be configured to authenticate with a Lacework account. The next section discusses how to configure the Lacework provider.

Create Lacework API Key​

The Terraform provider for Lacework requires an API key and secret to authenticate with Lacework. Lacework account administrators can create Lacework API keys via the Lacework Console. For more information, go to API Access Keys.

  1. Log in to the Lacework Console.
  2. Click Settings > Configuration > API keys.
  3. Click + Add New.
  4. Enter a name for the key and an optional description.
  5. Click Save.
  6. Click the ... icon and then Download to save the API key file locally.

The contents of your API key contain a keyId, secret, subAccount, and account:

 {
  "keyId": "ACCOUNT_ABCEF01234559B9B07114E834D8570F567C824039756E03",
  "secret": "_abc1234e243a645bcf173ef55b837c19",
  "subAccount": "subaccount",
  "account": "myaccount.lacework.net"
 }

The Terraform provider for Lacework can leverage configuration from the Lacework CLI. When you install and configure the Lacework CLI on the system that you plan to run Terraform from, this generates a configuration file named .lacework.toml that stores API keys for any accounts you configured. The configuration file's default location:

  • Linux and OS X - $HOME/.lacework.toml
  • Windows - %USERPROFILE%\.lacework.toml

You can manage the configuration file using the Lacework CLI. This method also supports a profile configuration and matching LW_PROFILE environment variable.

provider "lacework" {
  profile = "custom-profile"
}

Organization Accounts​

A Lacework organization can contain multiple accounts so you can manage components such as alerts, resource groups, team members, and audit logs at a more granular level inside an organization. A team member may have access to multiple accounts and can easily switch between them.

info

To manage multiple accounts, a user must have the Organization Admin role.

Use the subaccount argument to switch to a different account inside your Lacework organization.

The following example shows a default profile that has access to the primary account named my-company:

# Example .lacework.toml - Config for Lacework CLI

[default]
  account = "my-company"
  api_key = "my-api-key"
  api_secret = "my-api-secret"
  version = 2

To access your sub-account named business-unit, specify the subaccount argument.

## Example main.tf
provider "lacework" {
  alias = "primary"
}

provider "lacework" {
  alias      = "business-unit"
  # This uses the same default profile but points to a sub-account
  subaccount = "business-unit"
}

From there, you can pass the alias meta-argument to any resource to switch between accounts:

resource "lacework_alert_channel_slack" "primary_critical" {
  provider = lacework.primary
  # ...
}
resource "lacework_alert_channel_slack" "business_unit_critical" {
  provider = lacework.business-unit
  # ...
}

For more information on using alias to configure multiple providers, see Multiple Provider Configurations on the Terraform documentation site.

Environment Variables​

You can provide your credentials via the LW_ACCOUNT, LW_API_KEY, and LW_API_SECRET environment variables. These variables represent your Lacework account subdomain of URL, Lacework API access key, and Lacework API access secret, respectively.

provider "lacework" {}
Bash
export LW_ACCOUNT="my-account"
export LW_API_KEY="my-api-key"
export LW_API_SECRET="my-api-secret"
Powershell
$Env:LW_ACCOUNT = "my-account"
$Env:LW_API_KEY = "my-api-key"
$Env:LW_API_SECRET = "my-api-secret"

Static Credentials​

You can provide static credentials by adding the account, api_key, and api_secret in-line in the Lacework provider block:

provider "lacework" {
  account    = "my-account"
  api_key    = "my-api-key"
  api_secret = "my-api-secret"
}
danger

Hard coding credentials into any Terraform configuration is not recommended. Secrets could be leaked by committing hard-coded credentials to a public version control system.

Organization Level Access​

Organization administrators can access organization level data sets by setting the organization argument to true.

provider "lacework" {
  organization = true
}
info

When accessing organization level data sets, the subaccount argument is ignored.

Using this type of configuration is intended for managing resources such as alerts, resource groups, team members, cloud accounts, and more, at the organization level.

Version Pinning​

Lacework Terraform projects are under heavy development with frequent releases. It is important to create a strategy for upgrading and testing new releases within your environment to avoid unintentional changes due to new features and/or new functionality. This is especially important if you plan to run Terraform continuously using a CI/CD pipeline.

Lacework recommends using pessimistic version constraints for Lacework Terraform projects. This ensures that you will get minor updates, which include big fixes and minor changes, while avoiding version upgrades that could result in breaking changes.

For example, the following required_providers block shows how to specify Terraform provider for Lacework to 1.15.x versions, up to 2.x.x:

terraform {
  required_providers {
    lacework = {
      source = "lacework/lacework"
      version = "~> 1.15"
    }
  }
}

provider "lacework" {
  # Configuration options
}

Alternatively, the following example shows how to pin to a specific version of the Terraform provider for Lacework:

terraform {
  required_providers {
    lacework = {
      source = "lacework/lacework"
      version = "0.3.1" # Version is pinned to 0.3.1
    }
  }
}

provider "lacework" {
  # Configuration options
}
Last updated on