Setup Terraform Cloud account

[UlisesGascon]

Based on the discussion in #3270 (comment). cc: @nodejs/build

I will need help to setup the Terraform Cloud Account for Node.js Org. This account will be used to create a Team in Terraform Cloud and provide access to individual accounts. Can you create the account using the *@iojs.org email?

Additional steps

• Add my personal account to the team as well as Workspace Administrator level. This guide can help or I can do it if you share the credentials for Terraform Cloud
• I will generate a token for the GitHub actions that will sync the terraform state

[mhdawson]

+1 with readonly access to start.

[targos]

I created an account with the build email. Could be a good opportunity to start sharing build login credentials with 1Password

[targos]

With the free tier, I can only add people as team owners. We would need at least the Standard plan to create additional teams. They say the first 500 resources per month are free, but I don't know what counts as a resource and if it will be enough for us.

[UlisesGascon]

I love the idea to use 1password for this too. I believe 500 resources can cover our needs, but I will be sure once I got access to Cloudflare (#800).

We can start with the free tier and see how critical is to move to the Standard plan, I believe the amount of users with direct access to terraform cloud will be very limited and probably admin compatible role.

[targos]

@UlisesGascon What's your account's email address?

[UlisesGascon]

My email is ulisesgascongonzalez@gmail.com. Thanks @targos ! :)

[UlisesGascon]

It is working! Thanks a lot @targos 👍

[targos]

Reopening until the credentials have been somehow shared with @nodejs/build-infra

[UlisesGascon]

There is no option to scope the Terraform Cloud. So any personal token might have access to all the workspaces in all the organizations as the user.

I suggest to create an account with a build team email or another alias and generate the personal token from that account for the Github Actions part 🤔

[targos]

create an account with a build team email or another alias

Isn't it what this issue was about?

[UlisesGascon]

Isn't it what this issue was about?

Yes, that is correct. I expected to generate a token on behalf of the organization, but the current Terraform Cloud settings only allow me to generate tokens as myself. The next step will be to add a new member to the organization who is not a personal account and generate the token from that account. Is there a better way to manage this scenario?

[targos]

The API Tokens page recommends to create Team Tokens for CI/CD. What's wrong with that?

[UlisesGascon]

🤦 I didn't saw that in the UI. Thanks @targos!

I created a team API Token and it is working as expected.

I was not so sure about the expiration that we need, so I used a short one for now.

[targos]

Reopening until the credentials have been somehow shared with https://github.com/orgs/nodejs/teams/build-infra

Done in the secrets repo.