Keycloak - Create Realm with Terraform

#(1)
terraform {
  required_providers {
    keycloak = {
      source  = "keycloak/keycloak"
      version = "~> 5.0.0" # You can use the latest stable version
    }
  }
}

#(2)
provider "keycloak" {
  client_id = "admin-cli"
  username  = "admin"
  password  = "changeit"
  url       = "http://${var.kc_lb_hostname}"  #(3)
  realm     = "master"
}

# Create a new realm
#(1)
resource "keycloak_realm" "nsa2_realm" {
  realm   = "nsa2-realm"
  enabled = true
}

# Create a new client
#(2)
resource "keycloak_openid_client" "nsa2_o11y" {
  #realm_id                     = keycloak_realm.this.id
  realm_id                     = keycloak_realm.nsa2_realm.id
  client_id                    = "nsa2-o11y"
  name                         = "NSA2 Observability"
  enabled                      = true
  access_type                  = "CONFIDENTIAL" # or "PUBLIC"
  standard_flow_enabled        = true
  implicit_flow_enabled        = false
  direct_access_grants_enabled = true
  client_secret                = "gZ343TCd0kBehqTOkGZFkbL4WvXoa3Ss"

  valid_redirect_uris = [
    "http://prometheus.nsa2.com/*",
    "http://grafana.nsa2.com/*",
    "http://jaeger.nsa2.com/*",
    "http://oauth2-proxy.nsa2.com/*"
  ]

  valid_post_logout_redirect_uris = [
    "http://prometheus.nsa2.com/*",
    "http://grafana.nsa2.com/*",
    "http://jaeger.nsa2.com/*",
    "http://oauth2-proxy.nsa2.com/*"
  ]

  web_origins = [
    "http://prometheus.nsa2.com",
    "http://jaeger.nsa2.com",
    "http://grafana.nsa2.com",
    "http://oauth2-proxy.nsa2.com"
  ]
}

# Create realm roles - grafana-admin, grafana-editor, grafana-viewer

#(1)
resource "keycloak_role" "grafana_admin_role" {
  realm_id = keycloak_realm.nsa2_realm.id
  name     = "grafana-admin"
}

resource "keycloak_role" "grafana_editor_role" {
  realm_id = keycloak_realm.nsa2_realm.id
  name     = "grafana-editor"
}

resource "keycloak_role" "grafana_viewer_role" {
  realm_id = keycloak_realm.nsa2_realm.id
  name     = "grafana-viewer"
}

# Create devops User
#(2)
resource "keycloak_user" "devops" {
  realm_id   = keycloak_realm.nsa2_realm.id
  username   = "devops"
  email      = "devops@nsa2.com"
  email_verified = true
  enabled    = true
  first_name = "DevOps"
  last_name  = "Staff"

  initial_password {
    value     = "password"
    temporary = false
  }

  required_actions = []
}

# Assign roles to the user
#(1)
resource "keycloak_user_roles" "devops_roles" {
  realm_id = keycloak_realm.nsa2_realm.id
  user_id  = keycloak_user.devops.id

  role_ids = [
    keycloak_role.grafana_admin_role.id,
    #keycloak_role.grafana_roles["grafana-admin"].id
    # data.keycloak_role.grafana_admin.id
# or keycloak_role.grafana_admin.id if defined as a resource
  ]
}

# Create a new client scope
#(1)
resource "keycloak_openid_client_scope" "o11y_client_scope" {
  realm_id = keycloak_realm.nsa2_realm.id
  name     = "nsa2-o11y-client-scope"
  description = "Client scope for NSA2 Observability"
  include_in_token_scope = true
}

# Configure the client scope to add roles to the ID token
#(2)
resource "keycloak_openid_user_realm_role_protocol_mapper" "realm_roles_mapper" {
  realm_id        = keycloak_realm.nsa2_realm.id
  client_scope_id = keycloak_openid_client_scope.o11y_client_scope.id
  name            = "realm-role-mapper"

  claim_name        = "realm_access.roles"
  claim_value_type  = "String"
  add_to_id_token   = true
  add_to_access_token = true
  add_to_userinfo   = true
  multivalued        = true
}

# Add the client scope to the client
#(3)
resource "keycloak_openid_client_default_scopes" "client_default_scopes" {
  realm_id  = keycloak_realm.nsa2_realm.id
  client_id = keycloak_openid_client.nsa2_o11y.id

  default_scopes = [
    "web-origins",
    "acr",
    "roles",
    "profile",
    "basic",
    "email",
    keycloak_openid_client_scope.o11y_client_scope.name
  ]
}