Get started with the Workbench Terraform provider

Purpose: This document provides detailed instructions managing Workbench resources with a Terraform provider.

Introduction

Hashicorp Terraform is an Infrastructure as Code (IaC) tool that lets you provision and manage cloud infrastructure. Terraform provides plugins called providers that let you interact with cloud providers and other APIs. As a data steward or an organization admin, you can use the Workbench Terraform provider to provision and manage Workbench resources such as workspaces, data collections, and groups.

Benefits of using Terraform

This section explains some of the benefits of using Terraform to provision and manage Workbench infrastructure.

• Terraform lets you specify your preferred end state for your infrastructure. This provider empowers teams to enforce consistency, reduce manual errors, and track changes through version control.

• Terraform records the current state of your infrastructure and lets you manage state effectively. The Terraform state file keeps track of all resources in a deployment.

• By using this provider, platform teams can automate the lifecycle of core components like workspaces, groups, data collections, and IAM policies, significantly improving scalability.

We recommend the Workbench Terraform provider to organizations that require administrative oversight, particularly for managing data pipelines and data access in Workbench workspaces.

Getting started

Terraform has a declarative and configuration-oriented syntax, which you can use to author the infrastructure that you want to provision. Using this syntax, you'll define your preferred end-state for your infrastructure in a Terraform configuration file. You'll then use the Terraform CLI to provision infrastructure based on the configuration file.

First, the Terraform provider must authenticate to Workbench before it can manage resources. The recommended way to run the provider locally is to use credentials from the Workbench CLI.

Prerequisites

Ensure the following tools are installed:

• Workbench CLI
• Terraform

Authenticate

Run the following command to authenticate:

wb auth login

Then, add the provider to your Terraform configuration. This should be in a file named terraform.tf within your project.

terraform {
  required_providers {
    workbench = {
      source  = "verily-src/workbench"
      version = ">= 0.0.1"
    }
  }
}

provider "workbench" {
  host                = "https://workbench.verily.com"
  use_cli_credentials = true
}

By setting use_cli_credentials = true, the provider will call wb auth print-access-token to obtain your access token and refresh it automatically before it expires.

Initialize and run Terraform

Run the following Terraform commands:

terraform init
terraform plan
terraform apply -auto-approve

terraform init will pull the latest version of the Workbench provider. terraform plan will show you a preview of the changes Terraform will make based on your configuration. terraform apply -auto-approve will make the appropriate changes (creating, updating, or destroying resources).

Next steps

See Terraform provider examples to create Workbench resources.

Once your resources are created, you can:

• Attach IAM policies using workbench_workspace_iam_binding and workbench_group_iam_binding.
• Manage GCS buckets and folders using workbench_controlled_gcs_bucket and workbench_folder.
• Query existing resources using data sources.