Managed Keycloak · Terraform

Ihr Managed Keycloak, als Code.

Q: Is this the same as the community Keycloak Terraform provider?

No, and they work well together. The community keycloak/keycloak provider configures a Keycloak that you host and run: it talks to the admin REST API to manage realms, clients, users, and deep settings like authentication flows and protocol mappers. The Skycloak provider talks to the Skycloak API, so it provisions the managed cluster itself and manages the platform layer the admin API cannot reach (custom domains, WAF, IP rules, SIEM, extensions, maintenance windows, branding), plus the basic realm setup (realms, users, roles, groups, basic clients, identity providers, SMTP), from one API key. For deep realm configuration you pair it with the community provider.

Q: How do I authenticate?

Mint a Skycloak API key (sk_sc_...) in the dashboard and expose it as the SKYCLOAK_API_KEY environment variable. The provider reads it automatically.

Der offizielle Skycloak Terraform Provider stellt Ihr gesamtes Managed Keycloak mit einem einzigen API-Schlüssel bereit: den Cluster, die Plattform drumherum (WAF, SIEM, benutzerdefinierte Domains, Branding) und einen initialisierten Realm mit Benutzern, Rollen und Identity Providern. Gehen Sie von einer leeren Datei zu einer laufenden, gesicherten, gebrandeten Instanz mit einem einzigen terraform apply.

Ansehen on the Terraform Registry Lesen Sie den Leitfaden: Provider vs Community und wie beide zu nutzen sind

main.tf HCL

# Auth reads the SKYCLOAK_API_KEY env var (sk_sc_...)
provider "skycloak" {}

# 1. Provision a managed Keycloak cluster
resource "skycloak_cluster" "prod" {
  name     = "production"
  type     = "keycloak"
  size     = "small"
  version  = "26.6.3"
  location = "us"
}

# 2. Create a realm on it
resource "skycloak_realm" "app" {
  cluster_id   = skycloak_cluster.prod.id
  name         = "app"
  display_name = "Application Realm"
  enabled      = true
}

# 3. Add Google sign-in
resource "skycloak_identity_provider" "google" {
  cluster_id    = skycloak_cluster.prod.id
  realm_name    = skycloak_realm.app.name
  provider_id   = "google"
  type          = "oidc"
  client_id     = var.google_client_id
  client_secret = var.google_client_secret
}

# 4. Brand the login page and switch on the WAF
resource "skycloak_login_branding" "app" {
  cluster_id    = skycloak_cluster.prod.id
  realm_name    = skycloak_realm.app.name
  primary_color = "#3b82f6"
  logo_url      = "https://myapp.com/logo.svg"
}

resource "skycloak_cluster_security" "prod" {
  cluster_id = skycloak_cluster.prod.id
  waf = {
    enabled = true
    mode    = "block"
    preset  = "owasp_top_10"
  }
}

Der Community-Provider konfiguriert ein Keycloak, das Sie bereits betreiben. Dieser stellt es bereit, sichert es und bootet das Realm, in einer einzigen Datei.

One provider, 28 resources

Der gesamte Managed Stack, unter einem Schlüssel.

Platform

The infrastructure the admin API cannot touch.

Clusters, custom domains & routes, cluster security (WAF, IP access control, rate limiting, geo & bot rules), maintenance windows, extensions, SIEM destinations, webhooks, exports.

Realm basics

The building blocks inside a realm.

Realms, users, realm roles, groups & memberships, role assignments, applications (clients) & secrets, identity providers, SMTP. Deep realm config (auth flows, protocol mappers, client scopes) pairs with the community provider.

Branding & delivery

A login page that looks like yours.

Skycloak provider vs community provider

Es tut, was die Admin-API strukturell nicht kann.

Der Community-Provider ist exzellent in dem, was er tut: Konfigurieren eines Keycloak, das Sie bereits betreiben. Er authentifiziert sich gegen eine Keycloak Admin API, kann also niemals die Instanz oder die Plattform drum herum bereitstellen. Dieser kann es.

	Community Keycloak provider Config on a Keycloak you run	Skycloak provider Provision + config, one API key
Create realms, users, roles, groups
Basic clients, identity providers, SMTP
Deep realm config: auth flows, protocol mappers, client scopes, policies
Provision the Keycloak cluster itself
Custom domains & routing
WAF, IP access control, rate limiting
SIEM streaming & webhooks
Login & email branding, custom themes
Extensions & maintenance windows
Servers you run and patch	All of them	None
Authentication	Admin service account	One Skycloak API key

Loslegen

Drei Schritte zu Keycloak as Code.

1. Mint an API key

Erstellen Sie einen scoped sk_sc_ API Key im Skycloak Dashboard und exportieren Sie ihn als SKYCLOAK_API_KEY.

2. Declare the provider

Fügen Sie den sky-cloak/skycloak Provider zu Ihrer Config hinzu und pinnen Sie eine Version.

3. Run `terraform apply`

Planen, prüfen, anwenden. Ihr Cluster, Realm und Branding kommen zusammen hoch, versioniert und überprüfbar.

versions.tf HCL

terraform {
  required_providers {
    skycloak = {
      source  = "sky-cloak/skycloak"
      version = "~> 0.3"
    }
  }
}

FAQ

The provider, answered.

Is this the same as the community Keycloak Terraform provider?

No, and they work well together. The community keycloak/keycloak provider configures a Keycloak that you host and run: it talks to the admin REST API to manage realms, clients, users, and deep settings like authentication flows and protocol mappers. The Skycloak provider talks to the Skycloak API, so it provisions the managed cluster itself and manages the platform layer the admin API cannot reach (custom domains, WAF, IP rules, SIEM, extensions, maintenance windows, branding), plus the basic realm setup (realms, users, roles, groups, basic clients, identity providers, SMTP), from one API key. For deep realm configuration you pair it with the community provider.

What can it manage?

The full managed stack: clusters, custom domains and routing, cluster security (WAF, IP access control, rate limiting, geo and bot rules), SIEM destinations, extensions and maintenance windows, and login, email, and theme branding, plus the realm basics: realms, users, roles, groups, applications, identity providers, and SMTP. For deep realm configuration (auth flows, protocol mappers, client scopes, password policies) it hands off to the community keycloak/keycloak provider.

Can it configure authentication flows and protocol mappers?

Not yet. Deep realm configuration, authentication flows, protocol mappers, client scopes, password and token policies, and user federation, is out of scope for the Skycloak provider today. Manage it with the community keycloak/keycloak provider pointed at your cluster URL, in the same project. See the guide on using both providers together.

How do I authenticate?

Mint a Skycloak API key (sk_sc_...) in the dashboard and expose it as the SKYCLOAK_API_KEY environment variable. The provider reads it automatically.

Is it production ready?

The provider is published and usable today and is actively developed. Pin a version constraint in your required_providers block so a new release never changes resources under you, and review the changelog before you upgrade.

Does it work alongside my existing Terraform?

Yes. It is a standard Terraform provider, so it composes with your other providers, modules, workspaces, and remote state exactly like any HashiCorp or partner provider.

Kostenlos testen Im Register ansehen