Keycloak Managé · Terraform

Votre Keycloak managé, en code.

Q: Is this the same as the community Keycloak Terraform provider?

No, and they work well together. The community keycloak/keycloak provider configures a Keycloak that you host and run: it talks to the admin REST API to manage realms, clients, users, and deep settings like authentication flows and protocol mappers. The Skycloak provider talks to the Skycloak API, so it provisions the managed cluster itself and manages the platform layer the admin API cannot reach (custom domains, WAF, IP rules, SIEM, extensions, maintenance windows, branding), plus the basic realm setup (realms, users, roles, groups, basic clients, identity providers, SMTP), from one API key. For deep realm configuration you pair it with the community provider.

Q: How do I authenticate?

Mint a Skycloak API key (sk_sc_...) in the dashboard and expose it as the SKYCLOAK_API_KEY environment variable. The provider reads it automatically.

Le provider Terraform officiel de Skycloak provisionne votre Managed Keycloak complet à partir d'une seule clé API : le cluster, la plateforme qui l'entoure (WAF, SIEM, domaines personnalisés, branding), et un realm initialisé avec des utilisateurs, des rôles et des fournisseurs d'identité. Passez d'un fichier vide à une instance sécurisée, brandée et opérationnelle en un seul terraform apply.

Voir on the Terraform Registry Lisez le guide : fournisseur vs communauté, et comment utiliser les deux

main.tf HCL

# Auth reads the SKYCLOAK_API_KEY env var (sk_sc_...)
provider "skycloak" {}

# 1. Provision a managed Keycloak cluster
resource "skycloak_cluster" "prod" {
  name     = "production"
  type     = "keycloak"
  size     = "small"
  version  = "26.6.3"
  location = "us"
}

# 2. Create a realm on it
resource "skycloak_realm" "app" {
  cluster_id   = skycloak_cluster.prod.id
  name         = "app"
  display_name = "Application Realm"
  enabled      = true
}

# 3. Add Google sign-in
resource "skycloak_identity_provider" "google" {
  cluster_id    = skycloak_cluster.prod.id
  realm_name    = skycloak_realm.app.name
  provider_id   = "google"
  type          = "oidc"
  client_id     = var.google_client_id
  client_secret = var.google_client_secret
}

# 4. Brand the login page and switch on the WAF
resource "skycloak_login_branding" "app" {
  cluster_id    = skycloak_cluster.prod.id
  realm_name    = skycloak_realm.app.name
  primary_color = "#3b82f6"
  logo_url      = "https://myapp.com/logo.svg"
}

resource "skycloak_cluster_security" "prod" {
  cluster_id = skycloak_cluster.prod.id
  waf = {
    enabled = true
    mode    = "block"
    preset  = "owasp_top_10"
  }
}

Le fournisseur communautaire configure un Keycloak que vous exécutez déjà. Celui-ci le provisionne, le sécurise et amorce le realm, dans un seul fichier.

One provider, 28 resources

Toute la stack managée, sous une seule clé.

Platform

The infrastructure the admin API cannot touch.

Clusters, custom domains & routes, cluster security (WAF, IP access control, rate limiting, geo & bot rules), maintenance windows, extensions, SIEM destinations, webhooks, exports.

Realm basics

The building blocks inside a realm.

Realms, users, realm roles, groups & memberships, role assignments, applications (clients) & secrets, identity providers, SMTP. Deep realm config (auth flows, protocol mappers, client scopes) pairs with the community provider.

Branding & delivery

A login page that looks like yours.

Skycloak provider vs community provider

Il fait ce que l'API admin ne peut structurellement pas faire.

Le fournisseur communautaire est excellent dans ce qu'il fait : configurer un Keycloak que vous exécutez déjà. Il s'authentifie contre une API admin Keycloak, donc il ne peut jamais provisionner l'instance ou la plateforme autour. Celui-ci le peut.

	Community Keycloak provider Config on a Keycloak you run	Skycloak provider Provision + config, one API key
Create realms, users, roles, groups
Basic clients, identity providers, SMTP
Deep realm config: auth flows, protocol mappers, client scopes, policies
Provision the Keycloak cluster itself
Custom domains & routing
WAF, IP access control, rate limiting
SIEM streaming & webhooks
Login & email branding, custom themes
Extensions & maintenance windows
Servers you run and patch	All of them	None
Authentication	Admin service account	One Skycloak API key

Commencer

Trois étapes vers Keycloak as code.

1. Mint an API key

Créez une clé API sk_sc_ limitée dans le tableau de bord Skycloak et exportez-la comme SKYCLOAK_API_KEY.

2. Déclarez le fournisseur

Ajoutez le fournisseur sky-cloak/skycloak à votre configuration et épinglez une version.

3. Exécutez `terraform apply`

Planifiez, révisez, appliquez. Votre cluster, realm et branding montent ensemble, versionnés et révisables.

versions.tf HCL

terraform {
  required_providers {
    skycloak = {
      source  = "sky-cloak/skycloak"
      version = "~> 0.3"
    }
  }
}

FAQ

The provider, answered.

Is this the same as the community Keycloak Terraform provider?

No, and they work well together. The community keycloak/keycloak provider configures a Keycloak that you host and run: it talks to the admin REST API to manage realms, clients, users, and deep settings like authentication flows and protocol mappers. The Skycloak provider talks to the Skycloak API, so it provisions the managed cluster itself and manages the platform layer the admin API cannot reach (custom domains, WAF, IP rules, SIEM, extensions, maintenance windows, branding), plus the basic realm setup (realms, users, roles, groups, basic clients, identity providers, SMTP), from one API key. For deep realm configuration you pair it with the community provider.

What can it manage?

The full managed stack: clusters, custom domains and routing, cluster security (WAF, IP access control, rate limiting, geo and bot rules), SIEM destinations, extensions and maintenance windows, and login, email, and theme branding, plus the realm basics: realms, users, roles, groups, applications, identity providers, and SMTP. For deep realm configuration (auth flows, protocol mappers, client scopes, password policies) it hands off to the community keycloak/keycloak provider.

Can it configure authentication flows and protocol mappers?

Not yet. Deep realm configuration, authentication flows, protocol mappers, client scopes, password and token policies, and user federation, is out of scope for the Skycloak provider today. Manage it with the community keycloak/keycloak provider pointed at your cluster URL, in the same project. See the guide on using both providers together.

How do I authenticate?

Mint a Skycloak API key (sk_sc_...) in the dashboard and expose it as the SKYCLOAK_API_KEY environment variable. The provider reads it automatically.

Is it production ready?

The provider is published and usable today and is actively developed. Pin a version constraint in your required_providers block so a new release never changes resources under you, and review the changelog before you upgrade.

Does it work alongside my existing Terraform?

Yes. It is a standard Terraform provider, so it composes with your other providers, modules, workspaces, and remote state exactly like any HashiCorp or partner provider.

Démarrer l'essai gratuit Voir sur le registre