Use Terraform to create and manage SASL users - ApsaraMQ for Kafka

The default Simple Authentication and Security Layer (SASL) user of an ApsaraMQ for Kafka instance is used for identity verification. The default SASL user is granted the read and write permissions on all topics and consumer groups that are created on the instance. If you want to perform fine-grained access control on ApsaraMQ for Kafka resources, you must enable the access control list (ACL) feature, create a SASL user, and then grant the SASL user the required permissions on the ApsaraMQ for Kafka resources. You can use the alicloud_alikafka_sasl_user resource provided by Terraform to create and manage SASL users in ApsaraMQ for Kafka.

Note

You can run the sample code in this topic with a few clicks.

Before you start

An Alibaba Cloud account has full permissions on all resources that belong to this account. If the credentials of an Alibaba Cloud account are leaked, security risks may arise. We recommend that you use a Resource Access Management (RAM) user and create an AccessKey pair for the RAM user. For more information, see Create a RAM user and Create an AccessKey pair.

You must use RAM to manage access permissions on cloud resources in an efficient manner. This helps meet the requirements for multi-user collaboration and allows you to grant permissions to users based on the principle of least privilege to prevent security vulnerabilities caused by excessive permissions. For more information, see Grant permissions to RAM users.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DeleteVpc",
                "vpc:DeleteVSwitch",
                "vpc:CreateVpc",
                "vpc:CreateVSwitch"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "bss:ModifyAgreementRecord",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "bss:DescribeOrderList",
                "bss:DescribeOrderDetail",
                "bss:PayOrder",
                "bss:CancelOrder"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateSecurityGroup",
                "ecs:ModifySecurityGroupPolicy",
                "ecs:DescribeSecurityGroups",
                "ecs:ListTagResources",
                "ecs:DeleteSecurityGroup",
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:AuthorizeSecurityGroup",
                "ecs:RevokeSecurityGroup"
            ],
            "Resource": "*"
        },
        {
            "Action": "alikafka:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "connector.alikafka.aliyuncs.com",
                        "instanceencryption.alikafka.aliyuncs.com",
                        "alikafka.aliyuncs.com",
                        "etl.alikafka.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Prepare the runtime environment for Terraform by using one of the following methods:
- Use Terraform in Terraform Explorer: Alibaba Cloud provides Terraform Explorer, an online runtime environment for Terraform. You can use Terraform after you log on to Terraform Explorer without the need to install Terraform. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at no additional costs.
- Use Terraform in Cloud Shell: Terraform is preinstalled in Cloud Shell and identity credentials are configured. You can directly run Terraform commands in Cloud Shell. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at low costs.
- Install and configure Terraform on your on-premises machine: This method is suitable for scenarios in which network connections are unstable or a custom development environment is required.

Resources

Note

You are charged for specific resources required in this topic. If you no longer require the resources, release or unsubscribe from the resources at the earliest opportunity.

alicloud_vpc: creates a virtual private cloud (VPC).
alicloud_vswitch: creates a vSwitch in a VPC.
alicloud_security_group: creates a security group.
alicloud_alikafka_instance: creates an ApsaraMQ for Kafka instance.
alicloud_alikafka_sasl_user: creates a SASL user.
alicloud_alikafka_sasl_users: queries SASL users.

Create a SASL user

In the following example, a SASL user is created for an instance that resides in the China (Shenzhen) region.

Create a working directory and a configuration file named main.tf in the directory. Copy the following code to the main.tf configuration file:

Create the required resources.

Note

You can create SASL users only for ApsaraMQ for Kafka Professional Edition instances whose ACL feature is enabled.

variable "region" {
  default = "cn-shenzhen"
}

variable "instance_name" {
  default = "alikafkaInstanceName"
}

variable "zone_id" {
  default = "cn-shenzhen-f"
}

provider "alicloud" {
  region = var.region
}

# Create a VPC.
resource "alicloud_vpc" "default" {
  vpc_name   = "alicloud"
  cidr_block = "172.16.0.0/16"
}

# Create a vSwitch.
resource "alicloud_vswitch" "default" {
  vpc_id     = alicloud_vpc.default.id
  cidr_block = "172.16.192.0/20"
  zone_id    = var.zone_id
}

# Create a security group. 
resource "alicloud_security_group" "default" {
  vpc_id = alicloud_vpc.default.id
}

# Create an instance. The disk type is ultra disk, the disk capacity is 500 GB, and the traffic specification is alikafka.hw.2xlarge. 
# Deploy the instance. 
resource "alicloud_alikafka_instance" "default" {
  name            = var.instance_name
  partition_num   = 50
  disk_type       = "1"
  disk_size       = "500"
  deploy_type     = "5"
  io_max          = "20"
  spec_type       = "professional"
  service_version = "2.2.0"
  vswitch_id      = alicloud_vswitch.default.id
  security_group  = alicloud_security_group.default.id
  config          = <<EOF
  {
    "enable.acl": "true"
  }
  EOF
}

In the main.tf configuration file, add the resource alicloud_alikafka_sasl_user "default" configuration item.

variable "name" {
  default = "tf-example"
}

resource "alicloud_alikafka_sasl_user" "default" {
  instance_id = alicloud_alikafka_instance.default.id
  username    = var.name
  password    = "tf_example123"
}

Run the following command to initialize the runtime environment for Terraform:

terraform init

If the following information is returned, Terraform is initialized.

Initializing the backend...

Initializing provider plugins...
- Checking for available provider plugins...
- Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.90.1...
...

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other

Create an execution plan and preview the changes.
```
terraform plan
```

Run the following command to create the resources:

terraform apply

During the execution, enter yes as prompted and press the Enter key. Wait until the command is executed. If the following information is returned, the command is run.

alicloud_vpc.default: Creating...
alicloud_vpc.default: Creation complete after 6s [id=vpc-****]
alicloud_security_group.default: Creating...
alicloud_vswitch.default: Creating...
alicloud_security_group.default: Creation complete after 1s [id=sg-****]
alicloud_vswitch.default: Creation complete after 4s [id=vsw-****]
alicloud_alikafka_instance.default: Creating...
alicloud_alikafka_instance.default: Still creating... [10s elapsed]
···
alicloud_alikafka_instance.default: Still creating... [3m30s elapsed]
alicloud_alikafka_instance.default: Creation complete after 3m33s [id=alikafka_post-cn-****]
alicloud_alikafka_sasl_user.default: Creating...
alicloud_alikafka_sasl_user.default: Creation complete after 3s [id=alikafka_post-cn-****:tf-example]

Apply complete!  Resources: 5 added, 0 changed, 0 destroyed.

Verify the result.

Use the terraform show command

Run the terraform show command to view information about the SASL user.

terraform show

# alicloud_alikafka_sasl_user.default:
resource "alicloud_alikafka_sasl_user" "default" {
    id          = "alikafka_post-cn-****:tf-example"
    instance_id = "alikafka_post-cn-****"
    password    = (sensitive value)
    type        = "plain"
    username    = "tf-example"
}

Use the ApsaraMQ for Kafka console

Log on to the ApsaraMQ for Kafka console to view information about the SASL user.

Query a SASL user

In the main.tf configuration file, add the data "alicloud_alikafka_sasl_users" "sasl_users_ds" configuration item and configure the configuration item based on the following code snippet:
```
data "alicloud_alikafka_sasl_users" "sasl_users_ds" {
  instance_id = alicloud_alikafka_instance.default.id
}
```
Create an execution plan and preview the changes.
```
terraform plan
```

Run the following command to create the resources:

terraform apply

During the execution, enter yes as prompted and press the Enter key. Wait until the command is executed. If the following information is returned, the command is run.

alicloud_vpc.default: Refreshing state... [id=vpc-****]
alicloud_security_group.default: Refreshing state... [id=sg-****]
alicloud_vswitch.default: Refreshing state... [id=vsw-****]
alicloud_alikafka_instance.default: Refreshing state... [id=alikafka_post-cn-****]
alicloud_alikafka_sasl_user.default: Refreshing state... [id=alikafka_post-cn-****:tf-example]
data.alicloud_alikafka_sasl_users.sasl_users_ds: Reading...
data.alicloud_alikafka_sasl_users.sasl_users_ds: Read complete after 0s [id=****]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are
needed.

Apply complete!  Resources: 0 added, 0 changed, 0 destroyed.

Verify the result. Run the terraform show command to view information about the SASL user.

terraform show

# data.alicloud_alikafka_sasl_users.sasl_users_ds:
data "alicloud_alikafka_sasl_users" "sasl_users_ds" {
    id          = "404393857"
    instance_id = "alikafka_post-cn-****"
    names       = [
        "tf-example",
    ]
    users       = [
        {
            password = "tf_example123"
            username = "tf-example"
        },
    ]
}

Clear resources

If you no longer require the preceding resources that are created or managed by using Terraform, run the following command to release the resources. For more information about the terraform destroy command, see Common commands.

terraform destroy

Sample code

Note

You can run the sample code with a few clicks.

Sample code

variable "name" {
  default = "tf-example"
}

variable "region" {
  default = "cn-shenzhen"
}

variable "instance_name" {
  default = "alikafkaInstanceName"
}

variable "zone_id" {
  default = "cn-shenzhen-f"
}

provider "alicloud" {
  region = var.region
}

# Create a VPC.
resource "alicloud_vpc" "default" {
  vpc_name   = "alicloud"
  cidr_block = "172.16.0.0/16"
}

# Create a vSwitch.
resource "alicloud_vswitch" "default" {
  vpc_id     = alicloud_vpc.default.id
  cidr_block = "172.16.192.0/20"
  zone_id    = var.zone_id
}

# Create a security group. 
resource "alicloud_security_group" "default" {
  vpc_id = alicloud_vpc.default.id
}

# Create an instance. The disk type is ultra disk, the disk capacity is 500 GB, and the traffic specification is alikafka.hw.2xlarge. 
# Deploy the instance. 
resource "alicloud_alikafka_instance" "default" {
  name            = var.instance_name
  partition_num   = 50
  disk_type       = "1"
  disk_size       = "500"
  deploy_type     = "5"
  io_max          = "20"
  spec_type       = "professional"
  service_version = "2.2.0"
  vswitch_id      = alicloud_vswitch.default.id
  security_group  = alicloud_security_group.default.id
  config          = <<EOF
  {
    "enable.acl": "true"
  }
  EOF
}

resource "alicloud_alikafka_sasl_user" "default" {
  instance_id = alicloud_alikafka_instance.default.id
  username    = var.name
  password    = "tf_example123"
}

data "alicloud_alikafka_sasl_users" "sasl_users_ds" {
  instance_id = alicloud_alikafka_instance.default.id
  depends_on  = [alicloud_alikafka_sasl_user.default]
}

References

You can also create and manage SASL users in the ApsaraMQ for console or by calling API operations. For more information, see Grant permissions to SASL users and SASL users.
For information about other arguments provided by the alicloud_alikafka_sasl_user resource, see alicloud_alikafka_sasl_user.