|
| 1 | +# Setup of a Subaccount using BTP Terraform Provider |
| 2 | + |
| 3 | +In this exercise you will learn how to use the [Terraform Provider for SAP BTP](https://registry.terraform.io/providers/SAP/btp/latest/docs) to provision and manage resources in SAP BTP as well as [Cloudfoundry Terraform Provider](https://registry.terraform.io/providers/cloudfoundry/cloudfoundry/latest) to manage Cloudfoundry resources. |
| 4 | + |
| 5 | +## Step 1: Create a new directory |
| 6 | + |
| 7 | +To make use of Terraform you must create several configuration files using the [Terraform configuration language](https://developer.hashicorp.com/terraform/language). Create a new directory named `my-tf-handson` under the folder `SITBLR2025`. |
| 8 | + |
| 9 | +Terraform expects a specific file layout for its configurations. Create the following empty files in the directory `my-tf-handson`: |
| 10 | + |
| 11 | +- `main.tf` - this file will contain the main configuration of the Terraform setup |
| 12 | +- `provider.tf` - this file will contain the provider configuration |
| 13 | +- `variables.tf` - this file will contain the variables to be used in the Terraform configuration |
| 14 | +- `terraform.tfvars` - this file will contain your specific variable values |
| 15 | + |
| 16 | +## Step 2: Setup Subaccount using Terraform |
| 17 | + |
| 18 | +- Open the file `provider.tf` and add the following content: |
| 19 | + |
| 20 | +```terraform |
| 21 | +terraform { |
| 22 | + required_providers { |
| 23 | + btp = { |
| 24 | + source = "sap/btp" |
| 25 | + version = "~> 1.10.0" |
| 26 | + } |
| 27 | + cloudfoundry = { |
| 28 | + source = "cloudfoundry/cloudfoundry" |
| 29 | + version = "~> 1.3.0" |
| 30 | + } |
| 31 | + } |
| 32 | +} |
| 33 | +
|
| 34 | +provider "btp" { |
| 35 | + globalaccount = var.globalaccount |
| 36 | + idp = var.idp |
| 37 | +} |
| 38 | +provider "cloudfoundry" { |
| 39 | + api_url = "https://api.cf.${var.region}.hana.ondemand.com" |
| 40 | + origin = var.idp |
| 41 | +} |
| 42 | +``` |
| 43 | + |
| 44 | +What have we done? First we defined which provider we want to use and which version of the provider we want to use. In this case we want to use the provider `sap/btp` in version `1.10.0` and cloudfoundry provider `cloudfoundry/cloudfoundry` in version `1.3.0`. Then we defined the provider configuration. In this case we need to provide the `globalaccount` and `idp` parameters where we reference a variable. We will define this variable in the next steps. |
| 45 | + |
| 46 | + > [!NOTE] |
| 47 | + > We do not need any authentication information in this file. We provided the authentication information via environment variables. |
| 48 | +
|
| 49 | +Next we must add the required variables to the `variables.tf` file. Open the file `variables.tf` and add the following content: |
| 50 | + |
| 51 | +```terraform |
| 52 | +variable "globalaccount" { |
| 53 | + type = string |
| 54 | + description = "The subdomain of the SAP BTP global account." |
| 55 | +} |
| 56 | +
|
| 57 | +variable "idp" { |
| 58 | + type = string |
| 59 | + description = "Orgin key of Identity Provider" |
| 60 | + default = null |
| 61 | +} |
| 62 | +variable "region" { |
| 63 | + type = string |
| 64 | + description = "The region where the project account shall be created in." |
| 65 | + default = "ap10" |
| 66 | +} |
| 67 | +variable "project_name" { |
| 68 | + type = string |
| 69 | + description = "The subaccount name." |
| 70 | + default = "proj-1234" |
| 71 | +
|
| 72 | + validation { |
| 73 | + condition = can(regex("^[a-zA-Z0-9_\\-]{1,200}", var.project_name)) |
| 74 | + error_message = "Provide a valid project name." |
| 75 | + } |
| 76 | +} |
| 77 | +variable "stage" { |
| 78 | + type = string |
| 79 | + description = "The stage/tier the account will be used for." |
| 80 | + default = "DEV" |
| 81 | +
|
| 82 | + validation { |
| 83 | + condition = contains(["DEV", "TST", "PRD"], var.stage) |
| 84 | + error_message = "Select a valid stage for the project account." |
| 85 | + } |
| 86 | +} |
| 87 | +variable "costcenter" { |
| 88 | + type = string |
| 89 | + description = "The cost center the account will be billed to." |
| 90 | + default = "1234567890" |
| 91 | +
|
| 92 | + validation { |
| 93 | + condition = can(regex("^[0-9]{10}", var.costcenter)) |
| 94 | + error_message = "Provide a valid cost center." |
| 95 | + } |
| 96 | +} |
| 97 | +variable "org_name" { |
| 98 | + type = string |
| 99 | + description = "Defines to which organization the project account shall belong to." |
| 100 | + default = "Exporter" |
| 101 | +} |
| 102 | +variable "bas_admins" { |
| 103 | + type = list(string) |
| 104 | + description = "List of users to assign the Administrator role." |
| 105 | +
|
| 106 | +} |
| 107 | +variable "bas_developers" { |
| 108 | + type = list(string) |
| 109 | + description = "List of users to assign the Developer role." |
| 110 | +} |
| 111 | +variable "bas_service_name" { |
| 112 | + type = string |
| 113 | + description = "Service name for Business Application Studio." |
| 114 | + default = "sapappstudio" |
| 115 | +
|
| 116 | +} |
| 117 | +variable "bas_plan" { |
| 118 | + type = string |
| 119 | + description = "Plan name for Business Application Studio." |
| 120 | + default = "standard-edition" |
| 121 | +} |
| 122 | +
|
| 123 | +variable "cf_landscape_label" { |
| 124 | + type = string |
| 125 | + description = "The region where the project account shall be created in." |
| 126 | + default = "cf-ap10" |
| 127 | +} |
| 128 | +variable "cf_plan" { |
| 129 | + type = string |
| 130 | + description = "Plan name for Cloud Foundry Runtime." |
| 131 | + default = "standard" |
| 132 | +} |
| 133 | +variable "cf_space_name" { |
| 134 | + type = string |
| 135 | + description = "The name of the Cloud Foundry space." |
| 136 | + default = "dev" |
| 137 | +} |
| 138 | +
|
| 139 | +variable "cf_org_user" { |
| 140 | + type = set(string) |
| 141 | + description = "Defines the colleagues who are added to each subaccount as subaccount administrators." |
| 142 | + |
| 143 | +} |
| 144 | +
|
| 145 | +variable "cf_space_managers" { |
| 146 | + type = list(string) |
| 147 | + description = "The list of Cloud Foundry space managers." |
| 148 | + default = [] |
| 149 | +} |
| 150 | +
|
| 151 | +variable "cf_space_developers" { |
| 152 | + type = list(string) |
| 153 | + description = "The list of Cloud Foundry space developers." |
| 154 | + default = [] |
| 155 | +} |
| 156 | +
|
| 157 | +variable "cf_space_auditors" { |
| 158 | + type = list(string) |
| 159 | + description = "The list of Cloud Foundry space auditors." |
| 160 | + default = [] |
| 161 | +} |
| 162 | +``` |
| 163 | +We have now defined the variables which will be required for the provider configuration. We will provide the value for this variable via the `terraform.tfvars` file. |
| 164 | + |
| 165 | + - Open the file `terraform.tfvars` and add the following content: |
| 166 | + |
| 167 | +```terraform |
| 168 | +globalaccount = "<YOUR GLOBAL ACCOUNT SUBDOMAIN>" |
| 169 | +idp = null |
| 170 | +project_name = "<YOUR LAST NAME>" |
| 171 | +
|
| 172 | +bas_service_name = "sapappstudio" |
| 173 | +bas_plan = "standard-edition" |
| 174 | + |
| 175 | + |
| 176 | +
|
| 177 | +cf_plan = "standard" |
| 178 | +cf_org_user = ["[email protected]"] |
| 179 | +cf_space_developers = ["[email protected]"] |
| 180 | +``` |
| 181 | +The SAP BTP Global Account Subdomain can be found in the [SAP BTP Cockpit](https://apac.cockpit.btp.cloud.sap/cockpit/?idp=aviss4yru.accounts.ondemand.com#/globalaccount/6378f0c6-1b1e-4b10-8517-171cbec05c3e). Update fields with your user details. |
| 182 | + |
| 183 | +- Open `main.tf` file and add the following content |
| 184 | + |
| 185 | +```terraform |
| 186 | +locals { |
| 187 | + project_subaccount_name = "${var.org_name} | ${var.project_name}: CF - ${var.stage}" |
| 188 | + project_subaccount_domain = lower(replace("${var.org_name}-${var.project_name}-${var.stage}", " ", "")) |
| 189 | + project_subaccount_cf_org = replace("${var.org_name}_${lower(var.project_name)}-${lower(var.stage)}", " ", "_") |
| 190 | +} |
| 191 | +resource "btp_subaccount" "project" { |
| 192 | + name = local.project_subaccount_name |
| 193 | + subdomain = local.project_subaccount_domain |
| 194 | + region = lower(var.region) |
| 195 | + labels = { |
| 196 | + "stage" = ["${var.stage}"], |
| 197 | + "costcenter" = ["${var.costcenter}"] |
| 198 | + } |
| 199 | +} |
| 200 | +resource "btp_subaccount_entitlement" "bas" { |
| 201 | + subaccount_id = btp_subaccount.project.id |
| 202 | + service_name = var.bas_service_name |
| 203 | + plan_name = var.bas_plan |
| 204 | +} |
| 205 | +
|
| 206 | +resource "btp_subaccount_subscription" "bas" { |
| 207 | + subaccount_id = btp_subaccount.project.id |
| 208 | + app_name = var.bas_service_name |
| 209 | + plan_name = var.bas_plan |
| 210 | + depends_on = [btp_subaccount_entitlement.bas] |
| 211 | +} |
| 212 | +
|
| 213 | +resource "btp_subaccount_role_collection_assignment" "bas_admin" { |
| 214 | + for_each = toset(var.bas_admins) |
| 215 | + subaccount_id = btp_subaccount.project.id |
| 216 | + role_collection_name = "Business_Application_Studio_Administrator" |
| 217 | + user_name = each.value |
| 218 | + depends_on = [btp_subaccount_subscription.bas] |
| 219 | +} |
| 220 | +
|
| 221 | +resource "btp_subaccount_role_collection_assignment" "bas_developer" { |
| 222 | + for_each = toset(var.bas_developers) |
| 223 | + subaccount_id = btp_subaccount.project.id |
| 224 | + role_collection_name = "Business_Application_Studio_Developer" |
| 225 | + user_name = each.value |
| 226 | + depends_on = [btp_subaccount_subscription.bas] |
| 227 | +} |
| 228 | +resource "btp_subaccount_environment_instance" "cloudfoundry" { |
| 229 | + subaccount_id = btp_subaccount.project.id |
| 230 | + name = local.project_subaccount_cf_org |
| 231 | + landscape_label = var.cf_landscape_label |
| 232 | + environment_type = "cloudfoundry" |
| 233 | + service_name = "cloudfoundry" |
| 234 | + plan_name = var.cf_plan |
| 235 | + parameters = jsonencode({ |
| 236 | + instance_name = local.project_subaccount_cf_org |
| 237 | + }) |
| 238 | + timeouts = { |
| 239 | + create = "1h" |
| 240 | + update = "35m" |
| 241 | + delete = "30m" |
| 242 | + } |
| 243 | +} |
| 244 | +resource "cloudfoundry_org_role" "my_role" { |
| 245 | + for_each = var.cf_org_user |
| 246 | + username = each.value |
| 247 | + type = "organization_user" |
| 248 | + org = btp_subaccount_environment_instance.cloudfoundry.platform_id |
| 249 | +} |
| 250 | +
|
| 251 | +resource "cloudfoundry_space" "space" { |
| 252 | + name = var.cf_space_name |
| 253 | + org = btp_subaccount_environment_instance.cloudfoundry.platform_id |
| 254 | +} |
| 255 | +
|
| 256 | +resource "cloudfoundry_space_role" "cf_space_managers" { |
| 257 | + for_each = toset(var.cf_space_managers) |
| 258 | + username = each.value |
| 259 | + type = "space_manager" |
| 260 | + space = cloudfoundry_space.space.id |
| 261 | + depends_on = [cloudfoundry_org_role.my_role] |
| 262 | +} |
| 263 | +
|
| 264 | +resource "cloudfoundry_space_role" "cf_space_developers" { |
| 265 | + for_each = toset(var.cf_space_developers) |
| 266 | + username = each.value |
| 267 | + type = "space_developer" |
| 268 | + space = cloudfoundry_space.space.id |
| 269 | + depends_on = [cloudfoundry_org_role.my_role] |
| 270 | +} |
| 271 | +
|
| 272 | +resource "cloudfoundry_space_role" "cf_space_auditors" { |
| 273 | + for_each = toset(var.cf_space_auditors) |
| 274 | + username = each.value |
| 275 | + type = "space_auditor" |
| 276 | + space = cloudfoundry_space.space.id |
| 277 | + depends_on = [cloudfoundry_org_role.my_role] |
| 278 | +} |
| 279 | +``` |
| 280 | +### Apply the Terraform configuration |
| 281 | + |
| 282 | +Now the moment has come to apply the Terraform configuration for the first time. Open a terminal window and execute the following commands: |
| 283 | + |
| 284 | +1. Initialize the Terraform configuration to download the required provider: |
| 285 | + |
| 286 | +```bash |
| 287 | +terraform init |
| 288 | +``` |
| 289 | + |
| 290 | +> [!NOTE] |
| 291 | +> Check your files. You should have a new folder called `.terraform` as well as new file called `.terraform.lock.hcl` in your directory. This means that the Terraform provider has been successfully downloaded and the version constraints are stored for your setup. |
| 292 | +
|
| 293 | +2. Plan the Terraform configuration to see what will be created: |
| 294 | + |
| 295 | +```bash |
| 296 | +terraform plan |
| 297 | +``` |
| 298 | +3. Apply the Terraform configuration to create the subaccount: |
| 299 | + |
| 300 | +```bash |
| 301 | +terraform apply |
| 302 | + |
| 303 | +``` |
| 304 | + You will be prompted to confirm the creation of the subaccount. Type `yes` and press `Enter` to continue. |
| 305 | + |
| 306 | + Go to the BTP cockpit and check the resources you have created. Follow the URL to access [BTP Accounts Cockpit](https://apac.cockpit.btp.cloud.sap/cockpit/?idp=aviss4yru.accounts.ondemand.com#/globalaccount/6378f0c6-1b1e-4b10-8517-171cbec05c3e). |
| 307 | + |
| 308 | + |
| 309 | +## Summary |
| 310 | + |
| 311 | +You have successfully created an SAP BTP Subaccount with active resources using Terraform. Now, imagine you already have an existing subaccount and want to bring it under Terraform's management. This exercise will guide you through that process. |
| 312 | + |
| 313 | +Continue to - [Exercise 2 - Export BTP Subaccount Using BTP Terraform Exporter](../EXERCISE2/README.md). |
0 commit comments