Create an OAuth client for use with Dynatrace Configuration as Code via Terraform

This guide shows you how to create an OAuth client for use with Dynatrace Configuration as Code via Terraform.

Create an OAuth client

  1. Go to Account Management.

  2. Select Identity & access management > OAuth clients.

  3. Select Create client.

  4. Enter the email address of the user who owns the client.

  5. Enter a description of the new client.

  6. Select the required scopes.

    Each available type of platform configuration requires specific OAuth scopes.

    Configure an OAuth client with all of the permissions below to be compatible with all OAuth-based Terraform resources, or provide a subset of permissions based on required use cases.

    Purpose
    Scopes
    View and create settings objects
    settings:objects:read, settings:objects:write
    View and manage workflows
    automation:workflows:read, automation:workflows:write, automation:calendars:read, automation:calendars:write, automation:rules:read, automation:rules:write
    Access all workflows1
    automation:workflows:admin
    View and manage documents
    document:documents:read, document:documents:write, document:documents:delete, document:trash.documents:delete
    View and manage direct document sharing
    document:direct-shares:read, document:direct-shares:write, document:direct-shares:delete
    View business events
    storage:bizevents:read
    View and manage Grail buckets
    storage:bucket-definitions:read, storage:bucket-definitions:write
    View and manage users and groups
    account-idm-read, account-idm-write
    View and manage policies
    iam-policies-management
    View environments
    account-env-read
    1

    To use the automation:workflows:admin scope, you need to create a custom policy granting that scope, bind a group to it, and assign your user to that group in Account Management before creating the OAuth client. For detailed information on managing policies, see Manage IAM policies.

  7. Select Create client.

  8. Copy the generated client ID and secret and store them in a safe place.

    You can only access your client secret once upon creation. You can't reveal it afterward.

Ensure service user permissions

In addition to the scopes available to the OAuth client, permissions can be further limited via policies applied to the user's groups.

For details on how permissions can be controlled, see Working with policies.

To ensure your OAuth client works as intended, verify that the service user's groups grant the same scopes as the OAuth client you have created for all environments you want to use it with.

Use your OAuth client

  1. Follow the instructions for your operating system or CI/CD tool on making the client ID and secret available as environment variables.
  2. The Dynatrace Terraform Provider will request OAuth access tokens using your client credentials to make authenticated API calls.