Initial commit

.github/workflows/abbey-grant-kit-generate-policy-input.yaml

@@ -0,0 +1,45 @@
+name: Abbey Grant Kit Generate Policy Input
+
+on:
+  pull_request:
+jobs:
+  output-plan:
+    runs-on: ubuntu-latest
+    env:
+      TF_VAR_abbey_token: ${{ secrets.ABBEY_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Terraform
+        id: setup
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_wrapper: false
+
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        env:
+          TF_HTTP_USERNAME: quickstart
+          TF_HTTP_PASSWORD: ${{ secrets.ABBEY_TOKEN }}
+
+      - name: Terraform Plan
+        id: plan
+        run: terraform plan -no-color -input=false -out=tfplan
+        env:
+          TF_HTTP_USERNAME: quickstart
+          TF_HTTP_PASSWORD: ${{ secrets.ABBEY_TOKEN }}
+
+      - name: Terraform Show
+        id: show
+        run: echo "content=$(terraform show -no-color -json tfplan | jq '.variables.password |= "***" | tostring')" >> $GITHUB_OUTPUT
+
+      - name: Create comment
+        uses: peter-evans/create-or-update-comment@v2
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            ```json
+            ${{ fromJson(steps.show.outputs.content) }}
+            ```

.github/workflows/abbey-grant-kit-materialize.yaml

@@ -0,0 +1,35 @@
+name: Abbey Grant Kit Materialize
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  materialize:
+    runs-on: ubuntu-latest
+    env:
+      TF_VAR_abbey_token: ${{ secrets.ABBEY_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_wrapper: false
+
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        env:
+          TF_HTTP_USERNAME: quickstart
+          TF_HTTP_PASSWORD: ${{ secrets.ABBEY_TOKEN }}
+
+      - name: Terraform Apply
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        run: terraform apply -auto-approve -input=false
+        env:
+          TF_HTTP_USERNAME:   quickstart
+          TF_HTTP_PASSWORD:   ${{ secrets.ABBEY_TOKEN }}
+          TF_VAR_abbey_token: ${{ secrets.ABBEY_TOKEN }}

.gitignore

@@ -0,0 +1,40 @@
+# Created by https://www.toptal.com/developers/gitignore/api/terraform
+# Edit at https://www.toptal.com/developers/gitignore?templates=terraform
+
+### Terraform ###
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# End of https://www.toptal.com/developers/gitignore/api/terraform

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Abbey Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,15 @@
+# Abbey Starter Kit Quickstart Example
+
+This example shows how to create a single step Grant Kit workflow.
+The example features requesting access to a [Null Resource](https://registry.terraform.io/providers/hashicorp/null/latest).
+from multiple reviewers, requiring only `one_of` the reviewers to approve the access.
+
+## Usage
+
+Visit this [Starter Kit's docs](https://docs.abbey.io/getting-started/quickstart) for a short usage walkthrough.
+
+## :books: Learn More
+
+To learn more about Grant Kits and Grant Workflows, visit the following resources:
+
+-   [Abbey Labs Documentation](https://docs.abbey.io) - learn about automating access management with Abbey Labs.

main.tf

@@ -0,0 +1,69 @@
+terraform {
+  backend "http" {
+    address        = "https://api.abbey.io/terraform-http-backend"
+    lock_address   = "https://api.abbey.io/terraform-http-backend/lock"
+    unlock_address = "https://api.abbey.io/terraform-http-backend/unlock"
+    lock_method    = "POST"
+    unlock_method  = "POST"
+  }
+
+  required_providers {
+    abbey = {
+      source = "abbeylabs/abbey"
+      version = "0.2.3"
+    }
+  }
+}
+
+provider "abbey" {
+  # Configuration options
+  bearer_auth = var.abbey_token
+}
+
+resource "abbey_grant_kit" "abbey_demo_site" {
+  name = "Abbey_Demo_Site"
+  description = <<-EOT
+    Grants access to Abbey's Demo Page.
+    This Grant Kit uses a single-step Grant Workflow that requires only a single reviewer
+    from a list of reviewers to approve access.
+  EOT
+
+  workflow = {
+    steps = [
+      {
+        reviewers = {
+          one_of = ["replace-me@example.com"] # CHANGEME
+        }
+      }
+    ]
+  }
+
+  policies = [
+    { bundle = "github://replace-me-with-organization/replace-me-with-repo/policies" } # CHANGEME
+  ]
+
+  output = {
+    # Replace with your own path pointing to where you want your access changes to manifest.
+    # Path is an RFC 3986 URI, such as `github://{organization}/{repo}/path/to/file.tf`.
+    location = "github://replace-me-with-organization/replace-me-with-repo/access.tf" # CHANGEME
+    append = <<-EOT
+      resource "abbey_demo" "grant_read_write_access" {
+        permission = "read_write"
+        email = "{{ .data.system.abbey.abbey_identity }}"
+      }
+    EOT
+  }
+}
+
+resource "abbey_identity" "user_1" {
+  name = "User 1"
+
+  linked = jsonencode({
+    abbey = [
+      {
+        type  = "AuthId"
+        value = "replace-me@example.com" # CHANGEME
+      }
+    ]
+  })
+}

policies/common/.manifest

@@ -0,0 +1 @@
+{"roots": ["common"]}

policies/common/common.rego

@@ -0,0 +1,8 @@
+package common
+
+import data.abbey.functions
+
+allow[msg] {
+    functions.expire_after("0m")
+    msg := "granting access for 0 minutes"
+}

variables.tf

@@ -0,0 +1,5 @@
+variable "abbey_token" {
+  type = string
+  sensitive = true
+  description = "Abbey API Token"
+}