Support Dynamic OS Version Compliance for Device Assurance Policies

[lucascantor]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Feature request to support the new Dynamic OS version compliance feature for Device Assurance

Here is an example Device Assurance policy, with settings NOT configurable via Terraform:

• OS version must be at least the second latest supported major version of Android
• OS must be up-to-date with security patches

New or Affected Resource(s)

• okta_device_assurance_policy_android
• okta_device_assurance_policy_ios
• okta_device_assurance_policy_macos
• okta_device_assurance_policy_windows

Potential Terraform Configuration

resource "okta_policy_device_assurance_android" "example" {
  name                        = "Example"
  os_version_dynamic_minimum  = "LATEST_SUPPORTED"
  os_patches_required         = true
}

resource "okta_policy_device_assurance_ios" "example" {
  name                        = "Example"
  os_version_dynamic_minimum  = "SECOND_LATEST_SUPPORTED"
  os_patches_required         = true
}

resource "okta_policy_device_assurance_macos" "example" {
  name                 = "Example"
  os_version_dynamic   = "ANY_SUPPORTED"
  os_patches_required  = true
}

resource "okta_policy_device_assurance_windows" "example" {
  name                   = "Example"
  os_version_dynamic_11  = "ANY_SUPPORTED"
  os_patches_required_11 = true
  os_version_dynamic_10  = "NOT_ALLOWED"
}

References

• See Dynamic OS version compliance under Device assurance conditions at https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/device-assurance-add.htm?cshid=csh-device-assurance-add

[duytiennguyen-okta]

OKTA internal reference https://oktainc.atlassian.net/browse/OKTA-705818

[lucascantor]

Okta's Terraform provider should also support the new grace period functionality, which is part of the Configure Remediation section: https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/device-assurance-add.htm?cshid=csh-device-assurance-add#Configur

Relates to #2097