env0 applies your Terraform code to create resources in your own cloud account. Here you will learn how to give env0 the required permissions for that.

The exact steps depend on which cloud provider you are using.

Amazon Web Services (AWS)

env0 offers two ways for you to connect to your AWS account:

Using AWS Assume Role
Using IAM user credentials

Using AWS Assume Role

This role will be assumed by env0 to obtain credentials for Terraform.
It will require all permissions required by Terraform, including GetAccessKeyInfo.

Create an AWS IAM Role

Click on Roles -> Create Role
Under type of trusted entity select AWS Account
Under An AWS account ID, select 'An AWS account' and enter 913128560467. If you have a Self-hosted agent installation you should enter the AWS account ID where the agent is installed.
Select Require external ID
Enter an External ID. The value MUST be equal to your Organization ID.
Click Next:Permissions
Select AdministratorAccess or whatever policy required by your Terraform
Click Next:Review
Enter a name for the role, and click Create Role
Click on the Role you just created - We will need the Role ARN in subsequent steps.

📘
Assume Role Duration
If you like to edit the Duration of the Assume role, on the created Role screen, look for Maximum session duration and click Edit and select the relevant duration you would like.
When you create the credentials in env0, please make sure you select the correct duration as it need to be equal or less than the selected duration in AWS.

Add your Role ARN and External ID configuration to env0 (via CloudFormation)

You can use the following CloudFormation Template to create the AssumeRole

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  ExternalId:
    Type: String
    Default: external-id
Resources:
  AssumeRole:
    Type: AWS::IAM::Role
    Properties: 
      RoleName: Env0-AssumeRole
      Description: |
        Used by Env0 to automate the deployment of Infrastructure from a Verison Control System
      AssumeRolePolicyDocument: !Sub |
        {"Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": "sts:AssumeRole",
                    "Principal": {
                        "AWS": "913128560467"
                    },
                    "Condition": {
                        "StringEquals": {
                            "sts:ExternalId": "${ExternalId}"
                        }
                    }
                }
            ]
        }
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AdministratorAccess
      MaxSessionDuration: ${SessionDuration}
      Tags: 
        - Key: Owner
          Value: Env0
Outputs:
  ExternalId:
    Value: !Ref ExternalId
    Description: "ExternalID for Env0"
  AssumeRoleArn:
    Value: !GetAtt AssumeRole.Arn

and run the following AWS CLI command to deploy the CloudFormation Stack

aws cloudformation deploy \
--stack-name assume-role-env0 \
--template-file ./assume-role-env0.yml \
--capabilities CAPABILITY_NAMED_IAM \
--parameter-overrides ExternalId=YOUR_ORGANIZATION_ID SessionDuration=SESSION_DURATION

The RoleArn and ExternalId Will be available in the Outputs Tab of your CloudFormation Stack.

📘
For security reasons, the ExternalID is resolved on the backend to be your organization ID.

Add your Role ARN configuration to env0 (via Manual Configuration)

Go to the Settings page, and pick the "Credentials" tab
Under the Cloud Credentials section, click + Add Credential

Enter a name for the new credential.
Under "Type", pick "AWS Assumed Role".
Under "Role ARN", enter your role ARN.
Note that your External ID is pre-filled with your env0 Organization ID
Choose the duration for the deployment's assume role (Make sure it is equal or less than the duration you set in AWS)
Click Add
Go to the project for which you'd like to use this role, and then go to "Project Settings" -> Credentials" tab
Pick the credential you would like to use in this project, and then click on Save

2846 — Picking AWS credential for the project

📘
Change Assumed Role per Environment
If you'd like to override the project's Assumed Role, and use a different Assumed Role for a specific environment, you can create environment variables when deploying the environment, which will allow you to assume a different role.
Create a variable called ENV0_AWS_ROLE_ARN, and set its value to be the role.
To customize the duration per environment create a variable called ENV0_AWS_ROLE_DURATION, and set its value to be the duration in seconds.

Using AWS user credentials

Create IAM Role & Permissions

In order to connect your AWS account, you will need to create an IAM user with programmatic access. See this guide on how to do that. Make sure you save your Access Key ID and Secret Access Key.
You will need to grant this user the appropriate permissions in order to deploy the resources defined in your Terraform code.

Add Your Credentials to env0

Go to the Settings page, and pick the "Credentials" tab
Under the Cloud Credentials section, click + Add Credential

Enter a name for the new credential.
Under "Type", pick "AWS Access Keys".
Under "Access Key ID", enter your role ARN.
Under "Secret Access Key", enter the value of your Role's External ID
Click Add

📘
Secret Access Key in a Self-Hosted Agent
If your organization is managed in a Kubernetes Self-Hosted Agent, then you must reference to an existing AWS,GCP or Azure secret manager variable, instead of writing down the actual secret Secret Access Key. Read more here

Go to the project for which you'd like to use this role, and then go to "Project Settings" -> Credentials" tab
Pick the credential you would like to use in this project, and then click on Save

2854 — Picking AWS credential for the project

Google Cloud (GCP)

Create a Service Account

In order to connect your GCS account, you will need to create a Service Account Key. See this guide on how to create one. Make sure to save the JSON key contents.

Add Your Credentials to env0

Go to the Settings page, and pick the "Credentials" tab
Under the Cloud Credentials section, click + Add Credential

Enter a name for the new credential.
Under "Type", pick "Google Cloud Service Account".
Under "Project ID", enter your GCP project name (optional).
Under "Secret Account Key", Copy-paste the JSON key contents directly into the value of this variable
Click Add

📘
Secret Account Key in a Self-Hosted Agent
If your organization is managed in a Kubernetes Self-Hosted Agent, then you must reference to an existing AWS,GCP or Azure secret manager variable, instead of writing down the actual secret Secret Account Key. Read more here

Go to the project for which you'd like to use this role, and then go to "Project Settings" -> Credentials" tab
Pick the credential you would like to use in this project, and then click on Save

2834 — Picking GCP credential for project

Azure

Create a Service Principal

In order to access resources a Service Principal needs to be created in your Tenant.
It is easiest to do this via the AZ CLI.

First, make sure you are logged in:
```
az login
```
Follow the instructions to login.

Once logged in, your subscriptions will be returned:

[
  {
    "cloudName": "AzureCloud",
    "id": "2d7e700a-8793-45ff-ba0a-9d92d15edf56", // this is your Subscription ID
    "isDefault": "true",
    "name": "Pay-As-You-Go",
    "state": "Enabled",
    "tenantId": "e522969-635a-4327-8807-7f7aac328e82",
    "user": {
      "name": "[email protected]",
      "type": "user"
    }
  }
]

Next, set your active subscription:
```
az account set --subscription="${id}"
```

Then create a Service Principal for env0 to be able to deploy your terraform stack:

az ad sp create-for-rbac -n "${name-of-your-choice}"

That will return the metadata for your Service Principal:

{
  "appId": "2dc2b1b3-11dd-4eb5-845-84fc-5bda87620cea", // this is your Client ID
  "displayName": "who",
  "name": "http://who",
  "password": "ab735025-151e-4337-b154-b7833d6929a9",  // this is your Client Secret
  "tenant": "5c8c7547-dd3f-4750-a8d9-f2e04e6015ba"     // this is your Tenant ID
}

Add Your Credentials to env0

Go to the Settings page, and pick the "Credentials" tab
Under the Cloud Credentials section, click + Add Credential

Enter a name for the new credential.
Under "Type", pick "Azure Service Principal".
Under "Client ID", enter your service principal app ID.
Under "Client Secret", enter your service principal password.
Under "Subscription ID", enter your subscription ID.
Under "Tenant ID", enter your service principal tenant ID.
Click Add

📘
Client Secret in a Self-Hosted Agent
If your organization is managed in a Kubernetes Self-Hosted Agent, then you must reference to an existing AWS,GCP or Azure secret manager variable, instead of writing down the actual secret Client Secret. Read more here

Go to the project for which you'd like to use this role, and then go to "Project Settings" -> Credentials" tab
Pick the credential you would like to use in this project, and then click on Save

2860 — Picking Azure credential for project

Other Cloud Providers

If you are using Terraform to manage infrastructure in a different provider than the ones mentioned above, you will need to check the provider documentation to understand what authentication options the provider supports

Generally, you'll likely be able to simply use specific environment variables for authorization. Same as all the above options, you'll be able to separate your credentials into projects/environments as you see fit. Please See XXX for more info

Customising Cloud Authentication Per Environment

Generally, Cloud Credentials are defined per env0 project. Those are translated to environment variables at runtime (like AWS_ACCESS_KEY_ID and AWS_ACCESS_SECRET_KEY for AWS). If you'd like to specify different credentials for a specific environment, you could simply override those environment variables when deploying that environment

Kubernetes

env0 applies your Terraform code to create resources in your own Kubernetes cluster. Here you will learn how to give env0 the required permissions for that.

We support the major cloud provider managed clusters, as well as a general kubeconfig file.

👍
Easy Authentication for Terraform and Pulumi
While Helm and Kubernetes templates enjoy native support, env0 also enables seamless Kubernetes authentication integration within Terraform and Pulumi templates that connect to your cluster, as we are creating the kubeconfig file in the deployment container automatically.
Follow our code examples for Terraform and Pulumi for easy configuration.

Set Up Kubernetes Credential

Navigate into Organization Settings > Credentials
Under Deployment Credentials, click the + Add Credential button

Inside the opened modal, select the desired Kubernetes Cluster authentication method you like

Kubeconfig

If you want to allow connection to your custom cluster, you can do so by setting up a kubeconfig credential in the env0's UI.

Select the Kubernetes - Kubeconfig File credential from the Type dropdown, and paste your valid kubeconfig file.

📘
Constraints
Your kubeconfig should contain exactly one cluster, context and user. The current-context field must be provided, and match the given context.

Next, You'll need to associate the created credential with your project.

In your Project Settings, click on the Credentialstab. Then, check the Kubernetes checkbox and select the credential you created from the dropdown.

AWS EKS

Select the Kubernetes - AWS EKS Configuration credential from the Type dropdown. Then, insert your cluster name and region.

Next, You'll need to associate your EKS credential with your project.

In your Project Settings, click on the Credentialstab. Then, check the Kubernetes checkbox and select the credential you created from the dropdown.

📘
Credentials
In order to access your cluster, you'll also need to set valid AWS credentials.

GCP GKE

Select the Kubernetes - GCP GKE Configuration credential from the Type dropdown. Then, insert your cluster name and region.

Next, You'll need to associate the GKE credential with your project.

In your Project Settings, click on the Credentialstab. Then, check the Kubernetes checkbox and select the credential you created from the dropdown.

📘
Credentials
In order to access your cluster, you'll also need to set valid GCP credentials.

Azure AKS

Select the Kubernetes - Azure AKS Configuration credential from the Type dropdown. Then, insert your cluster name and resource group.

Next, You'll need to associate the AKS credential with your project.

In your Project Settings, click on the Credentialstab. Then, check the Kubernetes checkbox and select the credential you created from the dropdown.

📘
Credentials
In order to access your cluster, you'll also need to set valid Azure credentials.