Temporary Database User

# Response template — surfaces Atlas credentials
resource "britive_resource_manager_response_template" "atlas_creds" {
name                     = "Atlas-Database-Credentials"
description              = "Returns Atlas username and password on checkout"
show_on_ui               = true
is_console_access_enabled = false
template_data            = "Username: {{username}}\nPassword: {{password}}"
}

# Resource type — defines the MongoDBAtlas class
resource "britive_resource_manager_resource_type" "atlas" {
name        = "MongoDBAtlas"
description = "MongoDB Atlas project"

parameters {
  param_name   = "project_id"
  param_type   = "string"
  is_mandatory = true
}
parameters {
  param_name   = "cluster_name"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — Atlas API checkout/checkin routines
resource "britive_resource_manager_resource_type_permission" "atlas_user" {
name             = "Atlas-TempDatabaseUser"
resource_type_id = britive_resource_manager_resource_type.atlas.id
description      = "JIT Atlas database user via Atlas API"
code_language    = "Shell"

checkout_code_file = "${path.module}/scripts/checkout.sh"
checkin_code_file  = "${path.module}/scripts/checkin.sh"

variables          = ["atlas_username", "client_id", "client_secret", "project_id", "db_checkout_role", "db_checkout_database"]
response_templates = [britive_resource_manager_response_template.atlas_creds.name]
}

# Resource label — categorize by environment
resource "britive_resource_manager_resource_label" "env" {
name        = "environment"
description = "Deployment environment"
label_color = "#2563eb"

values { name = "Production";  description = "Production Atlas projects" }
values { name = "Staging";     description = "Staging Atlas projects" }
}

# Resource — a specific Atlas project
resource "britive_resource_manager_resource" "atlas_prod" {
name          = "atlas-prod"
description   = "Production MongoDB Atlas project"
resource_type = britive_resource_manager_resource_type.atlas.name

parameter_values = {
  project_id   = "your-atlas-project-id"
  cluster_name = "prod-cluster"
}

resource_labels = {
  environment = "Production"
}
}

# Profile — JIT Atlas access profile
resource "britive_resource_manager_profile" "atlas" {
name                = "MongoDB-Atlas-Access"
description         = "JIT temporary database user in MongoDB Atlas"
expiration_duration = 7200000   # 2 hours in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission — link profile to the Atlas permission
resource "britive_resource_manager_profile_permission" "atlas" {
profile_id = britive_resource_manager_profile.atlas.id
name       = britive_resource_manager_resource_type_permission.atlas_user.name
version    = "latest"

variables {
  name              = "db_checkout_role"
  value             = "readAnyDatabase"
  is_system_defined = false
}
variables {
  name              = "db_checkout_database"
  value             = "mydb"
  is_system_defined = false
}
variables {
  name              = "client_id"
  value             = "your-atlas-service-account-client-id"
  is_system_defined = false
}
}

# Profile policy — who can check out
resource "britive_resource_manager_profile_policy" "atlas" {
profile_id  = britive_resource_manager_profile.atlas.id
policy_name = "Atlas-Access-Policy"

members = jsonencode({
  tags             = [{ name = "data-engineers" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition   = jsonencode({ ipAddress = null, timeOfAccess = null })
access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}