Temporary DBA Access

# Response template — surfaces SQL Server credentials
resource "britive_resource_manager_response_template" "sql_creds" {
name                     = "SQLServer-DBA-Credentials"
description              = "Returns SQL Server login and password on checkout"
show_on_ui               = true
is_console_access_enabled = false
template_data            = "Server: {{SERVER}}\nDatabase: {{DATABASE}}\nLogin: {{LOGIN_NAME}}\nPassword: {{PASSWORD}}"
}

# Resource type — defines the SQLServer class
resource "britive_resource_manager_resource_type" "sql" {
name        = "SQLServer"
description = "Microsoft SQL Server instance"

parameters {
  param_name   = "SERVER_NAME"
  param_type   = "string"
  is_mandatory = true
}
parameters {
  param_name   = "DATABASE_NAME"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — temp DBA checkout/checkin (Bash variant)
resource "britive_resource_manager_resource_type_permission" "sql_dba" {
name             = "SQLServer-TempDBA"
resource_type_id = britive_resource_manager_resource_type.sql.id
description      = "JIT db_owner access via temporary SQL Server login"
code_language    = "Shell"

checkout_code_file = "${path.module}/scripts/checkout.sh"
checkin_code_file  = "${path.module}/scripts/checkin.sh"

variables          = ["EMAIL", "SERVER_NAME", "DATABASE_NAME", "ADMIN_USER", "ADMIN_PASSWORD"]
response_templates = [britive_resource_manager_response_template.sql_creds.name]
}

# Resource label — categorize by environment
resource "britive_resource_manager_resource_label" "env" {
name        = "environment"
description = "Deployment environment"
label_color = "#2563eb"

values { name = "Production";  description = "Production instances" }
values { name = "Staging";     description = "Staging instances" }
}

# Resource — a specific SQL Server instance
resource "britive_resource_manager_resource" "sql_prod" {
name          = "sqlserver-prod"
description   = "Production SQL Server"
resource_type = britive_resource_manager_resource_type.sql.name

parameter_values = {
  SERVER_NAME   = "sql.internal"
  DATABASE_NAME = "AppDatabase"
}

resource_labels = {
  environment = "Production"
}
}

# Profile — JIT DBA access profile
resource "britive_resource_manager_profile" "sql_dba" {
name                = "SQLServer-DBA-Access"
description         = "JIT db_owner access to SQL Server database"
expiration_duration = 7200000   # 2 hours in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission
resource "britive_resource_manager_profile_permission" "sql_dba" {
profile_id = britive_resource_manager_profile.sql_dba.id
name       = britive_resource_manager_resource_type_permission.sql_dba.name
version    = "latest"

variables {
  name              = "ADMIN_USER"
  value             = "britive_svc"
  is_system_defined = false
}
}

# Profile policy — with approval for db_owner
resource "britive_resource_manager_profile_policy" "sql_dba" {
profile_id  = britive_resource_manager_profile.sql_dba.id
policy_name = "SQLServer-DBA-Policy"

members = jsonencode({
  tags             = [{ name = "dba-team" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition = jsonencode({
  approval = {
    approvers          = { tags = ["dba-managers"], userIds = [] }
    notificationMedium = ["Email"]
    timeToApprove      = 30
    validFor           = 120
    isValidForInDays   = false
  }
  ipAddress    = null
  timeOfAccess = null
})

access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}