---
page_title: "Wiz Provider"
description: |-
  Terraform provider to manage Wiz resources
---

# terraform-provider-wiz

The Wiz Terraform provider is designed to work with [Wiz](https://wiz.io/). 

The "wiz" provider manages resources typically manually managed in the [Wiz web interface](https://app.wiz.io/).  You must configure the provider with the proper credentials before you can use it.

Use the navigation to the left to read about the available resources.

## Example Usage

```terraform
terraform {
  required_providers {
    wiz = {
      source  = "AxtonGrams/wiz"
      version = "1.0.2"
    }
  }
}

provider "wiz" {
  wiz_url                = var.wiz_url
  wiz_auth_client_id     = var.wiz_auth_client_id
  wiz_auth_client_secret = var.wiz_auth_client_secret
  wiz_auth_audience      = "wiz-api"
}
```

> **WARNING** Hard-coded credentials are not recommended in any Terraform configuration and risks secret leakage should this file ever be committed to a public version control system.


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `wiz_auth_client_id` (String) Your application's Client ID. You can find this value on the Settings > Service Accounts page. (default: none, environment variable: WIZ_AUTH_CLIENT_ID)
- `wiz_auth_client_secret` (String, Sensitive) Your application's Client Secret. You can find this value on the Settings > Service Accounts page. (default: none, environment variable: WIZ_AUTH_CLIENT_SECRET)
- `wiz_url` (String) Wiz api endpoint.  This varies for each Wiz deployment.  See https://docs.wiz.io/wiz-docs/docs/using-the-wiz-api#the-graphql-endpoint. (default: none, environment variable: WIZ_URL)

### Optional

- `ca_chain` (String) Base64 encoded PEM of the CA chain used when communicating with Wiz. If a proxy performs TLS interception/inspection, this will be the CA chain for the certificate used by the proxy. The default includes the CAs known to be used by Wiz: `C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root`, `C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3`, `C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2`, `C=US, O=Amazon, CN=Amazon Root CA 1`, `C=US, O=Amazon, OU=Server CA 1B, CN=Amazon`. (environment variable: CA_CHAIN)
- `http_client_retry_max` (Number) Maximum retry attempts.
    - Defaults to `10`.
- `http_client_retry_wait_max` (Number) Maximum time to wait before retrying, in seconds.
    - Defaults to `10`.
- `http_client_retry_wait_min` (Number) Minimum time to wait before retrying, in seconds.
    - Defaults to `1`.
- `proxy` (Boolean) Use an http proxy server? (default: false, environment variable: PROXY)
- `proxy_server` (String) Proxy server address.  Syntax: http[s]://[host]:[port]. (default: none, environment variable: PROXY_SERVER)
- `wiz_auth_audience` (String) Set this to 'beyond-api' if using auth0 and 'wiz-api' if using Cognito. (default: wiz-api, environment variable: WIZ_AUTH_AUDIENCE)
- `wiz_auth_grant_type` (String) Set this to 'client_credentials'. (default: client_credentials, environment variable: WIZ_AUTH_GRANT_TYPE)
- `wiz_auth_url` (String) The authentication endpoint. (default: https://auth.app.wiz.io/oauth/token, environment variable: WIZ_AUTH_URL)