---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "chainguard_identity Resource - terraform-provider-chainguard"
subcategory: ""
description: |-
  IAM Identity in the Chainguard platform.
---

# chainguard_identity (Resource)

IAM Identity in the Chainguard platform.

## Example Usage

```terraform
resource "chainguard_identity" "user" {
  parent_id   = "foo/bar"
  name        = "user"
  description = "example"
  claim_match {
    issuer   = "https://accounts.google.com"
    subject  = "foo"
    audience = "https://console-api.enforce.dev"
  }
}

resource "chainguard_identity" "aws-user" {
  parent_id   = "foo/other"
  name        = "aws-identity"
  description = "literal match to aws-identity"

  aws_identity {
    aws_account = "123456789012"
    aws_user_id = "AROAWSXXXXXXXXX:bob@example.com"
    aws_arn     = "arn:aws:sts::123456789012:assumed-role/example-role/bob@example.com"
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) The name of this identity.
- `parent_id` (String) The id of the group containing this identity.

### Optional

- `aws_identity` (Block, Optional) An identity that may be assumed by an AWS identity satisfying the following contains on its GetCallerIdentity values (see [below for nested schema](#nestedblock--aws_identity))
- `claim_match` (Block, Optional) An identity that may be assumed when its claims satisfy these constraints. (see [below for nested schema](#nestedblock--claim_match))
- `description` (String) A longer description of the purpose of this identity.
- `service_principal` (String) An identity that may be assumed by a particular Chainguard service.
- `static` (Block, Optional) An identity that is verified by OIDC, with pre-registered verification keys. (see [below for nested schema](#nestedblock--static))

### Read-Only

- `created_at` (String) The RFC3339 encoded time this identity was created.
- `id` (String) The id of this identity.
- `last_seen` (String) The RFC3339 encoded time this identity was last used to federate.
- `updated_at` (String) The RFC3339 encoded time this identity was last updated.

<a id="nestedblock--aws_identity"></a>
### Nested Schema for `aws_identity`

Optional:

- `aws_account` (String) AWS Account ID of AWS user
- `aws_arn` (String) The exact Arn that must appear in GetCallerIdentity to assume this identity.
- `aws_arn_pattern` (String) A pattern for matching acceptable Arn that must appear in GetCallerIdentity response to assume this identity.
- `aws_user_id` (String) The exact UserId that must appear in GetCallerIdentity to assume this identity.
- `aws_user_id_pattern` (String) A pattern for matching acceptable UserID that must appear in GetCallerIdentity response to assume this identity.


<a id="nestedblock--claim_match"></a>
### Nested Schema for `claim_match`

Optional:

- `audience` (String) The exact audience that must appear in tokens to assume this identity.
- `audience_pattern` (String) A pattern for matching acceptable audiences that appear in tokens to assume this identity.
- `claim_patterns` (Map of String) The custom claim patterns for matching acceptable custom claims that appear in tokens to assume this identity.
- `claims` (Map of String) The exact custom claims that appear in tokens to assume this identity.
- `issuer` (String) The exact issuer that must appear in tokens to assume this identity.
- `issuer_pattern` (String) A pattern for matching acceptable issuers that appear in tokens to assume this identity.
- `subject` (String) The exact subject that must appear in tokens to assume this identity.
- `subject_pattern` (String) A pattern for matching acceptable subjects that appear in tokens to assume this identity.


<a id="nestedblock--static"></a>
### Nested Schema for `static`

Optional:

- `expiration` (String) The RFC3339 encoded date and time at which this identity will no longer be valid.
- `issuer` (String) The exact issuer that must appear in tokens to assume this identity.
- `issuer_keys` (String) The JSON web key set (JWKS) of the OIDC issuer that should be used to verify tokens.
- `subject` (String) The exact subject that must appear in tokens to assume this identity.