---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "orcasecurity_integration_zscaler_zpa Resource - orcasecurity"
subcategory: ""
description: |-
  Manage a Zscaler ZPA integration in Orca.
---

# orcasecurity_integration_zscaler_zpa (Resource)

Manages a [Zscaler ZPA](https://www.zscaler.com/products-and-solutions/zscaler-private-access)
integration in Orca Security.

Under the hood this creates an entry under `POST /api/external_service/config`
with `service_name = "zscaler"`. The OAuth `client_id` and `client_secret` are
stored in Orca's secret store and are never returned by the API.

## Example Usage

### Basic example

```terraform
# Zscaler ZPA integration
resource "orcasecurity_integration_zscaler_zpa" "example" {
  template_name = "template_name"
  vanity_domain = "vanity_domain"
  client_id     = var.zscaler_client_id
  client_secret = var.zscaler_client_secret
  is_enabled    = true
  is_default    = false
}
```

### Sourcing credentials from HashiCorp Vault

```terraform
data "vault_generic_secret" "zpa" {
  path = "secret/zscaler-zpa/orca"
}

resource "orcasecurity_integration_zscaler_zpa" "from_vault" {
  template_name = "zpa-prod"
  vanity_domain = "acme"
  client_id     = data.vault_generic_secret.zpa.data["client_id"]
  client_secret = data.vault_generic_secret.zpa.data["client_secret"]
}
```

## Argument Reference

* `template_name` — (Required, String) Identifier for the integration as shown
  in the Orca UI. Changing this forces a new resource.
* `vanity_domain` — (Required, String) Customer-specific tenant identifier
  used in the Zscaler OAuth URL.
* `client_id` — (Required, String, Sensitive) Zscaler OAuth `client_id`.
* `client_secret` — (Required, String, Sensitive) Zscaler OAuth `client_secret`.
* `is_enabled` — (Optional, Bool) Defaults to `true`.
* `is_default` — (Optional, Bool) Defaults to `false`.

## Attribute Reference

* `id` — (String) Orca external service config identifier (UUID).

## Notes

* Orca strips `client_id` and `client_secret` from `GET` responses (stored in
  SSM). The provider keeps the values already in Terraform state to avoid
  permanent diffs. Rotate through `terraform apply`; for out-of-band rotation
  use `terraform apply -replace=orcasecurity_integration_zscaler_zpa.example`.
* Use an encrypted remote backend (S3 + KMS, GCS, Terraform Cloud, etc.) and
  restrict read access to the state — the secrets land in state regardless of
  the `sensitive = true` flag.

## Import

```bash
terraform import orcasecurity_integration_zscaler_zpa.example template_name
```

After import, set `client_id` and `client_secret` in your configuration — the
API does not return them.