🏗️Get Started with the P0 Terraform Provider

Configure the P0 Terraform provider, authenticate with an API token, and install your first integration as code with an end-to-end AWS just-in-time access example.

This guide shows you how to manage P0 integrations as code with the P0 Terraform provider. You configure the provider, authenticate with a P0 API token, and install an AWS account for just-in-time (JIT) access from end to end. By the end, you have a working Terraform configuration that you can extend to any P0 integration.

Managing P0 with Terraform keeps your access infrastructure version-controlled, reviewable, and repeatable across environments—the same workflow your team already uses for the rest of your cloud.

Steps to complete

1. Generate a P0 API key

2. Configure the P0 provider

3. Initialize Terraform

4. Stage the AWS integration

5. Create the IAM role P0 uses

6. Finish the installation

7. Apply and verify

This process takes about 15 minutes, assuming you already have an AWS account and permission to create IAM roles.

Prerequisites

Before you begin, confirm the following:

• P0 account — You have an account at p0.app and the Owner role in your organization. You need the Owner role to generate API keys.

• Terraform 1.0 or later — Install the Terraform CLI and confirm the version with terraform version.

• AWS account — You have an AWS account and credentials with permission to create IAM roles, along with the AWS Terraform provider configured in your project.

Generate a P0 API key

The provider authenticates to P0 with an API key, supplied as an API token.

1. Follow Generating an API key to create a key in the P0 dashboard.

2. Copy the key when it appears. P0 shows the key only once.

3. Export the key as the P0_API_TOKEN environment variable so the provider can read it:

   export P0_API_TOKEN="your-api-key"

Never commit your API key to version control. Use an environment variable or a secrets manager, and rotate keys regularly.

Configure the P0 provider

Declare the provider in a .tf file. The source is p0-security/p0, and the org attribute is your P0 organization identifier.

terraform {
  required_providers {
    p0 = {
      source  = "p0-security/p0"
      version = "~> 0.40"
    }
  }
}

provider "p0" {
  org = "my-org"
}

The provider reads your API token from the P0_API_TOKEN environment variable set in the previous step. To pass the token explicitly instead, set the api_token attribute—but prefer the environment variable to keep secrets out of your configuration.

Initialize Terraform

Download the provider and prepare your working directory:

terraform init

Terraform installs the P0 provider and reports Terraform has been successfully initialized!.

Stage the AWS integration

P0 installs an AWS integration in two phases. First, you stage the account so P0 can generate the trust policy and inline policy for the IAM role it uses to manage access.

Add the p0_aws_iam_write_staged resource with your AWS account ID:

resource "p0_aws_iam_write_staged" "prod" {
  id = "123456789012"
}

After you apply this resource, it exposes a role attribute that has the role name, trust policy, and inline policy that AWS requires in the next step.

Create the IAM role P0 uses

Create the AWS IAM role from the staged outputs. P0 assumes this role to manage just-in-time access in your account.

resource "aws_iam_role" "p0_iam_manager" {
  name               = p0_aws_iam_write_staged.prod.role.name
  assume_role_policy = p0_aws_iam_write_staged.prod.role.trust_policy

  inline_policy {
    name   = p0_aws_iam_write_staged.prod.role.inline_policy_name
    policy = p0_aws_iam_write_staged.prod.role.inline_policy
  }
}

Complete the installation

Complete the installation with the p0_aws_iam_write resource. The depends_on argument ensures Terraform creates the IAM role before P0 verifies the installation.

resource "p0_aws_iam_write" "prod" {
  id         = p0_aws_iam_write_staged.prod.id
  depends_on = [aws_iam_role.p0_iam_manager]

  login = {
    type = "iam"
    identity = {
      type = "email"
    }
  }
}

The login block tells P0 how users sign in to the account. This example uses IAM login with email-based identity matching, where each IAM user name is the user's email address. For Identity Center or federated login options, see the p0_aws_iam_write resource reference.

Apply and verify

Apply the full configuration:

terraform apply

Review the plan and confirm. Terraform stages the account, creates the IAM role, and finalizes the integration in dependency order.

To verify the installation succeeded, check the resource state:

terraform state show p0_aws_iam_write.prod

The state attribute reads installed when the integration is fully active:

state = "installed"

You can also open Integrations in the P0 dashboard and confirm the AWS account appears as installed. Users can now request just-in-time access to the account. See Requesting AWS access for the request workflow.

Full example

The following configuration installs an AWS account for just-in-time access from end to end:

terraform {
  required_providers {
    p0 = {
      source  = "p0-security/p0"
      version = "~> 0.40"
    }
  }
}

provider "p0" {
  org = "my-org"
}

# Step 1: Stage the account and generate the IAM policies P0 needs.
resource "p0_aws_iam_write_staged" "prod" {
  id = "123456789012"
}

# Step 2: Create the IAM role P0 assumes to manage access.
resource "aws_iam_role" "p0_iam_manager" {
  name               = p0_aws_iam_write_staged.prod.role.name
  assume_role_policy = p0_aws_iam_write_staged.prod.role.trust_policy

  inline_policy {
    name   = p0_aws_iam_write_staged.prod.role.inline_policy_name
    policy = p0_aws_iam_write_staged.prod.role.inline_policy
  }
}

# Step 3: Finalize the installation after the role exists.
resource "p0_aws_iam_write" "prod" {
  id         = p0_aws_iam_write_staged.prod.id
  depends_on = [aws_iam_role.p0_iam_manager]

  login = {
    type = "iam"
    identity = {
      type = "email"
    }
  }
}

Once p0_aws_iam_write.prod reaches the installed state, your AWS account is managed entirely as code. Commit the configuration to version control and reuse it across accounts and environments.

Troubleshooting

Issue	Cause	Fix
terraform init fails to find the provider	The source is wrong	Confirm the source is p0-security/p0 and run terraform init again.
Authentication or 401 errors on apply	The API token or org is wrong	Confirm P0_API_TOKEN is exported in your shell and that org matches your P0 organization identifier.
Apply fails creating the IAM role	The AWS provider lacks permission to create roles	Confirm your AWS credentials allow iam:CreateRole and iam:PutRolePolicy.
p0_aws_iam_write stays in the configure state	The IAM role was not created before finalizing	Keep the depends_on argument so Terraform creates the role first, then run terraform apply again.

Next steps

• Install more integrations — The provider supports AWS, Google Cloud, Azure, SSH, Kubernetes, databases, SIEM exports, and more. Browse the full resource catalog in the Terraform Registry.

• Install Kubernetes access — For EKS clusters, see Terraform installation.

• Manage access policies as code — Define request routing and approvals with the p0_routing_rule resource. See Configure access policies for the concepts.