Terraform for GitLab

Use this integration to collect evidence from your Git repositories

Written By Micah

Use Terraform for GitLab to collect evidence from your GitLab projects, repos, branches, and more.

With our Terraform for GitLab integration, you can collect evidence of your git settings and configurations directly from GitLab. Terraform integrations are a flexible, low-code solution that allow you to customize what evidence is collected from your cloud systems. Read more about our Terraform integrations.

Types of evidence you might collect with Terraform for GitLab

There are a lot of different types of evidence that you can collect from GitLab. The flexibility of this integration is limited only by what is available from Terraform in terms of data sources supported by the GitLab provider.

Important note: You do not need to use Terraform in your tech stack in order to use Terraform for GitLab to collect evidence.

Here is a short, non-exhaustive list of some of the possible evidence you may collect from this integration:

  • User access lists for your code repositories

  • Protected branch settings

  • Project compliance requirements

  • Artifacts from your CI/CD pipelines

Follow the instructions on this page to get started collecting evidence from GitLab using Terraform.

Configuring Terraform for GitLab

To configure the Terraform integration with GitLab, you (or someone in your organization) will need access and permissions to create personal, group, or project access tokens.

This integration only requires read_api access, and it's recommended to scope the access token for least privilege. Tokens do not need an expiration date, however if you do set an expiration date and your token expires, you can reconnect the integration with a new token at a future date.

Navigating to the Integration Manager in Strike Graph and open the Terraform for GitLab integration. Note: if you do not see this integration listed, it may not be available for your organization or role yet; reach out to support or your Customer Success Manager to request access.

Click on the “+ Connect” button to begin configuring a new integration.

Enter the token name and value into the provided fields, and click Save. Note: the token name is used in list of available integration during evidence upload, and does not need to match the name used to generate the token itself, so feel free to use a meaningful name if necessary.

You can create as many GitLab connections as you need, so that you can manage the scope integrations as necessary. Please note that everyone with access to your GRC organization will be able to use any configured GitLab connections during evidence collection.

Using Terraform for GitLab to collect evidence

Once you have configured a Terraform for GitLab integration, you can begin using it to collect evidence of your GitLab resources.

Start by navigating in Strike Graph to the item that you want to collect evidence for. You can choose to attach evidence directly for one time evidence collection, or configure automated collection (recommended).

Click on either one of the options, and then select the desired Terraform for GitLab integration from the list of available integrations. If you have configured multiple Terraform for GitLab integrations, make sure you select the one with the right permissions for the evidence that you plan to collect.

Define the data to collect

Terraform integrations allow you to use a few lines of code to define what data you would like to collect as evidence. These are called “data blocks” and more information about data blocks and local values can be found on the Terraform overview page.

With Terraform for Google Cloud Platform, you can collect evidence of GitLab settings that you use in your code repositories from supported data sources. There is a list of which data sources may be available at the bottom of this page, as well as on the Terraform GitLab provider page (data sources are listed under the sections on the left side of the page).

Step 1: Define the data block. Data blocks are extensible, but follow a typical pattern:

  • data_source: this defines which GitLab setting we should read from. Terraform for GitLab supports data collection from any resource with a supported data source from Terraform's GitLab provider (see below for a list).

  • temp_name: this is a temporary name you define and is used to refer to this data block during execution. It only has labeling significance within the scope of this configuration. The temp name is used in the output's filename, so it's recommended that you name it with something recognizable. Names can be repeated across configurations, are limited to alphanumeric characters, and do not allow spaces.

  • query constraints / arguments – Many data sources require specific argument(s) to be included (like the name of the resource you're pulling data from), or provide methods for constraining the data based on specific queries so that you can tailor the output. These are written as key/value pairs and can include multiple arguments as accepted by the data source. Refer to the specific data source requirements in the Terraform GitLab provider documentation.

Step 2: Define the local values used for the execution. This also follows a typical pattern that is derived from the data block: data.data_source.temp_name (sometimes followed by a key if a filter argument is desirable).

Run the data collection

After you have defined the data block and local values, click the "Attach" button to execute the data collection. This may take a few minutes as we set up the data pipeline to collect the attachment.

Once the collection is finished, the attachment modal will close and you can see the collected data has been added to the evidence. You can confirm what was collected by clicking on the attachment to view the data.

Using Terraform for GitLab with Automated Collection

It is highly recommended that you configure your evidence collection with automated collection. With Automated Collection, Strike Graph can recollect evidence attachments from GitLab a few days before expiration so that your evidence remains in an effective 'audit ready' state.

To configure your evidence with Automated Collection, follow the steps above after clicking on the "Automated Collection" button found on the evidence item detail pages. Additional information about Automated Collection is available here.

Removing your Terraform for GitLab integration

You can remove the integration at any time. Please note that removing an integration does not delete any files that were attached using that integration. Removing an integration will also disrupt automated collection.

To remove:

  1. Go to the Integrations Manager and click on the Terraform for GitLab card to access the integration configurations.

  2. Click the "Deactivate" button next to your configuration.

Note: You may have access to remove integrations for other users on your team.

If you are fully removing access between Strike Graph and your GitLab system, you may also wish to delete the access token that you set up during configuration. Before deleting, verify that you are not using it for other purposes.

Troubleshooting

For additional Terraform troubleshooting tips, click here.

Terraform integrations will return an error if we were unable to execute the collection request. The errors returned will be different depending on which step of the collection failed.

Errors when setting up an integration

If you receive an error while setting up an integration, check if there is a specific error message at the top of the form. Possible errors include providing a project id that’s not associated with the credential configuration, or providing a malformed credential configuration (which would most likely be due to a copy+paste error).

General formatting errors

If the error message returned during evidence collection is pretty generic (like "Something went wrong") it may be a formatting issue. Check that your temp_name is formatted correctly (no spaces, only alphanumeric characters) and that there are not any other unexpected characters or formatting issues in the data block or local values.

Check permissions

If it is a permissions error, ensure that you have given your service account the necessary read-only permissions to access the resource.

Confirm the data_source requirements

Check that the resource you defined in the data_source is available from the GitLab Terraform provider, and ensure that you have included any required query constraints / arguments.

Confirm the local values

Confirm that the local values are formatted correctly. Typically, the local value should start with "data" (as described above) and include the data_source and temp_name. Check that the data_source and temp_name values are the same between the data block and local values.

The list of supported GitLab data sources

The following list is a snapshot of supported data sources from the GitLab Terraform provider. For up-to-date support and specific data source requirements, visit the Terraform documentation.