English

Aikido Terraform Provider

Use the official Aikido Terraform provider to manage Aikido resources as code through the management API. This is useful if you already provision infrastructure with Terraform and want repository activation, AutoFix settings, and PR checks to follow the same workflow.

The provider is published on both the Terraform Registry and the OpenTofu Registry, so it works with Terraform and OpenTofu. Full resource schemas, arguments, and import syntax live in the Terraform Registry documentation.

What you can manage

The provider currently supports:

  • Repositories: Activate or deactivate existing code repositories, and set sensitivity, connectivity, and labels
  • AutoFix settings: Configure workspace AutoFix for dependencies, SAST, and Aikido Pentest findings
  • PR checks: Configure pull request gating per repository (severity thresholds, scan types, inline comments, Deep Review)
  • Teams and Permissions: setup teams and user permissions
  • Teams and resource mapping: map repos and containers to teams
  • Repo/Team Mapping to Task Trackers

The provider manages configuration for repositories that already exist in Aikido (synced from your Git provider). It does not create Git repositories or connect new Git integrations.

Requirements

Set up the provider

  1. Create API credentials

    1. Go to the Aikido REST API integration page.
    2. Create a client ID and client secret.
    3. Store the secret securely. You will not be able to view it again after you leave the page.

    See the API authorization docs for more detail on how Aikido authenticates API clients.

  2. Declare the provider

    Add the provider to your Terraform configuration, then run terraform init:

    main.tf
    terraform {
  required_providers {
    aikido = {
      source  = "AikidoTerraform/aikido"
      version = "~> 1.1"
    }
  }
}

provider "aikido" {
  client_id     = var.aikido_client_id
  client_secret = var.aikido_client_secret
}

    You can also pass credentials with environment variables instead of hardcoding them:

    • AIKIDO_CLIENT_ID
    • AIKIDO_CLIENT_SECRET

    When those are set, you can use an empty provider block:

    provider "aikido" {}

  3. Target your Aikido region (optional)

    By default, the provider uses the EU API (https://app.aikido.dev/api). If your workspace is hosted in another region, set base_url (or the AIKIDO_BASE_URL environment variable) to match the app URL you use to log in:

    Aikido login URLExample base_url
    app.aikido.devhttps://app.aikido.dev/api (default)
    app.us.aikido.devhttps://app.us.aikido.dev/api
    app.au.aikido.devhttps://app.au.aikido.dev/api
    app.me.aikido.devhttps://app.me.aikido.dev/api
    provider "aikido" {
  client_id     = var.aikido_client_id
  client_secret = var.aikido_client_secret
  base_url      = "https://app.us.aikido.dev/api"
}

Example configuration

resource "aikido_repository" "app" {
  id     = "12345"
  active = true

  sensitivity  = "sensitive"
  connectivity = "connected"

  labels = ["payments", "production"]
}

resource "aikido_autofix_dependency_settings" "workspace" {
  enabled                      = true
  severity_filter              = "critical_and_high_only"
  repos_scope                  = "all"
  use_aikido_library_for_major = true
}

resource "aikido_repo_pr_checks_settings" "app" {
  code_repo_id = 12345

  minimum_severity                  = "high"
  fail_on_dependency_scan            = true
  fail_on_sast_scan                  = true
  fail_on_iac_scan                   = true
  fail_on_secrets_scan               = true
  fail_on_malware_scan               = true
  post_inline_comments_min_severity  = "critical"

  minimum_license_severity = "high"

  fail_on_code_quality_scan                      = true
  enable_code_quality_scan                       = true
  post_code_quality_inline_comments_min_severity = "medium"
}

For every argument, import ID, and resource-specific behavior, use the official docs:

Terraform Registry docs OpenTofu Registry