deevnet_iot_broker_account (Resource) #

An MQTT account on the platform broker, for one of the tenant’s devices or workloads.

Configure the client with username and password.

Replacing this resource issues a new password, and anything already holding the old one stops connecting. A rebuilt API does not do that: it restores the account from this state. Use -replace only when you mean to revoke.

Example Usage #

resource "deevnet_iot_broker_account" "stand" {
  tenant = deevnet_tenant.this.name
  name   = "stand-1"
  device = deevnet_iot_device.stand.name

  # Relative to the tenant. The API writes the "tdemo/" prefix itself, which is
  # what confines a tenant to its own topics.
  publish   = ["lightstand/+/telemetry"]
  subscribe = ["lightstand/+/command"]
}

output "broker" {
  value = {
    username = deevnet_iot_broker_account.stand.username
    password = deevnet_iot_broker_account.stand.password
    # What the broker actually enforces, prefix and all.
    publish = deevnet_iot_broker_account.stand.granted_publish
  }
  sensitive = true
}

Schema #

Required #

• name (String) A label for the account, unique within the tenant.
• tenant (String) The tenant this broker account belongs to: the name of a deevnet_tenant.

Optional #

• device (String) A device in the tenant’s registry, in trust class iot. Omit for an account a tenant workload uses. iot_vendor is refused: the standard forbids those devices reaching the broker at all, so the account could never be used.
• publish (List of String) Topic patterns this account may publish to, relative to the tenant: write lightstand/+/scene, not eds/lightstand/+/scene. The API writes the prefix, which is what confines a tenant to its own topics.

May be omitted for an account that only subscribes. Omitting both is an error: the account could do nothing.

• subscribe (List of String) Topic patterns this account may subscribe to, relative to the tenant. # means the tenant’s whole tree, and no more.

Read-Only #

• granted_publish (List of String) What the broker actually enforces: the publish patterns with the tenant prefix written in.
• granted_subscribe (List of String) What the broker actually enforces: the subscribe patterns with the tenant prefix written in.
• password (String, Sensitive) The password to configure the client with. Generated by the API, which keeps only a hash of it — this state is the only copy.
• present (Boolean) Whether the API still holds this account.
• status (String) ready once the account is on the broker.
• username (String) The username to configure the client with. Derived by the API as <tenant>-<name>.