terraform-provider-arin
arin terraform provider
Star 0
Fork 0
Watch
58 1 6
Files
.github
arin
cmd
docs
examples
provider
.envrc
.gitignore
.goreleaser.yml
.mailmap
atelier.toml
flake.lock
flake.nix
go.mod
go.sum
gomod2nix.toml
license.txt
readme.md
terraform-registry-manifest.json
version.txt
readme.md

Terraform Provider: ARIN #

Manage ARIN RPKI objects (ROAs and ASPAs) and IRR objects (route, aut-num, as-set, route-set) with Terraform or OpenTofu via the ARIN RPKI RESTful API and the IRR RESTful API.

Resources: arin_roa, arin_aspa, arin_irr_route, arin_irr_aut_num, arin_irr_as_set, arin_irr_route_set, arin_net (adopt only), arin_delegation (modify only). Data sources: arin_roas, arin_aspas, arin_irr_routes, arin_irr_aut_nums, arin_irr_as_sets, arin_irr_route_sets, arin_net, arin_delegation, arin_org, arin_poc. See examples/main.tf for usage.

Install #

From the Terraform Registry:

terraform {
  required_providers {
    arin = {
      source = "stepbrobd/arin"
    }
  }
}

Releases are cut from version.txt bumps on master: the release workflow tags v<version>, builds multi-platform artifacts with goreleaser, and signs the checksums with GPG. Registry docs under docs/ are generated by tfplugindocs through the repo formatter (nix fmt).

For local development, build with nix and point dev_overrides at the result:

nix build

~/.terraformrc (or ~/.tofurc):

provider_installation {
  dev_overrides {
    "registry.terraform.io/stepbrobd/arin" = "/path/to/repo/result/bin"
  }
  direct {}
}

Configuration #

  • api_key: ARIN API key, falls back to ARIN_API_KEY. Generate one in ARIN Online under Settings, Security Info, Manage API Keys.
  • org_handle: org whose RPKI objects are managed. Use provider aliases for multiple orgs.
  • base_url: defaults to https://reg.arin.net. Set https://reg.ote.arin.net for OT&E. OT&E data (API keys included) is a monthly snapshot of production, taken around the first Monday of each month. OT&E serves single-object IRR reads but not the org-scoped IRR listings, so the IRR data sources read empty there.

Development #

nix develop
go test ./...

# acceptance tests against the in-memory fake, driven by opentofu
# (the dev shell presets TF_ACC_TERRAFORM_PATH and TF_ACC_PROVIDER_HOST)
TF_ACC=1 go test ./provider/ -v

Updates to a ROA run as one atomic delete+add transaction on ARIN's side and reissue the ROA under a new roa_handle. ARIN deletes the IRR route objects an auto_link ROA maintains together with the ROA unless the delete opts out. An update that keeps auto_link and the origin and only adds prefixes opts out, so the existing route objects stay in place and the reissued ROA relinks them. Any other update, and a destroy, deletes them with the old ROA.

IRR route objects that ARIN maintains for auto_link ROAs are refused by arin_irr_route; manage those through the ROA.

Intentional exclusions #

The provider applies a three-tier mutation safety policy. Tier 1 is full lifecycle management for objects whose operations are synchronous, org-owned, and reversible through the same API: RPKI and IRR objects. Tier 2 is metadata-only management of existing registry objects adopted via import: arin_net updates net name and public comments (the RFC 9092 geofeed URL lives there), arin_delegation updates nameservers and DS records. Tier 3 is read-only exposure for everything ticketed or with registry-level blast radius.

Excluded on purpose:

  • Org and POC resources. The fields would be metadata-safe, but they stay data sources (arin_org, arin_poc) by owner decision for now.
  • Org and NET creation, deletion, reassignment, and reallocation. ARIN handles these through ticketed requests with no sane Terraform lifecycle.
  • POC-to-org link management.
  • An ASN registry resource. Reg-RWS has no ASN endpoint; IRR aut-num carries the AS name and description, and NET public comments carry the geofeed reference.
  • Delegation creation and deletion. Delegations exist implicitly per net, so arin_delegation modifies in place, and DNS changes take up to 24 hours to propagate.

Binary Cache: