Complete Examples

These examples demonstrate how to combine multiple ImageFactory resources into a complete infrastructure-as-code configuration.

Full AWS Setup

This example onboards an AWS account, creates a custom component, looks up a distribution, and defines a template that uses both system and custom components.

# 1. Onboard AWS Account
resource "imagefactory_aws_account" "prod" {
  alias       = "production-aws"
  description = "Production AWS account"
  account_id  = "123456789012"

  access {
    role_arn         = "arn:aws:iam::123456789012:role/ImageFactoryMasterRole"
    role_external_id = "lieGhohY6ahv2aijieZ9"
  }
}

# 2. Create Custom Shell Component
resource "imagefactory_custom_component" "security_agent" {
  name            = "install-security-agent"
  description     = "Installs the security monitoring agent"
  stage           = "BUILD"
  cloud_providers = ["AWS"]
  os_types        = ["LINUX"]

  content {
    provisioner = "SHELL"
    script      = <<-EOT
      #!/bin/bash
      echo "Installing security agent..."
      # curl -s https://example.com/install.sh | bash
    EOT
  }
}

# 3. Look up Ubuntu Distribution
data "imagefactory_distribution" "ubuntu" {
  name           = "Ubuntu Server 22.04 LTS"
  cloud_provider = "AWS"
}

# 4. Look up System Hardening Component
data "imagefactory_system_component" "hardening" {
  name = "Hardening level 1"
}

# 5. Create Template
resource "imagefactory_template" "secure_ubuntu" {
  name            = "secure-ubuntu-2204"
  description     = "Hardened Ubuntu 22.04 with security agent"
  cloud_provider  = "AWS"
  distribution_id = data.imagefactory_distribution.ubuntu.id

  config {
    aws {
      region          = "eu-central-1"
      ebs_volume_type = "gp3"
    }
    build_components {
      id = data.imagefactory_system_component.hardening.id
    }
    build_components {
      id = imagefactory_custom_component.security_agent.id
    }
    notifications {
      type = "WEB_HOOK"
      uri  = "https://hooks.slack.com/services/..."
    }
    tags {
      key   = "Compliance"
      value = "CIS-L1"
    }
    tags {
      key   = "Owner"
      value = "SecurityTeam"
    }
    cloud_account_ids = [imagefactory_aws_account.prod.id]
  }
}

# 6. Set up RBAC for the template
resource "imagefactory_role" "template_viewer" {
  name = "Secure Template Viewer"
  rules {
    resources = ["TEMPLATE"]
    actions   = ["VIEW"]
  }
}

resource "imagefactory_role_binding" "viewer_binding" {
  kind    = "USER"
  role_id = imagefactory_role.template_viewer.id
  subject = "dev-team@example.com"
}

Azure with Custom Image Definition

This example shows how to onboard an Azure subscription and create a template that publishes to a specific VM Image Definition in the Azure Compute Gallery.

# 1. Onboard Azure Subscription
resource "imagefactory_azure_subscription" "prod" {
  alias           = "production-azure"
  description     = "Production Azure subscription"
  subscription_id = "00000000-0000-0000-0000-000000000000"

  access {
    tenant_id            = "00000000-0000-0000-0000-000000000000"
    app_id               = "00000000-0000-0000-0000-000000000000"
    password             = var.azure_client_secret
    resource_group_name  = "imagefactory-rg"
    storage_account      = "ifstorageprod"
    storage_account_key  = var.azure_storage_key
    shared_image_gallery = "MainGallery"
  }
}

# 2. Look up Ubuntu for Azure
data "imagefactory_distribution" "ubuntu_azure" {
  name           = "Ubuntu Server 22.04 LTS"
  cloud_provider = "AZURE"
}

# 3. Create Template with VM Image Definition
resource "imagefactory_template" "azure_web" {
  name            = "azure-web-server"
  cloud_provider  = "AZURE"
  distribution_id = data.imagefactory_distribution.ubuntu_azure.id

  config {
    azure {
      replica_regions = ["westeurope", "northeurope"]
      vm_image_definition {
        name  = "web-server-base"
        offer = "UbuntuServer"
        sku   = "22_04-lts-gen2"
      }
      additional_data_disks {
        size = 5
      }
      trusted_launch = true
    }
    cloud_account_ids = [imagefactory_azure_subscription.prod.id]
  }
}

Multi-Cloud RBAC Setup

Manage access for different teams across multiple cloud environments.

# 1. Define Roles
resource "imagefactory_role" "admin" {
  name        = "Full Admin"
  description = "Full access to all ImageFactory resources"
  rules {
    resources = ["TEMPLATE", "COMPONENT", "ACCOUNT", "ROLE", "API_KEY", "VARIABLE"]
    actions   = ["ANY"]
  }
}

resource "imagefactory_role" "developer" {
  name        = "Template Developer"
  description = "Can view and update templates and components"
  rules {
    resources = ["TEMPLATE", "COMPONENT"]
    actions   = ["VIEW", "UPDATE"]
  }
  rules {
    resources = ["ACCOUNT"]
    actions   = ["VIEW"]
  }
}

# 2. Create API Keys for CI/CD
resource "imagefactory_api_key" "github_actions" {
  name       = "github-actions-pipeline"
  expires_at = "2027-01-01"
}

# 3. Bind Roles
resource "imagefactory_role_binding" "admin_binding" {
  kind    = "USER"
  role_id = imagefactory_role.admin.id
  subject = "admin@example.com"
}

resource "imagefactory_role_binding" "ci_cd_binding" {
  kind    = "API_KEY"
  role_id = imagefactory_role.developer.id
  subject = imagefactory_api_key.github_actions.id
}