Terraform Provider for Slack Apps

[!NOTE] This provider was published as yumemi-inc/slackapp up to v0.2.9. Later releases are ymm-oss/slackapp.

To switch, change source to "ymm-oss/slackapp", then run:

terraform state replace-provider yumemi-inc/slackapp ymm-oss/slackapp
terraform init

Terraform provider for managing Slack Apps using app manifest.

Examples

Minimum Application

terraform {
  required_providers {
    slackapp = {
      source  = "ymm-oss/slackapp"
      version = "~> 0.4.0"
    }
  }
}

provider "slackapp" {
  // If you want to use non-default base URL for Slack API, use this argument to configure it.
  // It also can be set via SLACK_BASE_URL environment variable.
  base_url = "https://slack.com/api/"
  
  // App configuration token and refresh token can be retrieved from https://api.slack.com/reference/manifests#config-tokens.
  // They are special tokens to manage apps in workspace global.
  // They also can be set via SLACK_APP_CONFIGURATION_TOKEN and SLACK_REFRESH_TOKEN environment variables.
  app_configuration_token = "<YOUR_APP_CONFIGURATION_TOKEN>"
  refresh_token           = "<YOUR_REFRESH_TOKEN>"

  // Slack voids a refresh token once it is rotated, so keep the newest tokens between runs.
  // See "Keeping rotated tokens" below.
  token_store = {
    file = "/var/lib/atlantis/slackapp-tokens.json"
  }
}

// Data source slackapp_manifest is for constructing the manifest using Terraform language.
// If you want to use custom JSON representation, use jsonencode function instead.
data "slackapp_manifest" "default" {
  display_information {
    name = "Example Slack App"
  }

  settings {
    org_deploy_enabled  = false
    socket_mode_enabled = false
    token_rotation_enabled = false
  }
}

resource "slackapp_application" "default" {
  manifest = data.slackapp_manifest.default.json
}

output "app_id" {
  value = slackapp_application.default.id
}

Keeping rotated tokens

An app configuration token expires after 12 hours. With a refresh token, the provider rotates it for a new one. Slack voids the refresh token it rotates, and revokes the old app configuration token.

[!IMPORTANT] Without a token store, the configured refresh token works for one run only. Terraform restarts the provider for each plan, apply and destroy, so a later run uses a voided token and fails with invalid_refresh_token.

Set token_store to keep the newest tokens between runs:

provider "slackapp" {
  token_store = {
    file = "/var/lib/atlantis/slackapp-tokens.json"
  }
}

export SLACK_TOKEN_STORE_FILE=/var/lib/atlantis/slackapp-tokens.json

provider "slackapp" {
  token_store = {
    command = ["/path/to/helper", "--any", "args"]
  }
}

# A program with no arguments
export SLACK_TOKEN_STORE_COMMAND=/path/to/helper

The token_store attribute wins over the environment variables. With it set, neither variable is read.