terraform-provider-ory: Skill for Claude Code

Import an existing Ory Network project into Terraform

Onboard a live Ory Network project into Terraform so that terraform plan reports no changes. Terraform's built-in import blocks and terraform plan -generate-config-out do the mechanical part; this skill fills in the Ory-specific knowledge: where each resource is discovered, how each import ID is built, which attributes to prune from generated config, and which secrets can never be read back.

Safety first: every step below is read-only against Ory until the final terraform apply, and that apply only records imports (0 to add, 0 to change, 0 to destroy). Never run terraform destroy in the working directory — the imported resources are real. To undo a mistaken import, use terraform state rm <address>; it removes the resource from state without touching the live project.

Prerequisites

• Terraform >= 1.5 (import blocks and -generate-config-out).

• curl and jq (used by the inventory script).

• A workspace API key (ory_wak_..., create under Workspace Settings > API keys) and, to cover OAuth2 clients / JWKS / trusted issuers, a project API key (ory_pat_...).

• The project UUID. List a workspace's projects with the workspace API key:

  curl -sH "Authorization: Bearer $ORY_WORKSPACE_API_KEY" \
    "${ORY_CONSOLE_API_URL:-https://api.console.ory.sh}/workspaces/$ORY_WORKSPACE_ID/projects" \
    | jq -r '.projects[] | "\(.id)  \(.slug)  \(.name)"'
  

  Use this workspace-scoped endpoint, not GET /projects (that path needs a browser session token and returns 403 for an API key). The ory list projects CLI also works, but only against Ory's production console with an interactive ory auth session — it ignores ORY_CONSOLE_API_URL, so it cannot reach other environments, and it rejects --workspace when ORY_WORKSPACE_API_KEY is set. The curl call above is environment-agnostic.

Export the credentials as environment variables; the provider and the inventory script both read them: