Terraform Github provider gets a 403 error on /user (using Github app auth)

Question

I'm trying to setup team sync between Github and my id provider (Okta) using Terraform (v1.1.4). I've installed the Github provider as detailed in here. I did create a Github App and installed on my org, the permissions I've tried:

• Read access to metadata
• Read and write access to administration, members, and organization administration

In my terraform file, I'm trying:

data "github_organization_team_sync_groups" "all_okta_groups" {}

resource "github_team_sync_group_mapping" "main_group_mapping" {
  team_slug        = "example_team_slug"

  dynamic "group" {
    for_each = [for g in data.github_organization_team_sync_groups.all_okta_groups.groups : g if contains(var.teams, g.group_name)]
    content {
      group_id          = group.value.group_id
      group_name        = group.value.group_name
      group_description = group.value.group_description
    }
  }
}

as described here

And yet, when I try to do terraform plan, I get an error

 Error: GET https://api.github.com/user: 403 Resource not accessible by integration []

I think I'm missing some permission or something, please help 🙏

Answer 1

There is an owner field that needs to be set. It is marked as optional, but necessary for this auth method to work, you need to set it to the name of your org. The end result provider config that worked for me:

provider "github" {
  owner = "your-org-name"
  app_auth {
    id              = var.app_id
    installation_id = var.installation_id
    pem_file        = var.pem_file_contents
  }
}

It's possible the permissions you need will be different than what I did, so check those and make sure you only grant what is required.

Reference: https://registry.terraform.io/providers/integrations/github/latest/docs#argument-reference