# adamarkon/okta-asa-terraform-webinar architecture

> Architecture diagram of the GitHub repository adamarkon/okta-asa-terraform-webinar, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/adamarkon/okta-asa-terraform-webinar
- Repository: https://github.com/adamarkon/okta-asa-terraform-webinar

## Overview

This Terraform example provisions an AWS network with a public bastion and private Linux targets, while creating an Okta Advanced Server Access project and assigning existing groups. User-data scripts install the Server Agent so instances enroll in the project; authorized users can then reach targets through the bastion using the Okta client and short-lived certificates. The README documents these relationships, but no Terraform source excerpts were provided, so internal resource-level calls and dependencies are not asserted.

Main entry points: [`main.tf`](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/main.tf) (Deployment configuration), [`instances/instances.tf`](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf) (Bastion instance), [`okta/okta.tf`](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/okta.tf) (Group assignments), [`instances/userdata-scripts/ubuntu-userdata-sftd.sh`](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/userdata-scripts/ubuntu-userdata-sftd.sh) (Target user data)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_aws["AWS infrastructure"]
  node_root["Deployment configuration<br/>[main.tf]"]
  node_variables["Deployment inputs<br/>[input.tf]"]
  node_network["VPC and subnets<br/>[instances.tf]"]
  node_bastion["Bastion instance<br/>[instances.tf]"]
  node_targets["Private instances<br/>[instances.tf]"]
  node_instance_inputs["Instance settings<br/>[input.tf]"]
  node_instance_outputs["Instance outputs<br/>[output.tf]"]
  node_aws_service["AWS"]
end

subgraph group_okta["Okta access"]
  node_project["ASA project<br/>[okta.tf]"]
  node_group_assignment["Group assignments<br/>[okta.tf]"]
  node_okta_inputs["Okta settings<br/>[input.tf]"]
  node_okta_outputs["Okta outputs<br/>[output.tf]"]
  node_okta_service["Okta ASA backend"]
end

subgraph group_enrollment["Instance enrollment"]
  node_target_userdata["Target user data"]
  node_bastion_userdata["Bastion user data"]
  node_agent["Server Agent"]
end

subgraph group_access["SSH access"]
  node_client_user(("Authorized user"))
  node_client["ASA client"]
  node_cert["Short-lived certificate"]
end

node_operator(("Terraform operator"))

node_operator -->|"applies configuration"| node_root
node_root -->|"provisions infrastructure"| node_aws_service
node_root -->|"creates project"| node_okta_service
node_root -->|"assigns groups"| node_group_assignment
node_root -->|"deploys instances"| node_targets
node_root -->|"deploys bastion"| node_bastion
node_root -->|"creates network"| node_network
node_targets -->|"installs via"| node_target_userdata
node_bastion -->|"installs via"| node_bastion_userdata
node_target_userdata -->|"installs agent"| node_agent
node_bastion_userdata -->|"installs agent"| node_agent
node_agent -->|"enrolls with"| node_project
node_agent -->|"communicates changes"| node_okta_service
node_client_user -->|"uses"| node_client
node_client -->|"requests certificate"| node_cert
node_client -->|"connects through"| node_bastion
node_client -->|"SSH connects"| node_targets
node_group_assignment -->|"assigns groups to"| node_project

click node_root "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/main.tf"
click node_variables "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/input.tf"
click node_network "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf"
click node_bastion "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf"
click node_targets "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf"
click node_instance_inputs "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/input.tf"
click node_instance_outputs "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/output.tf"
click node_project "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/okta.tf"
click node_group_assignment "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/okta.tf"
click node_okta_inputs "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/input.tf"
click node_okta_outputs "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/output.tf"
click node_target_userdata "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/userdata-scripts/ubuntu-userdata-sftd.sh"
click node_bastion_userdata "https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/userdata-scripts/ubuntu-bastion-userdata-sftd.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_root,node_variables,node_network,node_bastion,node_targets,node_instance_inputs,node_instance_outputs,node_aws_service toneBlue
class node_project,node_group_assignment,node_okta_inputs,node_okta_outputs,node_okta_service toneAmber
class node_target_userdata,node_bastion_userdata,node_agent toneMint
class node_client_user,node_client,node_cert toneRose
class node_operator toneIndigo
```

## Components

### AWS infrastructure

- [Deployment configuration](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/main.tf): `main.tf`
- [Deployment inputs](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/input.tf): `input.tf`
- [VPC and subnets](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf): `instances/instances.tf`
- [Bastion instance](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf): `instances/instances.tf`
- [Private instances](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/instances.tf): `instances/instances.tf`
- [Instance settings](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/input.tf): `instances/input.tf`
- [Instance outputs](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/output.tf): `instances/output.tf`
- **AWS**

### Okta access

- [ASA project](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/okta.tf): `okta/okta.tf`
- [Group assignments](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/okta.tf): `okta/okta.tf`
- [Okta settings](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/input.tf): `okta/input.tf`
- [Okta outputs](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/okta/output.tf): `okta/output.tf`
- **Okta ASA backend**

### Instance enrollment

- [Target user data](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/userdata-scripts/ubuntu-userdata-sftd.sh): `instances/userdata-scripts/ubuntu-userdata-sftd.sh`
- [Bastion user data](https://github.com/adamarkon/okta-asa-terraform-webinar/blob/master/instances/userdata-scripts/ubuntu-bastion-userdata-sftd.sh): `instances/userdata-scripts/ubuntu-bastion-userdata-sftd.sh`
- **Server Agent**

### SSH access

- **Authorized user**
- **ASA client**
- **Short-lived certificate**

### Other components

- **Terraform operator**

## Connections

- Terraform operator → Deployment configuration: applies configuration (evidence: `README.md`)
- Deployment configuration → AWS: provisions infrastructure (evidence: `README.md`)
- Deployment configuration → Okta ASA backend: creates project (evidence: `README.md`)
- Deployment configuration → Group assignments: assigns groups (evidence: `README.md`)
- Deployment configuration → Private instances: deploys instances (evidence: `README.md`)
- Deployment configuration → Bastion instance: deploys bastion (evidence: `README.md`)
- Deployment configuration → VPC and subnets: creates network (evidence: `README.md`)
- Private instances → Target user data: installs via (evidence: `README.md`)
- Bastion instance → Bastion user data: installs via (evidence: `README.md`)
- Target user data → Server Agent: installs agent (evidence: `README.md`)
- Bastion user data → Server Agent: installs agent (evidence: `README.md`)
- Server Agent → ASA project: enrolls with (evidence: `README.md`)
- Server Agent → Okta ASA backend: communicates changes (evidence: `README.md`)
- Authorized user → ASA client: uses (evidence: `README.md`)
- ASA client → Short-lived certificate: requests certificate (evidence: `README.md`)
- ASA client → Bastion instance: connects through (evidence: `README.md`)
- ASA client → Private instances: SSH connects (evidence: `README.md`)
- Group assignments → ASA project: assigns groups to (evidence: `README.md`)