Product documentation
Citrix SecurSpaces™
View PDF

Terraform provider

August 21, 2026
Contributed by: 
T

Citrix SecurSpaces™ publishes a Terraform provider so that platform configuration can be managed as code rather than through the console. It is useful when you create projects and templates repeatedly, when configuration has to be reviewed before it is applied, or when an audit needs a record of who changed what.

The provider manages platform objects. It does not deploy the platform itself — for that, see Install with the Strong Installer CLI.

What it manages

Resource Manages
strong_user Platform users
strong_organization Organizations and their owner
strong_project Projects, their owner, and their members
strong_user_group User groups and their membership
strong_workspace_template Workspace templates, including specifications, images, scripts, secrets, apps, and security settings

Get the provider

The provider is distributed through your SecurSpaces deployment rather than the public Terraform Registry, so you download it with the same installer container you use for upgrades. Access is tied to your platform entitlement.

  1. Run the installer container as described in Install with the Strong Installer CLI.

  2. Fetch the provider:

    sds-cli get-terraform -d <your-sds-hostname>
<!--NeedCopy-->

    The newest version is downloaded into the shared directory. Add -v <version> to select a specific one, or --verbose to list what is available first.

  3. Install it where Terraform looks for local providers, and mark it executable:

    mkdir -p ~/.terraform.d/plugins/strong.network/strong-network/strong/<version>/linux_amd64/
cp terraform-provider-strong-<version> \
  ~/.terraform.d/plugins/strong.network/strong-network/strong/<version>/linux_amd64/terraform-provider-strong
chmod +x ~/.terraform.d/plugins/strong.network/strong-network/strong/<version>/linux_amd64/terraform-provider-strong
<!--NeedCopy-->

Note:

Because the provider is installed from the filesystem rather than a registry, terraform init does not verify a checksum for it. Fetch it through sds-cli rather than copying it between machines, and keep the version you deployed recorded with the rest of your infrastructure code.

Configure the provider

Declare the provider and point it at your deployment:

terraform {
  required_providers {
    strong = {
      source  = "strong.network/strong-network/strong"
      version = "<version>"
    }
  }
}

provider "strong" {
  api_token      = var.api_token
  deployment_url = var.deployment_url
}
<!--NeedCopy-->
Argument Required Description
api_token Yes A platform API key. Create one under Profile > Security > API Keys
deployment_url Yes The URL of your SecurSpaces deployment

The token is marked sensitive by the provider, so Terraform does not print it. Supply it through a variable or the environment rather than writing it into a file, and give it only the permissions the configuration needs — see Roles and permissions.

Resources

strong_user

Argument Type Required Description
email string Yes The user’s email address
user_type integer Yes 1 for an administrator, 3 for a developer
identity_provider integer Yes The identity provider, as a numeric value. 1 Google, 2 Microsoft, 3 SAML, 7 generic OIDC, 0 none
full_name string No The user’s full name

strong_organization

Argument Type Required Description
name string Yes The organization name
owner_id string Yes The user ID or email of the owner

strong_project

Argument Type Required Description
name string Yes The project name
owner_id string Yes The user ID or email of the owner
organization_id string Yes The organization the project belongs to
member block list No Project members. Each block takes id and role

strong_user_group

Argument Type Required Description
name string Yes The group name
description string No A description of the group
members set of strings No User IDs in the group

strong_workspace_template

The largest resource. It covers what a template defines in the console, including:

  • Identity and scope — name, project_id, version, description, region_id
  • Image — workspace_image with id and tag
  • Resources — workspace_specs with cpu, memory, and disk
  • Startup — before_startup_script, after_startup_script, default_folder
  • Secrets — injected_secrets_as_env, injected_secrets_as_file, and local equivalents taking secret_name and content
  • Applications — workspace_apps with port, name, and use_https
  • Security — policy_ids for network policies, apps_security, personal_ssh_identity, workspace_access_items
  • Clipboard — clipboard_settings, covering monitor, clipboard_restricted, paste restrictions, character limits, and enable_supervised_copy
  • Schedule — workspace_schedule, timeout_outside_schedule, idle_timeout

For what each setting does, see Workspace templates.

Example

Creating an organization, a project inside it, and a group:

resource "strong_user" "lead" {
  email             = "team-lead@example.com"
  user_type         = 3
  full_name         = "Team Lead"
  identity_provider = 3
}

resource "strong_organization" "engineering" {
  name     = "engineering"
  owner_id = strong_user.lead.id
}

resource "strong_project" "platform" {
  name            = "platform-services"
  owner_id        = strong_user.lead.id
  organization_id = strong_organization.engineering.id
}

resource "strong_user_group" "reviewers" {
  name        = "reviewers"
  description = "Engineers who review platform changes"
  members     = [strong_user.lead.id]
}
<!--NeedCopy-->

Apply it in the usual way:

terraform init
terraform plan
terraform apply
<!--NeedCopy-->

Every resource supports import, so you can bring objects that already exist under Terraform management with terraform import.

Terraform provider
August 21, 2026
Contributed by: 
T
August 21, 2026
Contributed by: 
T

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.