Configuration templates

Configuration templates are groupings of settings you can reuse across multiple resources and groups. Streamlined configuration settings allows your team to move faster, and increases security by avoiding policy drift.

​

Create templates

To create a template, go to Templates, then select Configuration Templates. Click + Configuration Template.

You can provide a name, select an admin, optionally link a Slack channel, optionally add on-call members, optionally add break-glass users, require a reason when users forfeit access (Require reason to forfeit), prevent users from forfeiting access (Disable forfeiting access), and configure MFA settings, the same as you would in a resource-specific request configuration.

​

Apply templates

To apply a template to a resource or group, edit the field on the resource or group page:

When a template is applied, all its access management settings are configured by the values in the template:

• If a configuration template is modified, all resources and groups linked to the template are also modified
• The settings cannot be directly edited except by unlinking the configuration template

Configuration templates can be set in bulk:

​

Set templates using tags

Importing based on tags is not supported for custom apps, so template mapping does not apply for custom apps.

You can also configure Opal to automatically set a configuration template using tags. Go to Configuration > Templates > Template Mapping and Priority and associate a tag with a template that you have configured.

When resources or groups are imported with certain tags, the set templates are automatically applied.

Note that templates are only applied on import, so you must first create and define the mapping, then import the resources. If you import a resource and later define a template or tag the resource, the template will not be applied.

You can also reorder template mappings by selecting Reorder, so resources with multiple tags use the template with the highest priority.

​

Manage templates programmatically

You can create, update, and attach configuration templates using the Opal REST API and Terraform provider:

• Use the /configuration-templates API endpoints or the opal_configuration_template Terraform resource to manage templates. requires_forfeit_reason is available in the REST API only.
• Attach or unlink a template on a resource or group using GET /resources/{resource_id}/configuration-template and PUT /resources/{resource_id}/configuration-template or GET /groups/{group_id}/configuration-template and PUT /groups/{group_id}/configuration-template (or attach one with configuration_template_id on opal_resource / opal_group in Terraform; unlinking isn’t supported in Terraform). Pass null for configuration_template_id to unlink the template and copy its current settings onto the resource or group. Setting configuration_template_id directly on PUT /resources and PUT /groups is deprecated in favor of the /configuration-template sub-resource endpoints.