ARTIFACTORY: How to Configure Terraform CLI with JFrog Artifactory for the Wiz Provider

Introduction

This guide outlines the steps to configure your Terraform client and JFrog Artifactory to resolve and cache the Wiz Terraform provider (tf.app.wiz.io). Please note that this is supported from Artifactory version - 7.123.0

Part 1: Artifactory Repository Configuration:

Before configuring the client, ensure that your remote repository is correctly set up in JFrog Artifactory to proxy the Wiz Terraform registry.

Create a Remote Repository: Set up a new remote repository for Terraform (e.g., kajaalr-terraform).

Configure URLs: Ensure the following URLs are pointed to the Wiz registry as shown in the below screenshot:

URL: https://tf.app.wiz.io

Registry URL: https://tf.app.wiz.io

Providers URL: https://tf.app.wiz.io/

Git Providers: Set the Git provider to GitHub.

External dependencies rewrite: Enable External dependencies rewrite in the advanced section as shown in the image below. Please add these patterns to the Patterns Allow List:

• **/tf.app.wiz.io/**

• **/terraform-server-prod.s3.us-east-2.amazonaws.com/**

Optional broader alternative in case if Wiz changes S3 bucket/region: **.amazonaws.com/**

Part 2: Client Configuration (Terraform CLI)

Once the  repository configuration is ready, configure your local Terraform environment to authenticate and route requests through Artifactory.

Step 1: Configure the Terraform CLI

You need to instruct Terraform to exclude the default registries so it forces the use of the request via Artifactory

Create a .terraformrc file (Linux/macOS in ~/.terraformrc) or a terraform.rc file (Windows in %APPDATA%\terraform.rc) with the following content:

Terraform

provider_installation {
  direct {
    exclude = ["registry.terraform.io/*/*", "tf.app.wiz.io/*/*"]
  }
}

Step 2: Configure Artifactory Credentials

Terraform needs to authenticate with JFrog to pull the provider. Add your credentials to the same ~/.terraformrc file, or alternatively, create a new file at ~/.terraform.d/credentials.tfrc.json with the following structure:

{
  "credentials": {
    "<JFrog_URL>": {
      "token": "<Token>"
    }
  }
}

Note:

Replace <JFrog_URL> with your actual JFrog domain and <Token> with your valid access token.

Step 3: Create the Terraform Configuration (main.tf)

In your Terraform project directory, define the required providers in your main.tf file. You must specify the custom Artifactory path as the source. Please note that to include rt-ns after the repository name to differentiate the repository name from the namespace.

terraform {
  required_providers {
    wiz = {
      source  = "<JF_Url>/<wiz-provider-remote-repo>-rt-ns-wizsec/wiz"
      version = "1.28.16016"
    }
  }
}

Step 4: Initialize Terraform

Clear out any old Terraform lock files and initialization directories to ensure a clean run, then initialize your project.

rm -rf .terraform .terraform.lock.hcl
terraform init

Upon a successful initialization, Terraform will confirm that the provider plugins have been found and installed from your Artifactory source. Image below displays the successful terraform init console output

Part 3: Verification

To verify that the configuration is working as expected and that the provider is successfully being proxied and cached:

Navigate to your JFrog Artifactory UI.

Open the Artifacts section and locate your remote repository

Drill down into .terraform -> providers -> wizsec -> wiz.

You should see the provider versions and the associated zip files cached locally. The below image illustrates the successfully populated local file cache in Artifactory