Architecture: App Store Connect Provider
Architecture: App Store Connect Provider
Purpose
Custom OpenTofu provider for the App Store Connect REST API. Manages iOS app lifecycle (bundle IDs, profiles, devices, apps) as infrastructure-as-code. Built in Go with the Terraform Plugin Framework.
API Capabilities
| Resource | Create | Read | Update | Delete | Priority |
|---|---|---|---|---|---|
| Apps | NO (Apple blocks) | Yes | Yes | NO | P0 |
| Bundle IDs | Yes | Yes | — | Yes | P0 |
| Profiles | Yes | Yes | — | Yes | P1 |
| Certificates | — | Yes | — | — | P1 |
| Devices | Yes | Yes | Yes | — | P2 |
| Beta Groups | Yes | Yes | Yes | Yes | P2 |
Key Constraint
POST /v1/apps returns 403 regardless of API key role — Apple restricts app creation to the web UI. The pipeline must detect new apps and prompt the operator to create them manually at appstoreconnect.apple.com, then import via tofu import.Auth
JWT (ES256) bearer tokens generated from an API key (.p8 file). Tokens expire after 20 minutes; the client auto-regenerates. Key has Admin role.
Consumer
pal-e-platform/terraform/ declares appstoreconnect provider resources alongside godaddy and orka providers. A single
tofu apply provisions DNS + Apple infra + Mac VMs.Related
- Repo: appstoreconnect-tofu
- Ticket: #1535 (P0 bundle_id resource)
- Board: board-project-ios-infrastructure