diff --git a/init.tf b/init.tf
new file mode 100644
index 0000000..d0a1a67
--- /dev/null
+++ b/init.tf
@@ -0,0 +1,14 @@
+terraform {
+  required_providers {
+    maas = {
+      source  = "maas/maas"
+      version = "~>1.0"
+    }
+  }
+}
+
+provider "maas" {
+  api_version = "2.0"
+  api_key = "cP5gj8RyemEhBLvyKG:AmRXEzR8MPAbRPWGBH:7T9LPemF3gAPe3qwr47rXAkLWZysjeRB"
+  api_url = "http://10.0.1.253:5240/MAAS"
+}
diff --git a/openstack/00-init.tf b/openstack/00-init.tf
index 3e82c65..85fb524 100644
--- a/openstack/00-init.tf
+++ b/openstack/00-init.tf
@@ -21,3 +21,8 @@ variable "cloud" {
   type    = string
   default = ""
 }
+
+variable "heat_domain_id" {
+  type    = string
+  default = ""
+}
diff --git a/openstack/arif-home.tfvars b/openstack/arif-home.tfvars
index d64fd24..fd605d8 100644
--- a/openstack/arif-home.tfvars
+++ b/openstack/arif-home.tfvars
@@ -1,2 +1,3 @@
 cloud = "arif-home"
 domain_id = "3fd5a53e08e243b49ac3b171d57b4e4a"
+heat_domain_id = "cf34d55eaf294678971be7ad732be0d2"
diff --git a/openstack/init/05-instance.tf b/openstack/init/05-instance.tf
index a66bd86..3c6d2cb 100644
--- a/openstack/init/05-instance.tf
+++ b/openstack/init/05-instance.tf
@@ -24,6 +24,8 @@ resource "openstack_compute_instance_v2" "test_server_01" {
   network {
     name = "private"
   }
+
+  user_data = file("user-data.yaml")
 }
 
 resource "openstack_networking_floatingip_v2" "fip" {
diff --git a/openstack/init/user-data.yaml b/openstack/init/user-data.yaml
new file mode 100644
index 0000000..96ae3db
--- /dev/null
+++ b/openstack/init/user-data.yaml
@@ -0,0 +1,4 @@
+#cloud-config
+password: ubuntu
+chpasswd: {expire: False}
+ssh_pwauth: True
diff --git a/openstack/stsstack_init/01-default-roles.tf b/openstack/stsstack_init/01-default-roles.tf
index ad7d9cc..aec72c7 100644
--- a/openstack/stsstack_init/01-default-roles.tf
+++ b/openstack/stsstack_init/01-default-roles.tf
@@ -1,3 +1,7 @@
+data "openstack_identity_role_v3" "admin"{
+  name = "admin"
+}
+
 data "openstack_identity_role_v3" "Member" {
   name = "Member"
 }
diff --git a/openstack/stsstack_init/01-heat-roles.tf b/openstack/stsstack_init/01-heat-roles.tf
new file mode 100644
index 0000000..baed8a5
--- /dev/null
+++ b/openstack/stsstack_init/01-heat-roles.tf
@@ -0,0 +1,16 @@
+resource "openstack_identity_user_v3" "heat_domain_admin" {
+  domain_id = var.heat_domain_id
+  name = "heat_domain_admin"
+
+  password = "Ht8NdKTGdpJjRsS4V33tsVW4mSztgZMs" # leader-get heat-domain-admin-passwd
+}
+
+resource "openstack_identity_role_assignment_v3" "heat_admin_role_assignment" {
+  domain_id  = var.heat_domain_id
+  user_id    = openstack_identity_user_v3.heat_domain_admin.id
+  role_id    = data.openstack_identity_role_v3.admin.id
+}
+
+resource "openstack_identity_role_v3" "heat_stack_user" {
+  name = "heat_stack_user"
+}