Skip to content

Commit 629839a

Browse files
committed
feat: implement sa access token resource
1 parent 7cb81c7 commit 629839a

File tree

6 files changed

+748
-1
lines changed

6 files changed

+748
-1
lines changed
Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stackit_service_account_access_token Resource - stackit"
4+
subcategory: ""
5+
description: |-
6+
Schema for a STACKIT service account access token resource.
7+
~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources for how to opt-in to use beta resources.
8+
Example Usage
9+
Automatically rotate access tokens
10+
11+
resource "stackit_service_account" "sa" {
12+
project_id = var.stackit_project_id
13+
name = "sa01"
14+
}
15+
16+
resource "time_rotating" "rotate" {
17+
rotation_days = 80
18+
}
19+
20+
// The access token is valid for 180 days but is configured to rotate every 80 days
21+
// when a Terraform apply is triggered.
22+
resource "stackit_service_account_access_token" "sa1" {
23+
project_id = var.stackit_project_id
24+
service_account_email = stackit_service_account.sa.email
25+
ttl_days = 180
26+
27+
// Trigger token rotation based on time_rotating changes.
28+
rotate_when_changed = {
29+
rotation = time_rotating.rotate.id
30+
}
31+
}
32+
---
33+
34+
# stackit_service_account_access_token (Resource)
35+
36+
Schema for a STACKIT service account access token resource.
37+
38+
~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our [guide](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources) for how to opt-in to use beta resources.
39+
## Example Usage
40+
41+
42+
### Automatically rotate access tokens
43+
```terraform
44+
resource "stackit_service_account" "sa" {
45+
project_id = var.stackit_project_id
46+
name = "sa01"
47+
}
48+
49+
resource "time_rotating" "rotate" {
50+
rotation_days = 80
51+
}
52+
53+
// The access token is valid for 180 days but is configured to rotate every 80 days
54+
// when a Terraform apply is triggered.
55+
resource "stackit_service_account_access_token" "sa1" {
56+
project_id = var.stackit_project_id
57+
service_account_email = stackit_service_account.sa.email
58+
ttl_days = 180
59+
60+
// Trigger token rotation based on time_rotating changes.
61+
rotate_when_changed = {
62+
rotation = time_rotating.rotate.id
63+
}
64+
}
65+
66+
```
67+
68+
69+
70+
<!-- schema generated by tfplugindocs -->
71+
## Schema
72+
73+
### Required
74+
75+
- `project_id` (String) STACKIT project ID associated with the service account token.
76+
- `service_account_email` (String) Email address linked to the service account.
77+
78+
### Optional
79+
80+
- `rotate_when_changed` (Map of String) A map of arbitrary key/value pairs that will force recreation of the token when they change, enabling token rotation based on external conditions such as a rotating timestamp. Changing this forces a new resource to be created.
81+
- `ttl_days` (Number) Specifies the token's validity duration in days. If unspecified, defaults to 90 days.
82+
83+
### Read-Only
84+
85+
- `access_token_id` (String) Identifier for the access token linked to the service account.
86+
- `created_at` (String) Timestamp indicating when the access token was created.
87+
- `id` (String) Unique internal resource ID for Terraform, formatted as "project_id,access_token_id".
88+
- `token` (String, Sensitive) JWT access token for API authentication. Prefixed by 'Bearer' and should be stored securely as it is irretrievable once lost.
89+
- `valid_until` (String) Estimated expiration timestamp of the access token. For precise validity, check the JWT details.

stackit/internal/services/serviceaccount/serviceaccount_acc_test.go

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ func inputServiceAccountResourceConfig(name string) string {
3030
project_id = "%s"
3131
name = "%s"
3232
}
33+
34+
resource "stackit_service_account_access_token" "token" {
35+
project_id = stackit_service_account.sa.project_id
36+
service_account_email = stackit_service_account.sa.email
37+
}
3338
`,
3439
testutil.ServiceAccountProviderConfig(),
3540
serviceAccountResource["project_id"],
@@ -55,13 +60,18 @@ func TestServiceAccount(t *testing.T) {
5560
ProtoV6ProviderFactories: testutil.TestAccProtoV6ProviderFactories,
5661
CheckDestroy: testAccCheckServiceAccountDestroy,
5762
Steps: []resource.TestStep{
58-
// Creation
63+
// Create
5964
{
6065
Config: inputServiceAccountResourceConfig(serviceAccountResource["name01"]),
6166
Check: resource.ComposeAggregateTestCheckFunc(
6267
resource.TestCheckResourceAttr("stackit_service_account.sa", "project_id", serviceAccountResource["project_id"]),
6368
resource.TestCheckResourceAttr("stackit_service_account.sa", "name", serviceAccountResource["name01"]),
6469
resource.TestCheckResourceAttrSet("stackit_service_account.sa", "email"),
70+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "token"),
71+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "created_at"),
72+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "valid_until"),
73+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "service_account_email"),
74+
resource.TestCheckResourceAttrPair("stackit_service_account.sa", "email", "stackit_service_account_access_token.token", "service_account_email"),
6575
),
6676
},
6777
// Update
@@ -71,6 +81,11 @@ func TestServiceAccount(t *testing.T) {
7181
resource.TestCheckResourceAttr("stackit_service_account.sa", "project_id", serviceAccountResource["project_id"]),
7282
resource.TestCheckResourceAttr("stackit_service_account.sa", "name", serviceAccountResource["name02"]),
7383
resource.TestCheckResourceAttrSet("stackit_service_account.sa", "email"),
84+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "token"),
85+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "created_at"),
86+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "valid_until"),
87+
resource.TestCheckResourceAttrSet("stackit_service_account_access_token.token", "service_account_email"),
88+
resource.TestCheckResourceAttrPair("stackit_service_account.sa", "email", "stackit_service_account_access_token.token", "service_account_email"),
7489
),
7590
},
7691
// Data source
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package token
2+
3+
const markdownDescription = `
4+
Schema for a STACKIT service account access token resource.` + "\n" + `
5+
~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our [guide](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources) for how to opt-in to use beta resources.
6+
## Example Usage` + "\n" + `
7+
8+
### Automatically rotate access tokens` + "\n" +
9+
"```terraform" + `
10+
resource "stackit_service_account" "sa" {
11+
project_id = var.stackit_project_id
12+
name = "sa01"
13+
}
14+
15+
resource "time_rotating" "rotate" {
16+
rotation_days = 80
17+
}
18+
19+
// The access token is valid for 180 days but is configured to rotate every 80 days
20+
// when a Terraform apply is triggered.
21+
resource "stackit_service_account_access_token" "sa1" {
22+
project_id = var.stackit_project_id
23+
service_account_email = stackit_service_account.sa.email
24+
ttl_days = 180
25+
26+
// Trigger token rotation based on time_rotating changes.
27+
rotate_when_changed = {
28+
rotation = time_rotating.rotate.id
29+
}
30+
}
31+
` + "\n```"

0 commit comments

Comments
 (0)