kosli_service_account_api_key resource

Manages an API key for a Kosli service account. The raw key value is returned only once, at creation time, and is stored in Terraform state as a sensitive value.

Manages an API key for a Kosli service account. API keys authenticate a service account against the Kosli API. Use this resource to mint and revoke keys for a service account managed with the kosli_service_account resource.

The raw key value is returned only once, at creation time, and is stored in Terraform state as a sensitive value. It is SHA-256 hashed server-side and can never be retrieved again — protect your Terraform state accordingly.

API keys are immutable. Changing description, expires_at, or service_account_name revokes the existing key and creates a new one. On terraform import, the key attribute cannot be populated because the raw value is not retrievable.

Example usage

terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Service account that the API key belongs to
resource "kosli_service_account" "ci" {
  name        = "ci-pipeline"
  description = "CI/CD pipeline service account"
  privilege   = "member"
}

# Omitting expires_at lets the server choose the expiry, which is the maximum
# it allows: 365 days from creation. No API key can be created that never
# expires.
resource "kosli_service_account_api_key" "ci_key" {
  service_account_name = kosli_service_account.ci.name
  description          = "Production CI key"
}

# An API key with an explicit expiry (RFC3339 timestamp). It must be in the
# future and no more than 365 days out. The server silently shortens anything
# longer.
resource "kosli_service_account_api_key" "ci_key_expiring" {
  service_account_name = kosli_service_account.ci.name
  description          = "Temporary CI key"
  # Pick a date within 365 days of when you apply; update it as you rotate.
  expires_at           = "2027-01-01T00:00:00Z"
}

# The raw key is only available on creation and is sensitive
output "ci_api_key" {
  value     = kosli_service_account_api_key.ci_key.key
  sensitive = true
}

Expiry

The expires_at attribute is an RFC3339 timestamp, e.g. 2027-01-01T00:00:00Z (offsets such as +01:00 are accepted and normalized to UTC). The timestamp must not be in the past.

Kosli caps the lifetime of every API key at 365 days. An expires_at further out than that is silently shortened by the server, and Terraform then reports the mismatch as Provider produced inconsistent result after apply. Keys that never expire can no longer be created: omitting expires_at yields the maximum 365-day expiry rather than no expiry at all.

To derive dates from a fixed anchor, use Terraform’s built-in functions, e.g. timeadd("2027-01-01T00:00:00Z", "720h"). Avoid deriving expires_at from timestamp(). It changes on every plan, and because expires_at forces replacement that would revoke and recreate the key on each apply.

All timestamps (expires_at, created_at, last_used_at) are RFC3339 UTC strings. last_used_at is null for a key that has never been used. expires_at is null only for keys minted before the 365-day cap was introduced.

Import

API keys can be imported using the <service_account_name>/<key_id> format:

# Import an existing API key using the "<service_account_name>/<key_id>" format.
# Note: the raw key value cannot be recovered on import (it is only returned once
# at creation), so the "key" attribute will be empty after import.
terraform import kosli_service_account_api_key.ci_key ci-pipeline/01HXYZ0123456789ABCDEFGHIJ

Because the raw key value is only returned at creation time, the key attribute is empty after an import.

Schema

Required

• description (String) Description of the API key (at least one character). Changing this forces creation of a new key.
• service_account_name (String) Name of the service account this API key belongs to. Changing this forces creation of a new key.

Optional

• expires_at (String) RFC3339 timestamp at which the key expires, e.g. 2027-01-01T00:00:00Z (offsets allowed; whole seconds only). Must not be in the past (validated server-side at apply time) and must be no more than 365 days out: the server caps every key’s lifetime and silently shortens a longer expiry, which Terraform then reports as an inconsistent result after apply. Omit to let the server apply the maximum 365-day expiry; keys that never expire can no longer be created. Changing this forces creation of a new key. Removing a previously set value from configuration leaves the existing expiry unchanged.

Read-only

• created_at (String) RFC3339 UTC timestamp of when the API key was created.
• id (String) Server-assigned identifier of the API key.
• key (String, Sensitive) The raw API key value. Only available at creation time and stored as a sensitive value. Empty when the resource is imported.
• last_used_at (String) RFC3339 UTC timestamp of when the API key was last used. Null if the key has never been used.