Skip to content
GantryCD Provider

gantrycd_service_account_token (Resource)

A token issued for a GantryCD service account. There is no update endpoint: rotating a token requires replacement (destroy + recreate).

Example Usage

resource "gantrycd_service_account" "ci" {
  name = "ci-bot"
}

# The raw token is returned exactly once, at creation. There is no update
# endpoint: rotate by replacing the resource (for example with a new name).
resource "gantrycd_service_account_token" "ci" {
  service_account_id = gantrycd_service_account.ci.id
  name               = "github-actions"
  expires_in         = "8760h" # one year; "unlimited" never expires
}

output "ci_token" {
  value     = gantrycd_service_account_token.ci.token
  sensitive = true
}

Schema

Required

  • expires_in (String) Token lifetime as a Go duration string (e.g. “8760h” for one year) or the literal “unlimited”. No update endpoint exists, so changing this requires replacement.
  • name (String) Human-readable token name. No update endpoint exists, so changing this requires replacement.
  • service_account_id (String) Service account the token authenticates as.

Read-Only

  • created_at (String) Pre-formatted creation timestamp.
  • expires_at (String) Pre-formatted expiry timestamp. Null when expires_in is “unlimited”.
  • id (String) Server-assigned token UUID. Used together with service_account_id as the Terraform import id (<service_account_id>/<id>).
  • identity_realm (String) Identity realm inherited from the configured provider.
  • token (String, Sensitive) Raw token secret returned by the Create API exactly once. Re-derivation is impossible — terraform import will leave this null; rotate by tainting/replacing the resource to obtain a fresh value.
  • token_prefix (String) Non-secret prefix of the token, useful for identifying which token is in use without exposing the secret.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import with a composite id: <service_account_id>/<token_id>. The raw token is
# only returned at creation and stays null after import.
terraform import gantrycd_service_account_token.ci sa_01HXXXXXXXXXXXXXXXXXXXXXXX/tok_01HXXXXXXXXXXXXXXXXXXXXXXX