gitlab.GroupServiceAccountAccessToken

The gitlab.GroupServiceAccountAccessToken resource allows to manage the lifecycle of a group service account access token.

Use of the timestamp() function with expires_at will cause the resource to be re-created with every apply, it’s recommended to use plantimestamp() or a static value instead.

Reading the access token status of a service account requires an admin token or a top-level group owner token on gitlab.com. As a result, this resource will ignore permission errors when attempting to read the token status, and will rely on the values in state instead. This can lead to apply-time failures if the token configured for the provider doesn’t have permissions to rotate tokens for the service account.

Use rotation_configuration to automatically rotate tokens instead of using timestamp() as timestamp will cause changes with every plan. pulumi up must still be run to rotate the token.

Due to a limitation in the API, the rotation_configuration is unable to set the new expiry date before GitLab 17.9. Instead, when the resource is created, it will default the expiry date to 7 days in the future. On each subsequent apply, the new expiry will be 7 days from the date of the apply.

Upstream API: GitLab API docs

Create GroupServiceAccountAccessToken Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new GroupServiceAccountAccessToken(name: string, args: GroupServiceAccountAccessTokenArgs, opts?: CustomResourceOptions);

@overload
def GroupServiceAccountAccessToken(resource_name: str,
                                   args: GroupServiceAccountAccessTokenArgs,
                                   opts: Optional[ResourceOptions] = None)

@overload
def GroupServiceAccountAccessToken(resource_name: str,
                                   opts: Optional[ResourceOptions] = None,
                                   group: Optional[str] = None,
                                   scopes: Optional[Sequence[str]] = None,
                                   user_id: Optional[int] = None,
                                   expires_at: Optional[str] = None,
                                   name: Optional[str] = None,
                                   rotation_configuration: Optional[GroupServiceAccountAccessTokenRotationConfigurationArgs] = None)

func NewGroupServiceAccountAccessToken(ctx *Context, name string, args GroupServiceAccountAccessTokenArgs, opts ...ResourceOption) (*GroupServiceAccountAccessToken, error)

public GroupServiceAccountAccessToken(string name, GroupServiceAccountAccessTokenArgs args, CustomResourceOptions? opts = null)

public GroupServiceAccountAccessToken(String name, GroupServiceAccountAccessTokenArgs args)
public GroupServiceAccountAccessToken(String name, GroupServiceAccountAccessTokenArgs args, CustomResourceOptions options)

type: gitlab:GroupServiceAccountAccessToken
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

Constructor example

The following reference example uses placeholder values for all input properties.

var groupServiceAccountAccessTokenResource = new GitLab.GroupServiceAccountAccessToken("groupServiceAccountAccessTokenResource", new()
{
    Group = "string",
    Scopes = new[]
    {
        "string",
    },
    UserId = 0,
    ExpiresAt = "string",
    Name = "string",
    RotationConfiguration = new GitLab.Inputs.GroupServiceAccountAccessTokenRotationConfigurationArgs
    {
        RotateBeforeDays = 0,
        ExpirationDays = 0,
    },
});

example, err := gitlab.NewGroupServiceAccountAccessToken(ctx, "groupServiceAccountAccessTokenResource", &gitlab.GroupServiceAccountAccessTokenArgs{
	Group: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserId:    pulumi.Int(0),
	ExpiresAt: pulumi.String("string"),
	Name:      pulumi.String("string"),
	RotationConfiguration: &gitlab.GroupServiceAccountAccessTokenRotationConfigurationArgs{
		RotateBeforeDays: pulumi.Int(0),
		ExpirationDays:   pulumi.Int(0),
	},
})

var groupServiceAccountAccessTokenResource = new GroupServiceAccountAccessToken("groupServiceAccountAccessTokenResource", GroupServiceAccountAccessTokenArgs.builder()
    .group("string")
    .scopes("string")
    .userId(0)
    .expiresAt("string")
    .name("string")
    .rotationConfiguration(GroupServiceAccountAccessTokenRotationConfigurationArgs.builder()
        .rotateBeforeDays(0)
        .expirationDays(0)
        .build())
    .build());

group_service_account_access_token_resource = gitlab.GroupServiceAccountAccessToken("groupServiceAccountAccessTokenResource",
    group="string",
    scopes=["string"],
    user_id=0,
    expires_at="string",
    name="string",
    rotation_configuration={
        "rotate_before_days": 0,
        "expiration_days": 0,
    })

const groupServiceAccountAccessTokenResource = new gitlab.GroupServiceAccountAccessToken("groupServiceAccountAccessTokenResource", {
    group: "string",
    scopes: ["string"],
    userId: 0,
    expiresAt: "string",
    name: "string",
    rotationConfiguration: {
        rotateBeforeDays: 0,
        expirationDays: 0,
    },
});

type: gitlab:GroupServiceAccountAccessToken
properties:
    expiresAt: string
    group: string
    name: string
    rotationConfiguration:
        expirationDays: 0
        rotateBeforeDays: 0
    scopes:
        - string
    userId: 0

GroupServiceAccountAccessToken Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The GroupServiceAccountAccessToken resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the GroupServiceAccountAccessToken resource produces the following output properties:

Look up Existing GroupServiceAccountAccessToken Resource

Get an existing GroupServiceAccountAccessToken resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupServiceAccountAccessTokenState, opts?: CustomResourceOptions): GroupServiceAccountAccessToken

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        active: Optional[bool] = None,
        created_at: Optional[str] = None,
        expires_at: Optional[str] = None,
        group: Optional[str] = None,
        name: Optional[str] = None,
        revoked: Optional[bool] = None,
        rotation_configuration: Optional[GroupServiceAccountAccessTokenRotationConfigurationArgs] = None,
        scopes: Optional[Sequence[str]] = None,
        token: Optional[str] = None,
        user_id: Optional[int] = None) -> GroupServiceAccountAccessToken

func GetGroupServiceAccountAccessToken(ctx *Context, name string, id IDInput, state *GroupServiceAccountAccessTokenState, opts ...ResourceOption) (*GroupServiceAccountAccessToken, error)

public static GroupServiceAccountAccessToken Get(string name, Input<string> id, GroupServiceAccountAccessTokenState? state, CustomResourceOptions? opts = null)

public static GroupServiceAccountAccessToken get(String name, Output<String> id, GroupServiceAccountAccessTokenState state, CustomResourceOptions options)

resources:  _:    type: gitlab:GroupServiceAccountAccessToken    get:      id: ${id}

Supporting Types

GroupServiceAccountAccessTokenRotationConfiguration, GroupServiceAccountAccessTokenRotationConfigurationArgs

Import

Starting in Terraform v1.5.0 you can use an import block to import gitlab_group_service_account_access_token. For example:

terraform

import {

to = gitlab_group_service_account_access_token.example

id = “see CLI command below for ID”

}

Import using the CLI is supported using the following syntax:

$ pulumi import gitlab:index/groupServiceAccountAccessToken:GroupServiceAccountAccessToken You can import a service account access token using `<resource> <id>`. The

id is in the form of <group_id>:<service_account_id>:<access_token_id>

Importing an access token does not import the access token value.

$ pulumi import gitlab:index/groupServiceAccountAccessToken:GroupServiceAccountAccessToken example 1:2:3

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository

GitLab pulumi/pulumi-gitlab

License

Apache-2.0

Notes

This Pulumi package is based on the gitlab Terraform Provider.