frostmoln_api_key (Resource)

Manages an API key in the Frostmoln platform.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — expires_at: the key's expiry is fixed when it is minted.

Observed, not enacted — key: returned once at create and never again — only this configuration's copy survives; a refresh cannot recover it.

Example Usage

resource "frostmoln_api_key" "ci" {
  name        = "ci-deploy-key"
  description = "API key for CI/CD pipeline deployments"
  scopes      = ["compute:write", "network:read", "storage:read"]
  # expires_at is optional. A bare date means end of that day (UTC); RFC3339 is
  # also accepted. A date already in the past is accepted and yields an
  # immediately expired key, so set one that is still ahead of today:
  #   expires_at = "2030-01-01"
  rate_limit = 5000
}

output "api_key_prefix" {
  value = frostmoln_api_key.ci.key_prefix
}

Schema

Required

• name (String) The name of the API key.

Optional

• description (String) A description of the API key.
• expires_at (String) The expiration for the API key. Accepts a bare date (YYYY-MM-DD, interpreted as the end of that day in UTC — e.g. 2027-01-01 becomes 2027-01-01T23:59:59Z) or a full RFC3339 timestamp. The expiry must be at most 2 years in the future — the server rejects a later value with API_KEY_LIFETIME_EXCEEDS_MAX. Note: the fm CLI's --expires uses the operator's local timezone for the end-of-day, so the same bare date may resolve to an instant up to a day apart between the two tools; this provider uses UTC so plans are reproducible across machines. Omit to use the server default (~1 year), which is then reflected in state. Once set, this cannot be changed (changing it replaces the key).
• rate_limit (Number) The rate limit for the API key (requests per minute). Omit to use the server default, which is then reflected in state.
• scopes (List of String) The permission scopes granted to the API key, as <service>:<action> strings (e.g. compute:read, storage:write). At least one is required, and a key can never exceed the permissions of the identity that created it. Grant :read and :write — for almost every service those are the actions enforced, and :write covers every mutation including start/stop/restart. THE EXCEPTION IS THE INTERACTIVE-SESSION SCOPES, WHICH ARE ENFORCED AS THEIR OWN CLASS: sessions:forward (fm forward / the managed-DB console), sessions:pty (a shell inside an instance-access instance) and sessions:write (the managed-Kubernetes API proxy). Nothing substitutes for them — compute:action does not open a shell and kubernetes:* does not open the cluster-API proxy. The global * wildcard is REJECTED (WILDCARD_SCOPE_NOT_ALLOWED) — keys are least-privilege — but a per-service wildcard such as compute:* is accepted. The grantable set with a description of each is served by the platform: read it with the frostmoln_api_key_scopes data source, or fm account api-key scopes. NOTE: identity also ACCEPTS the finer service:resource:action form here, but no service ENFORCES it as a key scope — a key holding only those applies cleanly and is then denied on every call. For per-resource targets, constraints or explicit denies, attach an access policy with frostmoln_iam_policy_attachment instead.

Read-Only

• created_at (String) The timestamp when the API key was created.
• id (String) The unique identifier of the API key.
• key (String, Sensitive) The API key value. Only available after creation; not returned on subsequent reads. Stored in Terraform state in plaintext — sensitive redacts CLI output, not the state file. See the Secrets in Terraform state guide.
• key_prefix (String) The prefix of the API key for identification.
• status (String) The current status of the API key.