frostmoln_s3_credential (Resource)

Manages an S3 credential in the Frostmoln platform. Credentials are immutable: changing the name, description, or any scope attribute (allowed_buckets/allowed_actions/ip_whitelist) replaces the credential and issues a new secret_access_key, so update any downstream consumers. Per-credential scoping requires an IAM-capable object-storage backend.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Create-immutable — allowed_actions, allowed_buckets, description, ip_whitelist, name: a credential has no update route — changing what it may do re-mints it and issues a new secret.

Observed, not enacted — secret_access_key: returned once at create and never again — a refresh cannot read it back.

Example Usage

resource "frostmoln_s3_credential" "example" {
  name        = "app-s3-access"
  description = "S3 credentials for application backend"

  # Scope the credential — omitting these grants ALL buckets and ALL actions.
  # Every scope attribute is ForceNew: changing one replaces the credential and
  # issues a new secret_access_key.
  allowed_buckets = [frostmoln_bucket.example.name]
  allowed_actions = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
}

output "s3_access_key_id" {
  value = frostmoln_s3_credential.example.id
}

output "s3_secret_key" {
  value     = frostmoln_s3_credential.example.secret_access_key
  sensitive = true
}

Schema

Required

• name (String) The name of the S3 credential.

Optional

• allowed_actions (List of String) S3 actions this credential may perform, e.g. s3:GetObject. Empty/unset = ALL actions — set it to apply least privilege. Bucket-metadata writes (s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutBucketTagging) are not grantable and are rejected. Changing this replaces the credential.
• allowed_buckets (List of String) Buckets this credential may access. Empty/unset = ALL buckets in the tenant's account — set it to apply least privilege. Changing this replaces the credential.
• description (String) A description of the S3 credential.
• ip_whitelist (List of String) Source IPs/CIDRs to restrict this credential to. TEMPORARILY UNAVAILABLE: must be empty or unset (= any source IP). The platform refuses a non-empty list, and so does terraform plan, before the credential is replaced. Changing this replaces the credential.

Read-Only

• created_at (String) The timestamp when the S3 credential was created.
• id (String) The access key ID of the S3 credential — the identifier used with secret_access_key when talking to the S3 endpoint, and the value to pass to terraform import.
• secret_access_key (String, Sensitive) The secret access key. Only returned when the credential is first created. Stored in Terraform state in plaintext — sensitive redacts CLI output, not the state file. See the Secrets in Terraform state guide.
• status (String) The status of the S3 credential.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# S3 credentials are imported by their access key ID.
# secret_access_key is NOT recoverable on import - the API returns it only when
# the credential is created. Rotate or replace the credential if you need it.
terraform import frostmoln_s3_credential.example <access-key-id>