frostmoln_s3_credential (Resource)

Manages an S3 credential in the Frostmoln platform. Credentials are immutable: changing the name, description, or any scope attribute (allowed_buckets/allowed_actions/ip_whitelist) replaces the credential and issues a new secret_access_key, so update any downstream consumers. Per-credential scoping requires the RGW-IAM object-storage backend.

Example Usage

resource "frostmoln_s3_credential" "example" {
  name        = "app-s3-access"
  description = "S3 credentials for application backend"

  # Scope the credential — omitting these grants ALL buckets and ALL actions.
  # Every scope attribute is ForceNew: changing one replaces the credential and
  # issues a new secret_access_key.
  allowed_buckets = [frostmoln_bucket.example.name]
  allowed_actions = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
}

output "s3_access_key_id" {
  value = frostmoln_s3_credential.example.id
}

output "s3_secret_key" {
  value     = frostmoln_s3_credential.example.secret_access_key
  sensitive = true
}

Schema

Required

• name (String) The name of the S3 credential.

Optional

• allowed_actions (List of String) S3 actions this credential may perform, e.g. s3:GetObject. Empty/unset = ALL actions — set it to apply least privilege. Bucket-metadata writes (s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutBucketTagging) are not grantable and are rejected. Changing this replaces the credential.
• allowed_buckets (List of String) Buckets this credential may access. Empty/unset = ALL buckets in the tenant's account — set it to apply least privilege. Changing this replaces the credential.
• description (String) A description of the S3 credential.
• ip_whitelist (List of String) Source IPs/CIDRs this credential is restricted to (empty/unset = any source IP). Changing this replaces the credential.

Read-Only

• created_at (String) The timestamp when the S3 credential was created.
• id (String) The access key ID of the S3 credential — the identifier used with secret_access_key when talking to the S3 endpoint, and the value to pass to terraform import.
• secret_access_key (String, Sensitive) The secret access key. Only returned when the credential is first created.
• status (String) The status of the S3 credential.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# S3 credentials are imported by their access key ID.
# secret_access_key is NOT recoverable on import - the API returns it only when
# the credential is created. Rotate or replace the credential if you need it.
terraform import frostmoln_s3_credential.example <access-key-id>