# Terraform Integration > Depth-first rabbithole dossier for Terraform Integration; source-anchored research pack. Parent: [Atlas Service Accounts](https://llms-explorer.com/tree/atlas-service-accounts/) · 5 facets · 29 facts · page: https://llms-explorer.com/tree/terraform-integration/ ## Definitions - [low] Service Account Authentication is the recommended configuration method for the Atlas Terraform provider. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` ## How it works - [low] The compute_max_instance_size attribute is required when compute_enabled is set to true. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Distribute Terraform executions across different IP addresses because rate limits apply per IP and SA client combination. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#patterns` ## Problems, failure modes and limitations - [low] The database_edition attribute can be set on the mongodbatlas_advanced_cluster resource during creation but cannot be changed afterward, and dedicated clusters cannot be scaled back to Free or Flex clusters. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] The storage_config.shard_size_limit_gb attribute is required only if storage_config is included; otherwise, Atlas applies the default maximum storage limit. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Ephemeral values are available at runtime but omitted from state and plan files, and cannot be added to outputs in the root module. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` ## Comparisons and alternatives - [low] Update provider attributes or environment variables to use Service Account credentials instead of PAK credentials, then run terraform plan to verify correctness. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#methodology` ## Facts and statements - [low] The Atlas Terraform provider supports any MongoDB version that Atlas supports in the specified project and region. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] The Organization Owner role is required to view the Organization ID, manage service accounts, and create or delete clusters and other project resources. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Atlas Service Account client ID and client secret are secrets; consider storing them as environment variables. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] The database_edition attribute is unavailable for Free clusters (such as M0) and Flex clusters. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] To create a dedicated cluster on Atlas Infinite, set database_edition to "INFINITE" and enable compute_enabled in auto_scaling. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Dedicated Atlas Infinite clusters support only the REPLICASET cluster type. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] M30+ Atlas Infinite clusters are available only on AWS Gen2, requiring the _GEN_2 suffix in the tier name (e.g., M60_GEN_2). Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Atlas Infinite clusters have two electable compute nodes (primary and standby), so node_count must be set to 2. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] The Atlas Terraform provider updates status every ten seconds until the operation is complete. Sources: https://www.mongodb.com/docs/atlas/terraform.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Use Terraform 0.15 or later to add the sensitive argument to variable and output blocks. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Use Terraform 1.10 or later to add the ephemeral argument to variables and child module outputs, or add the ephemeral block. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Use Terraform 1.11 or later to use a write-only argument on a managed resource. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Write-only arguments typically end with _wo and have corresponding _wo_version arguments, and neither write-only arguments nor ephemeral blocks persist outside the current Terraform run. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#core` - [low] Running terraform apply finalizes the migration to Service Accounts by deleting the PAK resources from Atlas. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#tools` - [low] The Service Account used for provider authentication should be created in a separate Terraform configuration or managed outside of Terraform to avoid lockout scenarios. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#patterns` - [low] HCP Terraform encrypts state at rest, allows custom encryption keys, and protects state with TLS in transit. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#patterns` - [low] The S3 backend can encrypt state at rest if the encrypt option is enabled, and protects state with TLS in transit. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#patterns` - [high] Managing Service Accounts with Terraform exposes sensitive organizational secrets in Terraform's state. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount/, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#antipatterns` - [low] Terraform stores values with the sensitive argument in both state and plan files, exposing them to anyone with file access. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#antipatterns` - [low] Tools default to the application/vnd.atlas.2025-03-12+json resource version, and Atlas returns a 406 status code if the header is missing or names a nonexistent version. (verified as of 2026-10-15) Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#troubleshooting` - [low] Service account access tokens can only be used from IPs listed in the service account's API access list. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#troubleshooting` - [low] Using the terraform output CLI command with -json or -raw flags displays sensitive variables and outputs in plain text. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-integration-83fef6ba88/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Terraform — is a part of Terraform Integration - Integration — is a part of Terraform Integration