# Terraform mongodbatlas_service_account without initial secret > Depth-first rabbithole dossier for Terraform mongodbatlas_service_account without initial secret; source-anchored research pack. Parent: [Atlas Identity Federation and Resource Policy Boundaries](https://llms-explorer.com/tree/mongodb-atlas-identity-policy-frontier-20261001/) · 3 facets · 8 facts · page: https://llms-explorer.com/tree/terraform-mongodbatlas-service-account-without-initial-secret/ ## How it works - [high] Setting `without_initial_secret` to true creates the Service Account without an initial secret, and `secret_expires_after_hours` must not be set in this case; `secret_expires_after_hours` is only set when `without_initial_secret` is false or omitted. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] The Terraform guide creates a new Service Account with `without_initial_secret = true`, requiring provider v2.19.0 or later, and this attribute cannot be set on an existing Service Account. (verified as of 2026-10-15) Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` ## Facts and statements - [low] New Terraform resources `mongodbatlas_service_account` and `mongodbatlas_service_account_secret` were introduced in provider updates #4018 and #4027 respectively. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#tools` - [low] Assigning an organization service account to a project allows the Project Owner to manage the account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` - [low] HCP Terraform uses static IP ranges for features like notifications and VCS connections, retrievable via the IP ranges API, which does not publish ranges for workspaces or Stacks in remote execution mode. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` - [low] IP allowlists define permitted CIDR ranges for connecting to organizations, agent pools, or workspaces. HashiCorp recommends checking the IP Ranges API every 24 hours; the ranges for each feature may overlap, and HashiCorp normally publishes expected changes at least 24 hours in advance, except in an emergency outage or failover. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` - [high] The Service Account secret is returned only the first time after creation, and the Service Account name is a modifiable, non-unique human-readable identifier. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#core` - [low] The `mongodbatlas_service_account` resource supports a list of organization-level roles, and the Service Account can be imported using the format ORG_ID/CLIENT_ID. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/terraform-mongodbatlas-service-account-without-initial-secret-80328810db/rabbithole-synthesis.md#tools` ## Related concepts - Terraform — is a part of Terraform mongodbatlas_service_account without initial secret - secret — is a part of Terraform mongodbatlas_service_account without initial secret - mongodbatlas_service_account — is a part of Terraform mongodbatlas_service_account without initial secret - without — is a part of Terraform mongodbatlas_service_account without initial secret - initial — is a part of Terraform mongodbatlas_service_account without initial secret