Service account secret rotation

Parent: Atlas Identity Federation and Resource Policy Boundaries · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Service account secret rotation; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Structure and components

[low] Terraform deletes the replaced MongoDB Atlas service account secret as part of the apply process, so manual revocation is not required. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]

How it works

[high] When a MongoDB Atlas service account secret is rotated, the old secret expires within 7 days, or sooner if its original expiration date is less than 7 days from the new secret's creation. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[high] When a MongoDB Atlas service account secret is about to expire, Atlas returns the alert `Service Account Secrets are about to expire`. Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] When the Terraform provider authenticates using the service account being rotated, update the provider credential `MONGODB_ATLAS_CLIENT_SECRET` to the new secret value before the next `terraform plan` or `apply`, or the run fails with `HTTP 401`. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] When importing a MongoDB Atlas service account in Terraform, omit `secretExpiresAfterHours` and `withoutInitialSecret` attributes because Atlas does not populate them during import. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]

Problems, failure modes and limitations

[low] Terraform cannot update a MongoDB Atlas service account secret in place, so rotation requires recreating the `mongodbatlas_service_account_secret` resource using `terraform apply -replace`. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] If the Terraform provider authenticates with the service account secret that the rotation replaces, a plain Terraform replace of the secret fails with an `HTTP 401` error, because it destroys the old secret first, which revokes the OAuth token minted from it, before creating the new one. `create_before_destroy` avoids this. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] MongoDB Atlas service account access tokens have a lifespan of 1 hour (3600 seconds) and cannot be refreshed, but a new token can be generated when the current one is close to expiry. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] In Terraform, `secret_2` needs `depends_on = [mongodbatlas_service_account_secret.secret_1]` to prevent parallel creation that can fail with `HTTP 409 Conflict` (Error code: "DATA_CONCURRENCY_ERROR"). Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]

Comparisons and alternatives

[low] When reading MongoDB Atlas service account secret expiry in Terraform, read each slot's expiry from the data source rather than the resource, as the resource's `expires_at` refreshes only when that specific resource is read. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]

Facts and statements

[low] MongoDB Atlas service account secret rotation supports self-rotation mode (default) using the account's own credentials, or admin-assisted mode using a separate admin credential if self-management permissions are lacking. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[low] During MongoDB Atlas service account secret rotation, the driver creates a new secret via the Atlas Admin API, verifies it by generating an OAuth token, updates the secret, and deletes the old secret. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[low] The Atlas Admin API version for service account secret rotation defaults to `2025-03-12` if not specified, and is used in the `Accept` header as `application/vnd.atlas.{apiVersion}+json`. (verified as of 2026-10-15) Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[high] The `clientId` for a MongoDB Atlas service account must start with `mdb_sa_id_` followed by a 24-character hexadecimal string, and remains constant during secret rotation. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] The `orgId` for MongoDB Atlas service account secret rotation is the 24-character hexadecimal Atlas Organization ID found in Organization Settings. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[low] The `adminSecretArn` parameter for MongoDB Atlas service account secret rotation is the ARN for the secret containing administrative credentials, used only in admin-assisted rotation mode. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[low] In Terraform, `current_credentials` for a MongoDB Atlas service account resolves to the secret slot with the largest `expires_at`, which is the new secret after rotation. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[medium] MongoDB Atlas service account secret rotation is documented in the Guide: Service Account Secret Rotation, introduced in PR #4050. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md [source]
[low] To avoid losing access to the MongoDB Atlas Administration API during service account secret rotation, update your application with the new client secret as soon as possible. Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md [source]
[high] The full client secret for a MongoDB Atlas service account is viewable only once, at creation time. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]
[high] MongoDB Atlas service account secrets expire after a duration set at creation, ranging from 8 hours to 365 days. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[high] A MongoDB Atlas service account can hold at most two secrets, and expired secrets are not deleted automatically. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] MongoDB Atlas revokes an OAuth token as soon as the service account secret that minted it is deleted. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] Replacing `secret_1` in a MongoDB Atlas service account configuration shortens the `expires_at` of `secret_2` to 7 days from the creation of the new `secret_1`. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] An MCP configuration for MongoDB Atlas holds at most two ingress secrets, requiring two secret resources to be defined and replaced alternately for rotation. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
[low] If an organization service account is assigned to a project, the Project Owner can manage the service account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Managing MongoDB Atlas Service Accounts with Terraform exposes sensitive organizational secrets in Terraform’s state, so following Terraform’s best practices is strongly recommended. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]
[low] To create a MongoDB Atlas service account or API keys for an organization, you must have Organization Owner access to that organization. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] If a project-level MongoDB Atlas service account has access to the organization or other projects, you must have the Organization Owner role to manage its lifecycle. Sources: https://www.mongodb.com/docs/atlas/tutorial/rotate-service-account-secrets.md [source]
[low] MongoDB Atlas service account authentication uses OAuth2 client_credentials. Sources: https://raw.githubusercontent.com/ansible-collections/community.mongodb/master/plugins/modules/mongodb_atlas_oidc_user.py [source]

Related concepts

Service — is a part of Service account secret rotation
account — is a part of Service account secret rotation
secret — is a part of Service account secret rotation
rotation — is a part of Service account secret rotation

Children

No children recorded.

← the whole tree · 3D view· how to read this page