Terraform Integration

Parent: Atlas Service Accounts · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Terraform Integration; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] Service Account Authentication is the recommended configuration method for the Atlas Terraform provider. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]

How it works

[low] The compute_max_instance_size attribute is required when compute_enabled is set to true. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Distribute Terraform executions across different IP addresses because rate limits apply per IP and SA client combination. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md [source]

Problems, failure modes and limitations

[low] The database_edition attribute can be set on the mongodbatlas_advanced_cluster resource during creation but cannot be changed afterward, and dedicated clusters cannot be scaled back to Free or Flex clusters. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] The storage_config.shard_size_limit_gb attribute is required only if storage_config is included; otherwise, Atlas applies the default maximum storage limit. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Ephemeral values are available at runtime but omitted from state and plan files, and cannot be added to outputs in the root module. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]

Comparisons and alternatives

[low] Update provider attributes or environment variables to use Service Account credentials instead of PAK credentials, then run terraform plan to verify correctness. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md [source]

Facts and statements

[low] The Atlas Terraform provider supports any MongoDB version that Atlas supports in the specified project and region. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] The Organization Owner role is required to view the Organization ID, manage service accounts, and create or delete clusters and other project resources. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Atlas Service Account client ID and client secret are secrets; consider storing them as environment variables. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] The database_edition attribute is unavailable for Free clusters (such as M0) and Flex clusters. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] To create a dedicated cluster on Atlas Infinite, set database_edition to "INFINITE" and enable compute_enabled in auto_scaling. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Dedicated Atlas Infinite clusters support only the REPLICASET cluster type. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] M30+ Atlas Infinite clusters are available only on AWS Gen2, requiring the _GEN_2 suffix in the tier name (e.g., M60_GEN_2). Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Atlas Infinite clusters have two electable compute nodes (primary and standby), so node_count must be set to 2. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] The Atlas Terraform provider updates status every ten seconds until the operation is complete. Sources: https://www.mongodb.com/docs/atlas/terraform.md [source]
[low] Use Terraform 0.15 or later to add the sensitive argument to variable and output blocks. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] Use Terraform 1.10 or later to add the ephemeral argument to variables and child module outputs, or add the ephemeral block. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] Use Terraform 1.11 or later to use a write-only argument on a managed resource. (verified as of 2026-10-15) Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] Write-only arguments typically end with _wo and have corresponding _wo_version arguments, and neither write-only arguments nor ephemeral blocks persist outside the current Terraform run. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] Running terraform apply finalizes the migration to Service Accounts by deleting the PAK resources from Atlas. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md [source]
[low] The Service Account used for provider authentication should be created in a separate Terraform configuration or managed outside of Terraform to avoid lockout scenarios. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md [source]
[low] HCP Terraform encrypts state at rest, allows custom encryption keys, and protects state with TLS in transit. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] The S3 backend can encrypt state at rest if the encrypt option is enabled, and protects state with TLS in transit. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[high] Managing Service Accounts with Terraform exposes sensitive organizational secrets in Terraform's state. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount/, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md [source]
[low] Terraform stores values with the sensitive argument in both state and plan files, exposing them to anyone with file access. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]
[low] Tools default to the application/vnd.atlas.2025-03-12+json resource version, and Atlas returns a 406 status code if the header is missing or names a nonexistent version. (verified as of 2026-10-15) Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] Service account access tokens can only be used from IPs listed in the service account's API access list. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] Using the terraform output CLI command with -json or -raw flags displays sensitive variables and outputs in plain text. Sources: https://developer.hashicorp.com/terraform/language/state/sensitive-data [source]

Related concepts

Terraform — is a part of Terraform Integration
Integration — is a part of Terraform Integration

Children

No children recorded.

← the whole tree · 3D view· how to read this page