Terraform mongodbatlas_service_account without initial secret
Parent: Atlas Identity Federation and Resource Policy Boundaries · Published reference · snapshot 2026-10-15
↓ Facts as markdownall context files
Depth-first rabbithole dossier for Terraform mongodbatlas_service_account without initial secret; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- [high] Setting `without_initial_secret` to true creates the Service Account without an initial secret, and `secret_expires_after_hours` must not be set in this case; `secret_expires_after_hours` is only set when `without_initial_secret` is false or omitted. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]
Problems, failure modes and limitations
- [low] The Terraform guide creates a new Service Account with `without_initial_secret = true`, requiring provider v2.19.0 or later, and this attribute cannot be set on an existing Service Account. (verified as of 2026-10-15) Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/service-account-secret-rotation.md [source]
Facts and statements
- [low] New Terraform resources `mongodbatlas_service_account` and `mongodbatlas_service_account_secret` were introduced in provider updates #4018 and #4027 respectively. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md [source]
- [low] Assigning an organization service account to a project allows the Project Owner to manage the account, including rotating secrets and updating IP access lists. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
- [low] HCP Terraform uses static IP ranges for features like notifications and VCS connections, retrievable via the IP ranges API, which does not publish ranges for workspaces or Stacks in remote execution mode. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges [source]
- [low] IP allowlists define permitted CIDR ranges for connecting to organizations, agent pools, or workspaces. HashiCorp recommends checking the IP Ranges API every 24 hours; the ranges for each feature may overlap, and HashiCorp normally publishes expected changes at least 24 hours in advance, except in an emergency outage or failover. Sources: https://developer.hashicorp.com/terraform/cloud-docs/architectural-details/ip-ranges [source]
- [high] The Service Account secret is returned only the first time after creation, and the Service Account name is a modifiable, non-unique human-readable identifier. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md, https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]
- [low] The `mongodbatlas_service_account` resource supports a list of organization-level roles, and the Service Account can be imported using the format ORG_ID/CLIENT_ID. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount [source]
Related concepts
- Terraform — is a part of Terraform mongodbatlas_service_account without initial secret
- secret — is a part of Terraform mongodbatlas_service_account without initial secret
- mongodbatlas_service_account — is a part of Terraform mongodbatlas_service_account without initial secret
- without — is a part of Terraform mongodbatlas_service_account without initial secret
- initial — is a part of Terraform mongodbatlas_service_account without initial secret
Children
- No children recorded.