Skip to main content

conveyor_service_account (Resource)

A service account: a stable machine identity that credential tokens nest under. Permissions are bound to the service account itself, so rotating its tokens never touches its grants.

Example Usage​

resource "conveyor_service_account" "my_service_account" {
  name            = "my_service_account"
  type            = "scoped"
  project_ids     = [conveyor_project.my_project.id]
  environment_ids = [conveyor_environment.my_environment.id]
}

Schema​

Required​

  • name (String) The name of the service account. Must be unique within the tenant. Renaming is not supported: changing this value destroys and recreates the service account, along with any tokens created under it.
  • type (String) The type of the service account. Valid values: scoped, admin. An admin service account bypasses project/environment scoping entirely, so changing between scoped and admin destroys and recreates the resource rather than silently escalating privileges in place.

Optional​

  • environment_ids (Set of String) The ids of the environments this service account is scoped to. Must be empty when type = "admin". Can be changed in place; existing tokens are unaffected.
  • project_ids (Set of String) The ids of the projects this service account is scoped to. Must be empty when type = "admin". Can be changed in place; existing tokens are unaffected.

Read-Only​

  • id (String) The id of the service account.

Import​

Import is supported using the following syntax:

export SERVICE_ACCOUNT_ID=$(conveyor service-account get --name my_service_account -ojson | jq -r ".id")
terraform import conveyor_service_account.my_service_account "$SERVICE_ACCOUNT_ID"