Skip to main content

tharsis_service_account

Defines and manages a service account.

Example Usage​

resource "tharsis_service_account" "this" {
  name        = "my-service-account"
  description = "A service account for CI."
  group_id    = tharsis_group.top_level.id

  oidc_trust_policies = [
    {
      issuer = "https://gitlab.com"
      bound_claims = {
        "sub" = "project_path:my-org/my-project:ref_type:branch:ref:main"
      }
    }
  ]
}

Behavior​

  • Service accounts are used for machine-to-machine authentication, such as from CI/CD pipelines.
  • A service account is created within a group.
  • It authenticates through OIDC trust policies. Each policy specifies an issuer URL (for example https://gitlab.com) and bound_claims, which are checked against the token issued by the identity provider.
  • A service account has no access until it is added as a member of a group or workspace with a role. Memberships are not managed by this provider. The deployer role is generally sufficient.

Permissions​

Editing a service account that has memberships requires the owner role in every group and workspace where it is a member.

Schema​

Required​

  • description (String) A description of the service account.
  • name (String) The name of the service account.
  • oidc_trust_policies (Attributes List) OIDC trust policies for this service account. (see below for nested schema)

Optional​

  • group_id (String) The ID or TRN of the parent group.
  • group_path (String, Deprecated) Path of the parent group.

Read-Only​

  • id (String) String identifier of the service account.
  • resource_path (String, Deprecated) The path of the parent namespace plus the name of the service account.

Nested Schema for oidc_trust_policies​

Required:

  • bound_claims (Map of String) Bound claims for this trust policy.
  • issuer (String) Issuer for this trust policy.