search

Mongey / terraform-provider-confluentcloud

A Terraform provider for managing resource in confluent.cloud
MIT License
110 stars 47 forks source link

Add support for service accounts #8

Closed Nevon closed 4 years ago

Nevon commented 4 years ago

This provider currently doesn't allow you to manage service accounts. I have opened a PR towards cgroschupp/go-client-confluent-cloud/pull/2 to add support for it to the client, after which it could be added to this provider.

Mongey commented 4 years ago

What is a service account? I can't see anything in the UI...

Nevon commented 4 years ago

I don't know if it's exposed in the UI, but it is through the CLI. https://docs.confluent.io/current/cloud/access-management/service-account.html

The service accounts are essentially principals in the confluent cloud terminology. This is the message I got from their support when I was trying to figure out the relationship between user accounts, service accounts and api keys, and how they mapped to principals in acls:

This is briefly how Confluent Cloud application access works: API keys are scoped at the cluster level, but it's possible to create service accounts and apply ACLs on them. A service account needs to be created for a specific application, then associate to it a cluster API key and apply ACLs in order to restrict access, for example to a specific topic. Here are described the available options to manage Confluent Cloud access and in this tutorial steps 7 and 8 are showing how to set service accounts, api keys and ACLs. Service Accounts can be considered the CCloud "principals" and we use the ID to reference them. The service account credentials to hand over to the application is the API-Key/Secret. CCloud service accounts, API keys and ACLs can be managed only through the CCloud CLI, so it seems the Terraform provider you are using is not compatible with Confluent Cloud access.

zalyoung commented 4 years ago

Has this PR merged and released? We also want this feature