API Key Resource: Generate/Ouput API Key & Secret for confluentcloud_service_account object

[jorgenfries]

I have setup automatic creations of clusters, topics, service account, ACL's

However there is no option to output the API key & secret for the service account in the confluentcloud_service_account resource.
This has to be done manually through the portal & copy/paste into our variable sets for the applications using the accounts.

Please provide an option in the next version to generate & output these

Thanks,
Jørgen

[linouk23]

@jorgenfries thanks for opening an issue!

We're aware of this issue (see #4) and we're actively working on it 👌

[PlugaruT]

@linouk23 any ETA regarding this? It defeats the purpose of terraforming everything if it needs manual actions, like creating Kafka API keys to create topics on a cluster.
Thanks

[linouk23]

@PlugaruT that's a great point! We're hoping to close this gap towards the end of the quarter.

[nbommu]

while creating api keys can you stash them in aws Secret Manager or Azure Key Vault etc.. automatically, so that service can pull them during bootstrap?

[linouk23]

@nbommu that's an interesting idea, do you have an example in mind or something?

[s7an-it]

Terraform Vault provider.
Basically you create secret in vault and then rest of the resources source it from it.

[linouk23]

@s7an-it could you share an example of such a workflow? Assume that

resource "confluentcloud_api_key" "kafka-api-key" {}

exports .id, .secret attributes

[linouk23]

@s7an-it, @nbommu, @PlugaruT, @jorgenfries, @czerasz-mineiros, @Caislear, @mikhailznak, @jonathanjuursema, @JWDobken, @YuviGold we're very excited to let you know we've just published a new version of TF Provider that includes api_key resource among other very exciting improvements: it enables fully automated provisioning of our key Kafka workflows (see the demo) with no more manual intervention and makes it our biggest and most impactful release.

The only gotcha we've renamed it from confluentinc/confluentcloud to confluentinc/confluent but we published a migration guide so it should be fairly straightforward. The existing confluentinc/confluentcloud will be deprecated soon so we'd recommend switching as soon as possible.

New confluentinc/confluent provider also includes a lot of sample configurations so you won't need to write them from scratch. You can find them here, find a full list of changes here.