Skip to main content

okustera_s3_credentials (Resource)

The okustera_s3_credentials resource generates and manages S3-compatible API access keys for Ceph RADOS Gateway (RGW) object storage. The resulting secret credentials can be retrieved securely by downstream Terraform resources and are escrowed safely into OpenStack Barbican.

Example Usage​

Generate S3 Credentials for Application Service Account​

resource "okustera_s3_credentials" "app_s3_keys" {
  username = "app-backup-service"
}

output "s3_access_key" {
  value       = okustera_s3_credentials.app_s3_keys.access_key
  description = "S3 Access Key ID"
}

output "s3_secret_key" {
  value       = okustera_s3_credentials.app_s3_keys.secret_key
  sensitive   = true
  description = "S3 Secret Access Key"
}

output "barbican_ref" {
  value       = okustera_s3_credentials.app_s3_keys.barbican_secret_ref
  description = "OpenStack Barbican Secret Reference URI"
}

Schema​

Required​

  • username (String) Tenant username for whom S3 keys are created.

Read-Only Attributes​

  • id (String) Unique credential identifier.
  • access_key (String) S3 Access Key ID.
  • secret_key (String, Sensitive) S3 Secret Access Key.
  • barbican_secret_ref (String) OpenStack Barbican Secret URL storing the key pair for automated secret rotation.
  • status (String) Status of the credentials (Active, Suspended).

Import​

Existing S3 credentials can be imported using their identifier:

terraform import okustera_s3_credentials.app_s3_keys <credential_id>