Add Resource for Token Management

[aschaber1]

Current Provider Version

OpenTofu v1.10.6
on darwin_arm64
+ provider registry.opentofu.org/ionos-cloud/ionoscloud v6.7.14

Use-cases

I want to use terraform to create a token to be used by external-dns.

Attempted Solutions

Proposal

Create a resource for creating api tokens.

References

• https://dcd.ionos.com/latest/#/tokens
• https://docs.ionos.com/cloud/set-up-ionos-cloud/management/identity-access-management/token-manager

[mimihalescu]

Hi,

Thank you for opening this issue and for sharing your use case!

Currently, API tokens can be created either through the Data Center Designer (DCD) or via ionosctl using username and password authentication.
The ionosctl option is available only for users without 2-Factor Authentication (2FA).

Because Terraform runs non-interactively and cannot go through the secure 2FA process, we don’t plan to introduce a Terraform resource for creating tokens at this time.

For now, we recommend one of the following options:

• Create a long-lived token in DCD (for example, valid for up to 3 months) and use it in your Terraform setup or with tools such as external-dns. When it expires, you can manually generate a new one in DCD.
• Create a dedicated automation user with limited privileges and use that account with basic auth for automation tasks, if applicable to your setup.

In the future, these concepts will be revisited and improved (for example, by adding API support for token refresh), taking into consideration customer usage and feedback.

Thank you for your understanding and for the feedback!

[aschaber1]

Hello,

thank you for taking the time to respond.

We currently create a terraform user, give it the required permissions (currently admin, we hope to slim that down in the future), and then via terraform want to create multiple users with less privileges and their api tokens to be used different applications.

Now the approach is:

• Create a terraform user (manually)
• Create a token for terraform (manually - fine so far)
• Create other users via terraform (cool :) )
• Create s3 access keys for them (still fine and pretty happy about all this)

But now there's external-dns:

• Create token for external-dns user manually
• Rotate this token manually

That's what not so cool. Even if token refresh wasn't available, I'd gladly manually taint the resource on a schedule and let it recreate one. That's still better than creating and rotating the token via clickops.

In regard to your recommendations:

1. we do this for terraform (which is fine), we would like to do this as well for external-dns but programatically.
2. this means we need a different tool (possibly a pipeline) to automate this and we'd have a media-break / tool-break in the middle. And we need to store the generated token somewhere (for which IONOS doesn't have a secret store). All in all, doable but far from great.

Looking forward to the API support for token refresh becoming available.