Add resource to create an API key for managed grafana

[allenhumphreys]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I'm trying to create a managed Grafana instance using the AWS provider and then manage the Grafana dashboards/etc using the Grafana provider.

In order for the Grafana provider to authenticate with the Grafana instance, it needs to have an API key. As part of my infrastructure configuration, I'd like to ensure my Grafana provider can have access to an API.

The goal would be to use aws_grafana_workspace_api_key to create an admin key, store it in Secrets Manager, and then read that value as part of my Dashboard terraform configuration.

New or Affected Resource(s)

• aws_grafana_workspace_api_key
• aws_grafana_workspace (needs to export the workspace_id for use with the new resource)

Potential Terraform Configuration

resource "aws_grafana_workspace" "example" {
  account_access_type      = "CURRENT_ACCOUNT"
  authentication_providers = ["SAML"]
  permission_type          = "SERVICE_MANAGED"
  role_arn                 = aws_iam_role.assume.arn
}

resource "aws_grafana_workspace_api_key" "terraform" {
  workspace_id = aws_grafana_workspace.example.workspace_id
  name            = "${var.environment}-terraform-api-key"
  role            = "Admin"
  seconds_to_live = 2592000 ### 1 month
}

resource "aws_secretsmanager_secret" "grafana-key" {
  name                    = "${var.environment}-grafana-key"
  recovery_window_in_days = 0
}

resource "aws_secretsmanager_secret_version" "grafana-key" {
  secret_id     = aws_secretsmanager_secret.grafana-key.id
  secret_string = jsonencode({
    key   = "${var.environment}-grafana-secret"
    value = aws_grafana_workspace_api_key.terraform
  })
}

References

• Create a workspace key: https://docs.aws.amazon.com/grafana/latest/APIReference/API_CreateWorkspaceApiKey.html)
• Delete a workspace key: https://docs.aws.amazon.com/grafana/latest/APIReference/API_DeleteWorkspaceApiKey.html

[bschaatsbergen]

Hi @allenhumphreys, thanks for raising this issue. I'll happily look into this.

[allenhumphreys]

@bschaatsbergen that’s amazing, your time is appreciated!

[bschaatsbergen]

With a pleasure @allenhumphreys, the PR is out 🚀 !

[allenhumphreys]

Turns out this was a duplicate of #25100 all along

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.