qumulo_s3_access_key (Resource)

Manages an S3 access key on a Qumulo cluster.

S3 access keys are immutable - any change to the user identity will require replacing the key. The secret access key is only available at creation time and is stored in Terraform state.

Important: The secret_access_key is sensitive and will be stored in Terraform state. Ensure your state backend is properly secured.

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic Access Key for Local User

resource "qumulo_s3_access_key" "app" {
  connection_profile = "prod"

  user {
    domain = "LOCAL"
    name   = "app-user"
  }
}

output "access_key_id" {
  value = qumulo_s3_access_key.app.access_key_id
}

output "secret_access_key" {
  value     = qumulo_s3_access_key.app.secret_access_key
  sensitive = true
}

Access Key for POSIX User

resource "qumulo_s3_access_key" "posix" {
  connection_profile = "prod"

  user {
    domain = "POSIX_USER"
    uid    = 1001
  }
}

Access Key for Active Directory User

resource "qumulo_s3_access_key" "ad" {
  connection_profile = "prod"

  user {
    domain = "ACTIVE_DIRECTORY"
    name   = "DOMAIN\\app-service"
  }
}

Multi-Cluster with for_each

variable "clusters" {
  type    = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_s3_access_key" "app" {
  for_each = var.clusters

  connection_profile = each.value

  user {
    domain = "LOCAL"
    name   = "app-user"
  }
}

Schema

Required

• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

Optional

• user (Block, Optional) The user identity that requests with this access key will use for file system operations. (see below for nested schema)

Read-Only

• access_key_id (String) The access key ID to use in S3 API requests.
• creation_time (String) The creation time of the access key in ISO 8601 format.
• secret_access_key (String, Sensitive) The secret access key for signing S3 requests. Only available at creation time.

Nested Schema for user

Optional:

• domain (String) The authentication domain. Valid values: LOCAL, ACTIVE_DIRECTORY, POSIX_USER. Use LOCAL for local cluster users, ACTIVE_DIRECTORY for AD users, POSIX_USER for NFS-style UIDs.
• name (String) The username for LOCAL or ACTIVE_DIRECTORY domains. For AD users, use the format 'DOMAIN\username' or 'username@domain'.
• sid (String) The Windows Security Identifier (SID) for the user.
• uid (Number) The POSIX user ID for POSIX_USER domain.