[Enhancement]: Service Account Resource for Managed Grafana

[lorrrrrrrenzo]

Description

The recent release of Managed Grafana 10 introduces the ability to use Grafana Service Accounts and Service Account Tokens for improved authn/z. I am proposing that support for this new authentication method be added to the AWS provider, with an eye towards making sure it integrates well with the Grafana provider, which according to its documentation, already supports authentication with Service Account Tokens.

Affected Resource(s) and/or Data Source(s)

• aws_grafana_workspace
• aws_grafana_service_account (new)

Potential Terraform Configuration

resource "aws_grafana_workspace" "example" {
  account_access_type      = "CURRENT_ACCOUNT"
  authentication_providers = ["SAML"]
  permission_type          = "SERVICE_MANAGED"
  role_arn                 = aws_iam_role.assume.arn
}

resource "aws_grafana_service_account" "example_admin" {
  workspace_id = aws_grafana_workspace.example.id
  role = "ADMIN"
}

// service account tokens can be created programmatically as needed with 
// aws grafana create-workspace-service-account-token, as part of CI

References

https://registry.terraform.io/providers/grafana/grafana/latest/docs

https://aws.amazon.com/blogs/mt/amazon-managed-grafana-announces-support-for-grafana-version-10-4
(Look at the section "Service Accounts and new APIs" for an example of the new authentication flow)

https://grafana.com/docs/grafana/v10.4/administration/service-accounts/

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[aristosvo]

I'll try to pick this up. This requires a move to SDK v2, I'll pick that up first.

[lorrrrrrrenzo]

@aristosvo I'm happy to hear that you're taking this on! Just out of technical curiosity, what introduces the requirement to move to SDK v2? I'm taking a look at the AWS SDK (assuming that is what you're referring to) and it seems like AMG service accounts are supported by it? For instance, I see that CreateWorkspaceServiceAccountInput is available, along with all of the expected functions.

Thanks again!

[aristosvo]

Hi @lorrrrrrrenzo 👋

The reason is explained in this issue, new resources are not accepted when using the old SDK.

[lorrrrrrrenzo]

Great to know, thanks @aristosvo!

[aristosvo]

Hi @lorrrrrrrenzo!

I think this one can be closed, as #37645 is an extended duplicate of this one.

In the meantime the AWS SDK Go PR is ready for review, so things are in progress 👍🏽

[lorrrrrrrenzo]

Closing this, as it's a duplicate of #37645.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.