workspace_service_account_tokens

Creates, updates, deletes, gets or lists a workspace_service_account_tokens resource.

Overview

Name	workspace_service_account_tokens
Type	Resource
Id	aws.grafana.workspace_service_account_tokens

Fields

The following fields are returned by SELECT queries:

list_workspace_service_account_tokens

Name	Datatype	Description
id	string	The unique ID of the service account token.
name	string	The name of the service account token.
created_at	string (date-time)	When the service account token was created.
expires_at	string (date-time)	When the service account token will expire.
last_used_at	string (date-time)	The last time the token was used to authorize a Grafana HTTP API.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_workspace_service_account_tokens	select	service_account_id, workspace_id, region	maxResults, nextToken	Returns a list of tokens for a workspace service account. This does not return the key for each token. You cannot access keys after they are created. To create a new key, delete the token and recreate it. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.
create_workspace_service_account_token	insert	service_account_id, workspace_id, region, name, secondsToLive		Creates a token that can be used to authenticate and authorize Grafana HTTP API operations for the given workspace service account. The service account acts as a user for the API operations, and defines the permissions that are used by the API. When you create the service account token, you will receive a key that is used when calling Grafana APIs. Do not lose this key, as it will not be retrievable again. If you do lose the key, you can delete the token and recreate it to receive a new key. This will disable the initial key. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.
delete_workspace_service_account_token	delete	token_id, service_account_id, workspace_id, region		Deletes a token for the workspace service account. This will disable the key associated with the token. If any automation is currently using the key, it will no longer be authenticated or authorized to perform actions with the Grafana HTTP APIs. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
service_account_id	string	The ID of the service account from which to delete the token.
token_id	string	The ID of the token to delete.
workspace_id	string	The ID of the workspace from which to delete the token.
maxResults	integer	The maximum number of tokens to include in the results.
nextToken	string	The token for the next set of service accounts to return. (You receive this token from a previous ListWorkspaceServiceAccountTokens operation.)

SELECT examples

list_workspace_service_account_tokens

Returns a list of tokens for a workspace service account. This does not return the key for each token. You cannot access keys after they are created. To create a new key, delete the token and recreate it. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.

SELECT
id,
name,
created_at,
expires_at,
last_used_at
FROM aws.grafana.workspace_service_account_tokens
WHERE service_account_id = '{{ service_account_id }}' -- required
AND workspace_id = '{{ workspace_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_workspace_service_account_token

Creates a token that can be used to authenticate and authorize Grafana HTTP API operations for the given workspace service account. The service account acts as a user for the API operations, and defines the permissions that are used by the API. When you create the service account token, you will receive a key that is used when calling Grafana APIs. Do not lose this key, as it will not be retrievable again. If you do lose the key, you can delete the token and recreate it to receive a new key. This will disable the initial key. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.

INSERT INTO aws.grafana.workspace_service_account_tokens (
name,
secondsToLive,
service_account_id,
workspace_id,
region
)
SELECT 
'{{ name }}' /* required */,
{{ secondsToLive }} /* required */,
'{{ service_account_id }}',
'{{ workspace_id }}',
'{{ region }}'
RETURNING
service_account_id,
service_account_token,
workspace_id
;

Manifest

# Description fields are for documentation purposes
- name: workspace_service_account_tokens
props:
  - name: service_account_id
    value: "{{ service_account_id }}"
    description: Required parameter for the workspace_service_account_tokens resource.
  - name: workspace_id
    value: "{{ workspace_id }}"
    description: Required parameter for the workspace_service_account_tokens resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the workspace_service_account_tokens resource.
  - name: name
    value: "{{ name }}"
  - name: secondsToLive
    value: {{ secondsToLive }}

DELETE examples

delete_workspace_service_account_token

Deletes a token for the workspace service account. This will disable the key associated with the token. If any automation is currently using the key, it will no longer be authenticated or authorized to perform actions with the Grafana HTTP APIs. Service accounts are only available for workspaces that are compatible with Grafana version 9 and above.

DELETE FROM aws.grafana.workspace_service_account_tokens
WHERE token_id = '{{ token_id }}' --required
AND service_account_id = '{{ service_account_id }}' --required
AND workspace_id = '{{ workspace_id }}' --required
AND region = '{{ region }}' --required
;