Terraform Import for “google_service_account_key”
By: Ravish Kumar
Tags: Gcp Service Account Key, Terraform Import, Google Cloud Platform, Terraform State File, Terraform

Terraform is a popular and widely accepted tool for provisioning, changing, and versioning infrastructure efficiently. Today I will talk about the “import” feature of terraform.

If resources are created by some other tools and there is a need to bring it under Terraform management then, use “import”. This feature allows for the slow transition of the existing infrastructure to Terraform.

More Info: https://www.terraform.io/docs/import/index.html

Problem Statement:

Need to perform terraform import for “google_service_account_key”.

Officially terraform DO NOT support import for this resource. But I have found a tricky manual way to do it.

More Info: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key

Solution:

Creating a State file for the service account key is a little tricky as there is no direct command to import it. Here I will walk through all the required fields of the state file.

Assumption: Google Service Account Key which needs to be imported, is available as Json file.

The skeleton for the State file should look as below. Let’s talk about each line.

1 "google_service_account_key.sample_sa_key": { 2 "type": "google_service_account_key", 3 "depends_on": [ 4 "google_project_iam_member.<dependent_resource_if_any>" 5 ], 6 "primary": { 7 "id": "projects/<project_name>/serviceAccounts/<client_email>/keys/<private_key_id>", 8 "attributes": { 9 "id": "projects/<project_name>/serviceAccounts/<client_email>/keys/<private_key_id>", 10 "key_algorithm": "KEY_ALG_RSA_2048", 11 "name": "projects/<project_name>/serviceAccounts/<client_email>/keys/<private_key_id>", 12 "private_key": "<Interpolate1>", 13 "private_key_type": "TYPE_GOOGLE_CREDENTIALS_FILE", 14 "public_key": "<Interpolate2>", 15 "public_key_type": "TYPE_X509_PEM_FILE", 16 "service_account_id": "projects/<project_name>/serviceAccounts/<client_email>", 17 "valid_after": "2020-11-29T10:18:55Z", 18 "valid_before": "2030-11-27T10:18:55Z" 19 }, 20 "meta": {}, 21 "tainted": false 22 }, 23 "deposed": [], 24 "provider": "provider.google" 25 },

Line 1 — Replace string “sample_sa_key” with the name of the resource. It can be a relevant service account key name.

Line 2 — Type of resource. No change required.

Line 3 — Replace string “dependent_resource_if_any” with dependent resource iam member (if any).

Line 7— Replace “project_name” with GCP Project name. Replace “client_email” with same as present in JSON file. Replace “private_key_id” with the same present in the JSON file.

The value of Line 7 (“key”: “value”) needs to be repeated at lines 9 and 11.

Line 12 — Replace string “Interpolate1” with base64 encoded value of JSON file.

Line 14 — Replace string “Interpolate2” with the public key.

Google ensures that all public keys for all service accounts are publicly accessible by anyone and available to verify signatures that are created with the private key. The public key is publicly accessible. Use curl to find out the public key.

$ curl "https://www.googleapis.com/service_accounts/v1/metadata/x509/<client_email>" -H "Metadata-Flavor: Google"

This will return the list of all public keys available for the given “client_email”.

Pick the value (“key”: “value”) whose key matches “private_key_id” in the JSON file. Perform base64 encoding of the “value” and replace string “Interpolate2”.

Line 16 — Replace “project_name” with GCP Project name. Replace “client_email” with the same present in the JSON file.

Once all the entries are made into the skeleton state file, the terraform plan will show no changes to apply.

This concludes GCP Service Account Key is import into Terraform.

That’s All !!!