continueops_provider_connection (Resource)

A connection to a cloud or business system (Settings → Providers): the settings and the credential ContinueOps uses for asset discovery and import, and, for microsoft365, the app a self-hosted runner is handed a short-lived Graph token for.

Needs a tenant owner or administrator API key, and migration 20261008061700_api_provider_connections.sql on the platform (until it is applied, the API answers 503 to writes).

The secret is write-only. The platform encrypts it and never returns it, so Terraform keeps the value from your configuration in state (mark the state as sensitive and store it accordingly) and cannot see a credential rotated in the console. After terraform import, secret is null: leave it out of the configuration to keep the stored credential (no diff), or set it and the next apply replaces the stored credential. Removing secret from the configuration never deletes the stored credential. Setting a new secret resets health to untested.

Testing a connection is an operation, not desired state, and is not modelled: use Test connection in the console. health and the last_* attributes report the latest test and never cause a diff.

Destroy is a soft delete: the connection stops being used at once, by runners too.

Example Usage

# Discovery through an assumed IAM role: no secret to store.
resource "continueops_provider_connection" "aws_prod" {
  provider_type     = "aws"
  display_name      = "Production account"
  use_for_discovery = true
  config = {
    account_label = "123456789012"
    region        = "eu-west-2"
    auth_mode     = "assume_role"
    role_arn      = "arn:aws:iam::123456789012:role/ContinueOpsReadOnly"
    external_id   = "continueops-acme"
  }
}

# Import from Jira. The API token is write-only: Terraform sends it, the
# platform encrypts it and never returns it.
variable "jira_api_token" {
  type      = string
  sensitive = true
}

resource "continueops_provider_connection" "jira" {
  provider_type  = "jira"
  display_name   = "Resilience actions"
  use_for_import = true
  secret         = var.jira_api_token
  config = {
    site_url      = "https://acme.atlassian.net"
    account_email = "resilience-bot@acme.com"
    project_key   = "RESIL"
  }
}

Schema

Required

config (Map of String) The provider's non-secret settings, by key (values non-blank, without surrounding whitespace). Keys per provider:
- aws: access_key_id (auth_mode access_key), account_label, auth_mode, external_id (optional) (auth_mode assume_role), region, role_arn (auth_mode assume_role). Secret: secret_access_key (auth_mode access_key only).
- azure: client_id, directory_tenant_id, subscription_id. Secret: client_secret.
- fusion: base_url, client_id. Secret: client_secret.
- gcp: project_id. Secret: service_account_json.
- jira: account_email, project_key (optional), site_url. Secret: api_token.
- microsoft365: client_id, directory_tenant_id. Secret: client_secret.
- riskconnect: base_url, tenant_key. Secret: api_key.
- servicenow: instance_url, username. Secret: password.
- sharepoint: client_id, directory_tenant_id, site_url. Secret: client_secret.
- teams: client_id, directory_tenant_id, team_name (optional). Secret: client_secret.
display_name (String) Name, 1 to 120 characters, unique per provider within the tenant (ignoring case).
provider_type (String) The system (the API's provider; provider itself is a Terraform meta-argument): aws, azure, fusion, gcp, jira, microsoft365, riskconnect, servicenow, sharepoint, teams. Changing it replaces the connection.

Optional

is_enabled (Boolean) Whether the connection is used at all. Default true.
runner_deployment_ids (Set of String) With runner_use, the runners (dep_..., enrolled in this tenant) allowed to use it; empty means any runner this tenant owns.
runner_use (Boolean) Let runbooks on self-hosted runners use it (microsoft365 only): a run is given a Graph token that expires in about an hour, never the secret. Default false.
secret (String, Sensitive) The credential (the provider's secret field, listed under config; for gcp the whole service account key JSON). Write-only: never returned by the API, null after import. Required to create every connection except aws with auth_mode = "assume_role", where it is not used.
timeouts (Attributes) (see below for nested schema)
use_for_discovery (Boolean) Discover assets through it (aws, azure, gcp, servicenow, fusion). Default false. At least one of use_for_discovery, use_for_import, runner_use must be true.
use_for_import (Boolean) Import material through it (jira, sharepoint, teams, servicenow, fusion, riskconnect). Default false.

Read-Only

created_at (String) When the connection was created (RFC 3339, UTC).
has_secret (Boolean) Whether a credential is stored.
health (String) Result of the latest connection test: untested, ok or failing.
id (String) Connection id (UUID).
last_success_at (String) When a test last succeeded (RFC 3339, UTC); null if never.
last_test_at (String) When it was last tested (RFC 3339, UTC); null if never.
last_test_message (String) What the latest test said.
updated_at (String) When the connection last changed (RFC 3339, UTC).

Nested Schema for `timeouts`

Optional:

create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
read (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

import {
  to = continueops_provider_connection.example
  id = "00000000-0000-4000-8000-000000000000"
}

The terraform import command can be used, for example:

# Import by id (UUID). The secret cannot be imported: the platform never returns it.
# Leave `secret` out of the configuration to keep the stored credential, or set it
# to replace the credential on the next apply.
terraform import continueops_provider_connection.example 00000000-0000-4000-8000-000000000000

continueops