Skip to content

[v18.5.0] Unexpected token rotation on imported *access_token

Bug Report

We have several access tokens of type gitlab_group_access_token and gitlab_project_access_token created manually via the GitLab UI, then imported into Terraform. By doing so, the sensitive token value is not present in the state, as per the documentation.

Prior to v18.5.0, terraform plan never proposed rotating the imported tokens.

After upgrading to v18.5.0, terraform plan shows that the token secret value would be added, and terraform apply attempts to rotate the affected token secret.

We expect that terraform plan on v18.5.0 does not propose rotating the imported tokens.

Relevant Terraform Configuration

resource "gitlab_group_access_token" "group_token" {
  group        = "<group-id>"
  name         = "<token_name>"
  expires_at   = "2026-06-01"
  access_level = "owner"
  scopes       = ["api"]

  lifecycle {
    postcondition {
      condition     = self.token == null
      error_message = "Token value should not be in the state file."
    }
  }
}

import {
  id = "<token-id>"
  to = gitlab_group_access_token.group_token
}

terraform plan output on v18.4.1:

No changes. Your infrastructure matches the configuration.

terraform plan output on v18.5.0:

  # gitlab_group_access_token.group_token will be updated in-place
  ~ resource "gitlab_group_access_token" "group_token" {
      ~ active                        = true -> (known after apply)
      ~ created_at                    = "<created-date>" -> (known after apply)
      ~ id                            = "<token-id>" -> (known after apply)
        name                          = "<token_name>"
      ~ revoked                       = false -> (known after apply)
      + token                         = (sensitive value)
      ~ user_id                       = <user-id> -> (known after apply)
      + validate_past_expiration_date = true
        # (5 unchanged attributes hidden)
    }

terraform apply attempts to rotate the token. Since we use another group token to perform the apply, it returns an error:

Error: Error rotating GitLab GroupAccessTokens
401 {message: 401 Unauthorized}

Additional Details

  • GitLab Terraform Provider Version: 18.5.0
  • Terraform Version: 1.13.4
  • License Tier: Premium
Edited by 🤖 GitLab Bot 🤖