Feature Request: Support CLI Authentication Fallback in the STACKIT Terraform Provider

[rswrz]

Description

It would be highly beneficial if the STACKIT Terraform Provider could automatically fall back to an active stackit CLI authentication session. This would allow users to authenticate via the stackit CLI and seamlessly use Terraform locally, without requiring additional manual authentication steps.

Current Workaround

At the moment, this behavior can be manually achieved by retrieving an access token via the CLI and exporting it as an environment variable:

stackit auth login
export STACKIT_SERVICE_ACCOUNT_TOKEN=$(stackit auth get-access-token 2>/dev/stdout)
terraform init && terraform apply

Proposed Enhancement

Enable the Terraform provider to detect and utilize the existing CLI session automatically, similar to how other cloud providers (e.g., Azure CLI, AWS CLI) handle authentication fallback in their Terraform providers. This would greatly improve the developer experience and streamline local workflows.

[h3adex]

We already talked about this internally! It is in our backlog. Keep in mind it is STACKIT not StackIT :-P

[jkroepke]

It should work since 0.47.0 - I could confirm it locally.

In #745, the sdk core package was bumped to v0.16.2 which includes stackitcloud/stackit-sdk-go#1499

[marceljk]

Hello @rswrz,

we created a RFC #880 with our target architecture of this feature and we will start to implement it in the next weeks.

[franklouwers]

Love this. Makes your cloud so more a viable alternative for the big folks. Decent, integrated, audittrailed, operations using personal IDs instead of a generic service account.

Like the proposal in #880, and tbh you should consider already documenting @rswrz 's workaround. It does what it needs to do with a simple shell alias.

[franklouwers]

(although @rswrz's solution is barely usable given the extremely short lifetime of the token)

[HartmannVolker]

We'd greatly appreciate this feature. Using the stackit CLI with a personal account in Terraform significantly improves project audit logs by showing the actual user instead of a generic service account. So besides being a very convenient feature, it would also increase the security of the platform.

[franklouwers]

Hi Stackit team. Could you share some insights on how this RFC would progress and what the timelines would be? From a security perspective, we want to limit the number of long-lived tokens for service-accounts as much as possible, want to have the user show up correctly in the audit logs.

The current workaround by @rswrz works, but just barely, as it times out soo quickly (eg: changing a nodepool never "completes" because the token is expired by the time the operation has been completed 100%.

[franklouwers]

@marceljk do you know the way forward with this?

[marceljk]

Hi @franklouwers,
Unfortunately we have been busy with some other topics in the last weeks and couldn't make any progress on the CLI authentication.
I'll try to prioritize this in our internal backlog, as this is a highly requested feature.

Best regards,
Marcel

[franklouwers]

Hi @marceljk,

Could you update us on the planning for this feature?