Terraform Provider Auth for grafana_user resource

Grafana Authentication
1

Trying to connect to Grafana from Terraform to provision new user accounts.

In the provider section I have:

terraform {
  required_providers {
.
.
.
    grafana = {
      source = "grafana/grafana"
      version = "3.7.0"
    }
  }
}

and

provider "grafana" {
  url  = "< correct url to Grafana instance >"
  auth = "< correct service account token >"
}

Further down in the Terraform code I have a resource to create an account:

resource "grafana_user" "staff" {
  provider = grafana
  email    = "< valid email address >"
  name     = "< user's full name >"
  login    = "< username >"
  password = "< a password >"
  is_admin = false
}

When I run the Terraform plan/apply, I get

Error: global scope resources cannot be managed with an API key. Use basic auth instead

Seems it is interpreting service account token on the auth line as an API key? Documentation here: Terraform Registry says:

auth (String, Sensitive) API token, basic auth in the username:password format or anonymous (string literal). May alternatively be set via the GRAFANA_AUTH environment variable.

No mention of service account token, but further down on the same page is:

auth
This can be a Grafana API key, basic auth username:password, or a *Grafana Service Account token*.

There is a service account set up in the Grafana account, and I am passing the token in the “auth” field. Running Terraform 1.3.7, Grafana provider v3.7.0, and Grafana 9.4.7.

2

https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/user

It does not work with API tokens or service accounts which are org-scoped. You must use basic auth.

So this is coming from the resource (admin API).

3

Foolish me. I thought I set up a provider and authenticate, then no problem accessing any resource. I guess it’s a little more complicated than that.

Thank you!