Terraform AWS Access Key Rotation

monthly_aws_access_key_rotation_example.tf

resource "aws_iam_user" "monthly_credential_rotation_example" {
  provider = aws.local
  name     = "monthly-credential-rotation-example"
}

resource "aws_iam_access_key" "one" {
  provider = aws.local
  count    = local.modmonth == 0 ? 1 : 0
  user     = aws_iam_user.monthly_credential_rotation_example.name
}

resource "aws_iam_access_key" "two" {
  provider = aws.local
  count    = local.modmonth ==  1 ? 1 : 0
  user     = aws_iam_user.monthly_credential_rotation_example.name
}

data "external" "modulo_month" {
  program = ["/bin/sh", "-c", "echo '{\"value\": \"'$(expr $(date '+%m') % 2)'\"}'"]
}

locals {
  modmonth = tonumber(data.external.modulo_month.result.value)
}

output "accesskeyid" {
  value = try(aws_iam_access_key.one[0].id, aws_iam_access_key.two[0].id)
}

output "secretaccesskey" {
  value = try(aws_iam_access_key.one[0].secret, aws_iam_access_key.two[0].secret)
}

Yeah, terraform needs to resolve the count values in the plan so it has to be in a data source rather than a timestamp function in locals.