The same three IAM resources in HCL: a kvindo_access_policy carrying a least-privilege policy document, a kvindo_user that attaches it, and a kvindo_user_token for that user. Self-contained — IAM resources take no subnet, so this example does not build on the Networking one. Terraform does not resolve names, so the policy and user are wired through metadata.id references.

Two things about the policy document: spec.content is YAML (format_version + entries), not a JSON blob, which is why it is written as a heredoc rather than jsonencode(...); and the reconciler parses it on every apply, so a malformed document fails the resource. The final output surfaces status.token — the value is minted during reconciliation, so it only exists after the apply completes, and it is marked sensitive so Terraform does not print it.

Related pages

Resource docs

• Access Policy resource docs
• IAM User resource docs
• User Token resource docs

More in this section

• Networking
• VMs
• VPN
• Load Balancing
• Kubernetes
• S3
• Valkey
• Valkey Replication
• PostgreSQL
• Kafka
• ClickHouse
• OpenSearch
• GitLab
• Examples

Reference

• Kvindo provider on the Terraform Registry