Chronosphere service account tokens never expire and are shown only once

Chronosphere service account tokens never expire and are shown only once

TL;DR

Match the account type to the job. Ingestion or the Collector: create a restricted write-only service account, which follows least privilege. Chronoctl or Terraform: create an unrestricted one.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Context: Official docs (Service accounts): documents that creating a service account also creates a non-expiring API token, shown once at creation and never again (the token field is empty in list results). Service accounts cannot use the UI, only the APIs. Two types matter: unrestricted accounts for Chronoctl or Terraform, and restricted write-only accounts for the Collector or ingestion. You must be on a

Remember the token is non-expiring, so own the rotation story yourself, and copy the token at creation time because the API will not show it again. If creation fails with permissions errors, check that your own account is on a team with the SysAdmin role. Keep Terraform state with these tokens in a locked-down backend, since the token lives in state. And for label restrictions, remember the two-pair cap and that they are case sensitive.

Official docs (Service accounts): documents that creating a service account also creates a non-expiring API token, shown once at creation and never again (the token field is empty in list results). Service accounts cannot use the UI, only the APIs. Two types matter: unrestricted accounts for Chronoctl or Terraform, and restricted write-only accounts for the Collector or ingestion. You must be on a team with the SysAdmin role to create service accounts, and Terraform resources store the token in state. Label restrictions are case sensitive, capped at two key-value pairs per account, and you cannot set multiple values for the same label key.

Verified resolution: Match the account type to the job. Ingestion or the Collector: create a restricted write-only service account, which follows least privilege. Chronoctl or Terraform: create an unrestricted one. Remember the token is non-expiring, so own the rotation story yourself, and copy the token at creation time because the API will not show it again. If creation fails with permissions errors, check that your own account is on a team with the SysAdmin role. Keep Terraform state with these tokens in a locked-down backend, since the token lives in state. And for label restrictions, remember the two-pair cap and that they are case sensitive.

Source: https://docs.chronosphere.io/administer/accounts-teams/service-accounts