Terraform AWS Access Key Rotation

monthly_aws_access_key_rotation_example.tf

resource "aws_iam_user" "monthly_credential_rotation_example" {
  provider = aws.local
  name     = "monthly-credential-rotation-example"
}

resource "aws_iam_access_key" "one" {
  provider = aws.local
  count    = local.modmonth == 0 ? 1 : 0
  user     = aws_iam_user.monthly_credential_rotation_example.name
}

resource "aws_iam_access_key" "two" {
  provider = aws.local
  count    = local.modmonth ==  1 ? 1 : 0
  user     = aws_iam_user.monthly_credential_rotation_example.name
}

data "external" "modulo_month" {
  program = ["/bin/sh", "-c", "echo '{\"value\": \"'$(expr $(date '+%m') % 2)'\"}'"]
}

locals {
  modmonth = tonumber(data.external.modulo_month.result.value)
}

output "accesskeyid" {
  value = try(aws_iam_access_key.one[0].id, aws_iam_access_key.two[0].id)
}

output "secretaccesskey" {
  value = try(aws_iam_access_key.one[0].secret, aws_iam_access_key.two[0].secret)
}

looks good, instead of using an external data source you could also just use built in TF date functions

ex.

locals {
  modmonth = formatdate("M", timestamp()) % 2
}

ahh nevermind, I guess you can't. and im guessing you found that out already :(. Because of use of the timestamp function as described here https://www.terraform.io/language/expressions/function-calls#when-terraform-calls-functions

Yeah, terraform needs to resolve the count values in the plan so it has to be in a data source rather than a timestamp function in locals.