Feature Request: TTL support for TFE team and org tokens

[husunal]

Is it possible to support TTL with TFE team and org tokens?

In our CI/CD environments, we only use team tokens and we really would like to generate a dynamic TFE token using this new backend.

[catsby]

Hello @husunal - the decision was made to specifically not have TTLs for team and org tokens, because there can only be a single of each and we originally thought that revoking them could surprise users.

That said, we're open to changing the behavior if user feedback leads us that way. Can you share why your organization uses Team tokens for its CI/CD? I presume it's to limit the actions the token could preform?

[husunal]

Hello @catsby thanks for your reply.

It would be great if we can control the token's lifecycle, optional TTL would be a great improvement!

Our use cases:

• We use a team token per TFE workspace and we would like to generate a dynamic TFE token per terraform run.
• In our CI environment we would like to generate a team token that is valid during a change window only (e.g. 8hrs) at the end of the change window (lease) the generated token should be revoked by Vault.

[nrbunn]

I'm actually interested in the same. I even forked this to implement. I have it working where it would support both solutions. Just struggling on how to force the revoke of the lease since you can only have 1 token and if someone request a new token before the ttl. you get a error when lease expires saying token doesn't exists