feat: Add mcp config org secret resources by laylaazouz · Pull Request #4652 · mongodb/terraform-provider-mongodbatlas

laylaazouz · 2026-08-17T16:21:52Z

Description

Adds the mongodbatlas_mcp_config_secret resource and its singular/plural data sources (mongodbatlas_mcp_config_secret, mongodbatlas_mcp_config_secrets).

Generated via the existing autogen tooling, with schema overrides on top of the standard CRD (no update) mapping:

Includes acceptance tests, a working example, and generated docs.

Link to any related issue(s):

Type of change:

Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR. A migration guide must be created or updated.
This change requires a documentation update
Documentation fix/enhancement

Required Checklist:

I have signed the MongoDB CLA
I have read the contributing guides
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fix and verified my code
If changes include deprecations or removals I have added appropriate changelog entries.
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

…ss review comments

…LOUDP-435895-mcp-config-org-secret # Conflicts: # internal/provider/provider.go # tools/codegen/config.yml

github-actions · 2026-08-20T08:30:19Z

APIx bot: a message has been sent to Docs Slack channel

augmentcode · 2026-08-20T08:32:22Z

🤖 Augment PR Summary

Summary: Adds Terraform support for organization-level Remote MCP configuration ingress secrets.

Changes:

Registers a new mongodbatlas_mcp_config_secret resource.
Adds singular and plural MCP config secret data sources.
Implements create, read, delete, and import paths against the Remote MCP API.
Models one-time secret creation, expiry configuration, masked metadata, and secret IDs.
Generates provider schemas and codegen model/configuration for the new endpoints.
Adds acceptance coverage for basic creation/import and the two-active-secret limit.
Adds example configuration, generated documentation, templates, and release notes.

Technical Notes: The resource marks the create response's secret as sensitive and uses the MCP API preview version header.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-20T08:32:23Z

+							Computed:            true,
+							MarkdownDescription: "The masked Service Account secret.",
+						},
+						"secret": dsschema.StringAttribute{


results.secret is exposed as a non-sensitive computed attribute, even though this list endpoint is documented to return metadata only. The generator's ignore only matches root-level secret, so if this field is ever present in a list response its plaintext value will be written to Terraform state and displayed as non-sensitive. Other locations where this applies: tools/codegen/models/mcp_config_secret.yaml:281, docs/data-sources/mcp_config_secrets.md:43.

Severity: high

Other Locations

tools/codegen/models/mcp_config_secret.yaml:281

docs/data-sources/mcp_config_secrets.md:43

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-08-20T08:32:24Z

+Import the MCP Config Secret resource by using the Organization ID, MCP Config ID, and Secret ID in the format `ORG_ID/MCP_CONFIG_ID/SECRET_ID`, e.g.
+```
+$ terraform import mongodbatlas_mcp_config_secret.test 6117ac2fe2a3d04ed27a987v/8423867e-394c-4f1e-9d81-32d323a1dd81/6a79adb34c91a97469c7fd1d
+```


The sample organization ID ends in v, which is not hexadecimal although org_id is required to be a 24-hexadecimal-digit ID. Copying this import command will therefore use an invalid organization identifier. Other locations where this applies: docs/resources/mcp_config_secret.md:60.

Severity: low

Other Locations

docs/resources/mcp_config_secret.md:60

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

EspenAlbert · 2026-08-20T08:43:11Z

@@ -0,0 +1,25 @@
+# MongoDB Atlas Provider -- MCP Config Secret


q: Did we make a decision about grouping these mcp examples? Seems like they are all very connected

Context on previous discussions: We do want an example per reesource. It ensures that customers can always find an example for the specific resource they are concerned about. (same for AI agents)

EspenAlbert · 2026-08-20T08:44:25Z

@@ -0,0 +1,9 @@
+data "mongodbatlas_mcp_config_secrets" "this" {


is this a convention we are using? putting plural and singlular data sources in separate files?

Yes, this follows the log_integration examples structure (discussed in org config resources PR comments)

EspenAlbert · 2026-08-20T08:45:11Z

+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func DataSourceSchema(ctx context.Context) dsschema.Schema {


when would this be useful to the user? Is there any value in any of the computed attributes?

the singular data source lets a user look up a secret's metadata without having the resource itself in their Terraform config/state. expires_at is useful for tracking when it needs rotating.

manupedrozo

Didn't go through the full PR yet, left some comments

manupedrozo · 2026-08-20T08:52:56Z

+
+# {{.Type}}: {{.Name}}
+
+`{{.Name}}` describes an ingress secret for an Organization Remote MCP Configuration. Secret values are never returned; only masked metadata is available.


Lets revisit these descriptions, see the SA secret docs as examples: https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/data-sources/service_account_secret

manupedrozo · 2026-08-20T08:56:24Z

+`{{.Name}}` provides an Organization MCP Config Secret resource. The resource lets you create and delete ingress secrets for an [`mongodbatlas_mcp_config`](mcp_config.md) configuration. The egress Service Account secret is system-managed, automatically rotated, and is not exposed through this or any other public resource.
+
+-> **NOTE:** This resource does not support updates. To rotate secrets, create a new secret resource and delete the old one once no longer needed -- up to two secrets can be active at once.
+
+-> **NOTE:** Unlike [`mongodbatlas_service_account_secret`](service_account_secret.md), no auto-generated secret is created that needs to be imported. The auto-generated ingress secret from `mongodbatlas_mcp_config` creation is deleted server-side, so you always create your first secret explicitly with this resource.
+


Same here, I sense some AI usage for these, lets revisit. Can use https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/resources/project_service_account_secret as an example.

no auto-generated secret is created that needs to be imported. The auto-generated ingress secret from `mongodbatlas_mcp_config` creation is deleted server-side - we discussed in a previous PR to not mention this point as it would likely just confuse customers who are not aware of how the backend works.

Meant to change these following the last PR's discussion, sorry! fixing now.

manupedrozo · 2026-08-20T08:58:04Z

@@ -0,0 +1,25 @@
+# MongoDB Atlas Provider -- MCP Config Secret


Context on previous discussions: We do want an example per reesource. It ensures that customers can always find an example for the specific resource they are concerned about. (same for AI agents)

manupedrozo · 2026-08-20T08:59:02Z

+
+## Important Notes
+
+Unlike `mongodbatlas_service_account_secret`, no auto-generated secret needs to be imported: the MCP config's create flow deletes its auto-generated ingress secret server-side, so you always create your first usable secret explicitly with this resource.


Would not mention mongodbatlas_service_account_secret here, also knowing that one is changing in the short term so I would avoid introducing work to update this example.

laylaazouz changed the title ~~Cloudp 435895 mcp config org secret~~ feat: Add mcp config org secret resources Aug 17, 2026

github-actions Bot added the enhancement label Aug 17, 2026

laylaazouz force-pushed the CLOUDP-435895-mcp-config-org-secret branch 3 times, most recently from ec9c82e to f03c33b Compare August 19, 2026 09:54

fix: regenerate mcp_config_secret for autogen packages format + addre…

ecc365c

…ss review comments

laylaazouz force-pushed the CLOUDP-435895-mcp-config-org-secret branch from f03c33b to ecc365c Compare August 19, 2026 16:01

fix: tests

32d9f39

laylaazouz mentioned this pull request Aug 19, 2026

feat: Add mcp config project secret resources #4651

Draft

13 tasks

Merge remote-tracking branch 'origin/CLOUDP-411233-mcp-config' into C…

36504ed

…LOUDP-435895-mcp-config-org-secret # Conflicts: # internal/provider/provider.go # tools/codegen/config.yml

laylaazouz marked this pull request as ready for review August 20, 2026 08:30

laylaazouz requested review from a team as code owners August 20, 2026 08:30

augmentcode Bot reviewed Aug 20, 2026

View reviewed changes

fix: ignore results.secret in plural ds

7f0f0aa

EspenAlbert reviewed Aug 20, 2026

View reviewed changes

manupedrozo reviewed Aug 20, 2026

View reviewed changes

laylaazouz added 2 commits August 20, 2026 10:12

fix: update descriptions

f1d38a8

fix: docs

483986e

		@@ -0,0 +1,25 @@
		# MongoDB Atlas Provider -- MCP Config Secret

		@@ -0,0 +1,9 @@
		data "mongodbatlas_mcp_config_secrets" "this" {


		# {{.Type}}: {{.Name}}

		`{{.Name}}` describes an ingress secret for an Organization Remote MCP Configuration. Secret values are never returned; only masked metadata is available.


		## Important Notes

		Unlike `mongodbatlas_service_account_secret`, no auto-generated secret needs to be imported: the MCP config's create flow deletes its auto-generated ingress secret server-side, so you always create your first usable secret explicitly with this resource.

Uh oh!

Conversation

laylaazouz commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change:

Required Checklist:

Further comments

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

augmentcode Bot commented Aug 20, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

manupedrozo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

laylaazouz commented Aug 17, 2026 •

edited

Loading

augmentcode Bot Aug 20, 2026 •

edited

Loading

augmentcode Bot Aug 20, 2026 •

edited

Loading