feat: Add mcp config org secret resources

.changelog/4652.txt

@@ -0,0 +1,11 @@
+```release-note:new-resource
+resource/mongodbatlas_mcp_config_secret
+```
+
+```release-note:new-datasource
+data-source/mongodbatlas_mcp_config_secret
+```
+
+```release-note:new-datasource
+data-source/mongodbatlas_mcp_config_secrets
+```

docs/data-sources/mcp_config_secret.md

@@ -0,0 +1,38 @@
+---
+subcategory: "Remote MCP"
+---
+
+# Data Source: mongodbatlas_mcp_config_secret
+
+`mongodbatlas_mcp_config_secret` describes an ingress secret for an Organization Remote MCP Configuration. Secret values are never returned; only masked metadata is available.
+
+## Example Usages
+```terraform
+data "mongodbatlas_mcp_config_secret" "this" {
+  org_id        = var.org_id
+  mcp_config_id = mongodbatlas_mcp_config.this.mcp_config_id
+  secret_id     = mongodbatlas_mcp_config_secret.this.secret_id
+}
+
+output "secret_expires_at" {
+  value = data.mongodbatlas_mcp_config_secret.this.expires_at
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `mcp_config_id` (String) Unique identifier of the MCP configuration.
+- `org_id` (String) Unique 24-hexadecimal digit string that identifies the organization that contains your projects.
+- `secret_id` (String) Unique 24-hexadecimal digit string that identifies the secret.
+
+### Read-Only
+
+- `created_at` (String) The date that the secret was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `expires_at` (String) The date for the expiration of the secret. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `last_used_at` (String) The last time the secret was used. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `masked_secret_value` (String) The masked Service Account secret.
+
+For more information, see [Return One Secret for One Organization MCP Configuration](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgmcpconfigsecret) in the MongoDB Atlas API documentation.

docs/data-sources/mcp_config_secrets.md

@@ -0,0 +1,46 @@
+---
+subcategory: "Remote MCP"
+---
+
+# Data Source: mongodbatlas_mcp_config_secrets
+
+`mongodbatlas_mcp_config_secrets` returns all ingress secrets for an Organization Remote MCP Configuration. Secret values are never returned; only masked metadata is available.
+
+## Example Usages
+```terraform
+data "mongodbatlas_mcp_config_secrets" "this" {
+  org_id        = var.org_id
+  mcp_config_id = mongodbatlas_mcp_config.this.mcp_config_id
+  depends_on    = [mongodbatlas_mcp_config_secret.this]
+}
+
+output "mcp_config_secrets_results" {
+  value = data.mongodbatlas_mcp_config_secrets.this.results
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `mcp_config_id` (String) Unique identifier of the MCP configuration.
+- `org_id` (String) Unique 24-hexadecimal digit string that identifies the organization that contains your projects.
+
+### Read-Only
+
+- `results` (Attributes List) List of returned documents that MongoDB Cloud provides when completing this request. (see [below for nested schema](#nestedatt--results))
+
+<a id="nestedatt--results"></a>
+### Nested Schema for `results`
+
+Read-Only:
+
+- `created_at` (String) The date that the secret was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `expires_at` (String) The date for the expiration of the secret. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `id` (String) Unique 24-hexadecimal digit string that identifies the secret.
+- `last_used_at` (String) The last time the secret was used. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `masked_secret_value` (String) The masked Service Account secret.
+- `secret` (String) The secret for the Service Account. It will be returned only the first time after creation.
+
+For more information, see [Return All Secrets for One Organization MCP Configuration](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgmcpconfigsecrets) in the MongoDB Atlas API documentation.

docs/resources/mcp_config_secret.md

@@ -0,0 +1,68 @@
+---
+subcategory: "Remote MCP"
+---
+
+# Resource: mongodbatlas_mcp_config_secret
+
+`mongodbatlas_mcp_config_secret` provides an Organization MCP Config Secret resource. The resource lets you create and delete ingress secrets for an [`mongodbatlas_mcp_config`](mcp_config.md) configuration. The egress Service Account secret is system-managed, automatically rotated, and is not exposed through this or any other public resource.
+
+-> **NOTE:** This resource does not support updates. To rotate secrets, create a new secret resource and delete the old one once no longer needed -- up to two secrets can be active at once.
+
+-> **NOTE:** Unlike [`mongodbatlas_service_account_secret`](service_account_secret.md), no auto-generated secret is created that needs to be imported. The auto-generated ingress secret from `mongodbatlas_mcp_config` creation is deleted server-side, so you always create your first secret explicitly with this resource.
+
+## Example Usages
+
+```terraform
+resource "mongodbatlas_mcp_config" "this" {
+  org_id          = var.org_id
+  mcp_config_name = "example-mcp-config"
+  roles           = ["ORG_READ_ONLY"]
+}
+
+resource "mongodbatlas_mcp_config_secret" "this" {
+  org_id                     = var.org_id
+  mcp_config_id              = mongodbatlas_mcp_config.this.mcp_config_id
+  secret_expires_after_hours = 720 # 30 days
+}
+
+output "secret_id" {
+  value = mongodbatlas_mcp_config_secret.this.secret_id
+}
+
+output "secret" {
+  description = "The plain-text secret value. Returned only in the create response and cannot be retrieved again."
+  sensitive   = true
+  value       = mongodbatlas_mcp_config_secret.this.secret
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `mcp_config_id` (String) Unique identifier of the MCP configuration.
+- `org_id` (String) Unique 24-hexadecimal digit string that identifies the organization that contains your projects.
+
+### Optional
+
+- `secret_expires_after_hours` (Number) The expiration time of the new ingress Service Account secret, provided in hours. This attribute is required when creating the secret and cannot be updated later.
+
+### Read-Only
+
+- `created_at` (String) The date that the secret was created on. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `expires_at` (String) The date for the expiration of the secret. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `last_used_at` (String) The last time the secret was used. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
+- `masked_secret_value` (String) The masked Service Account secret.
+- `secret` (String, Sensitive) The secret for the Service Account. It will be returned only the first time after creation.
+- `secret_id` (String) Unique 24-hexadecimal digit string that identifies the secret.
+
+## Import
+Import the MCP Config Secret resource by using the Organization ID, MCP Config ID, and Secret ID in the format `ORG_ID/MCP_CONFIG_ID/SECRET_ID`, e.g.
+```
+$ terraform import mongodbatlas_mcp_config_secret.test 6117ac2fe2a3d04ed27a987v/8423867e-394c-4f1e-9d81-32d323a1dd81/6a79adb34c91a97469c7fd1d
+```
+
+-> **NOTE:** `secret` and `masked_secret_value` are not populated during import and should be omitted in the resource definition when importing the resource.
+
+For more information, see [Create One Secret for One Organization MCP Configuration](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createorgmcpconfigsecret) in the MongoDB Atlas API documentation.

examples/mongodbatlas_mcp_config_secret/README.md

@@ -0,0 +1,25 @@
+# MongoDB Atlas Provider -- MCP Config Secret
+
+This example shows how to create an ingress secret for an organization-level MCP configuration.
+
+## Important Notes
+
+Unlike `mongodbatlas_service_account_secret`, no auto-generated secret needs to be imported: the MCP config's create flow deletes its auto-generated ingress secret server-side, so you always create your first usable secret explicitly with this resource.
+
+The secret value is returned only once, in the create response. The example includes a sensitive output `secret` that captures it.
+You can retrieve it using (**warning**: this prints the secret to your terminal):
+
+```bash
+terraform output -raw secret
+```
+
+## Variables Required to be set:
+- `atlas_client_id`: The MongoDB Atlas Service Account Client ID
+- `atlas_client_secret`: The MongoDB Atlas Service Account Client Secret
+- `org_id`: The organization ID where the MCP configuration will be created
+
+## Outputs
+- `secret_id`: The unique identifier of the created secret
+- `secret` (sensitive): The plain-text secret value (only available at creation)
+- `secret_expires_at`: The secret's expiry timestamp, retrieved via the singular data source
+- `mcp_config_secrets_results`: All ingress secrets for the MCP configuration

examples/mongodbatlas_mcp_config_secret/main.tf

@@ -0,0 +1,21 @@
+resource "mongodbatlas_mcp_config" "this" {
+  org_id          = var.org_id
+  mcp_config_name = "example-mcp-config"
+  roles           = ["ORG_READ_ONLY"]
+}
+
+resource "mongodbatlas_mcp_config_secret" "this" {
+  org_id                     = var.org_id
+  mcp_config_id              = mongodbatlas_mcp_config.this.mcp_config_id
+  secret_expires_after_hours = 720 # 30 days
+}
+
+output "secret_id" {
+  value = mongodbatlas_mcp_config_secret.this.secret_id
+}
+
+output "secret" {
+  description = "The plain-text secret value. Returned only in the create response and cannot be retrieved again."
+  sensitive   = true
+  value       = mongodbatlas_mcp_config_secret.this.secret
+}

examples/mongodbatlas_mcp_config_secret/plural-data-source.tf

@@ -0,0 +1,9 @@
+data "mongodbatlas_mcp_config_secrets" "this" {
+  org_id        = var.org_id
+  mcp_config_id = mongodbatlas_mcp_config.this.mcp_config_id
+  depends_on    = [mongodbatlas_mcp_config_secret.this]
+}
+
+output "mcp_config_secrets_results" {
+  value = data.mongodbatlas_mcp_config_secrets.this.results
+}

examples/mongodbatlas_mcp_config_secret/provider.tf

@@ -0,0 +1,4 @@
+provider "mongodbatlas" {
+  client_id     = var.atlas_client_id
+  client_secret = var.atlas_client_secret
+}

examples/mongodbatlas_mcp_config_secret/singular-data-source.tf

@@ -0,0 +1,9 @@
+data "mongodbatlas_mcp_config_secret" "this" {
+  org_id        = var.org_id
+  mcp_config_id = mongodbatlas_mcp_config.this.mcp_config_id
+  secret_id     = mongodbatlas_mcp_config_secret.this.secret_id
+}
+
+output "secret_expires_at" {
+  value = data.mongodbatlas_mcp_config_secret.this.expires_at
+}

examples/mongodbatlas_mcp_config_secret/variables.tf

@@ -0,0 +1,17 @@
+variable "atlas_client_id" {
+  description = "MongoDB Atlas Service Account Client ID"
+  type        = string
+  default     = ""
+}
+
+variable "atlas_client_secret" {
+  description = "MongoDB Atlas Service Account Client Secret"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "org_id" {
+  description = "Atlas Organization ID"
+  type        = string
+}

examples/mongodbatlas_mcp_config_secret/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    mongodbatlas = {
+      source = "mongodb/mongodbatlas"
+    }
+  }
+  required_version = ">= 1.10"
+}

internal/provider/provider.go

@@ -5,6 +5,7 @@ import (
 	"log"
 
 	"github.com/mongodb/terraform-provider-mongodbatlas/internal/serviceapi/mcpconfig"
+	"github.com/mongodb/terraform-provider-mongodbatlas/internal/serviceapi/mcpconfigsecret"
 	"github.com/mongodb/terraform-provider-mongodbatlas/internal/serviceapi/metricintegration"
 
 	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
@@ -355,6 +356,8 @@ func (p *MongodbatlasProvider) DataSources(context.Context) []func() datasource.
 		aimodelratelimit.PluralDataSource,
 		mcpconfig.DataSource,
 		mcpconfig.PluralDataSource,
+		mcpconfigsecret.DataSource,
+		mcpconfigsecret.PluralDataSource,
 	}
 	analyticsDataSources := []func() datasource.DataSource{}
 	for _, dataSourceFunc := range dataSources {
@@ -366,6 +369,7 @@ func (p *MongodbatlasProvider) DataSources(context.Context) []func() datasource.
 func (p *MongodbatlasProvider) Resources(context.Context) []func() resource.Resource {
 	resources := []func() resource.Resource{
 		mcpconfig.Resource,
+		mcpconfigsecret.Resource,
 		metricintegration.Resource,
 		project.Resource,
 		logintegration.Resource,