---
title: How to use IAM authentication for Cockpit with Terraform/OpenTofu
description: Learn how to securely manage Cockpit Grafana access and resources using Terraform/OpenTofu and IAM authentication.
tags: observability cockpit grafana terraform iam-authentication
dates:
  validation: 2026-02-09
  posted: 2026-02-09
---

import Requirements from '@macros/iam/requirements.mdx'

This page shows you how to use Terraform/OpenTofu to access your Cockpit's Grafana.

<Requirements />

- A Scaleway account with access to the [Scaleway console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created](/iam/how-to/create-api-keys/) an API key with the required rights to allow Terraform/OpenTofu to access Grafana
- Installed the latest versions of the [Scaleway](https://registry.terraform.io/providers/scaleway/scaleway/latest/docs) and [Grafana](https://registry.terraform.io/providers/grafana/grafana/latest/docs) Terraform/OpenTofu providers

## Storing your credentials

1. Open a terminal and create a `scaleway.auto.tfvars` file to store your credentials. Terraform/OpenTofu will load it automatically.
2. Paste the code below inside your file. Make sure that you replace the placeholder values with your own.

    ```bash

    access_key       = "<SCWXXXXXXXXXXXXXXXXX>"
    secret_key       = <xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    organization_id  = "<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    project_id       = "<xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx>"
    ```

    Find out more about Terraform/OpenTofu configuration files in the [dedicated documentation](/terraform/reference-content/scaleway-configuration-file/).

## Configuring the Terraform/OpenTofu providers

1. Create a `main.tf` file in the same folder in which you have created your `scaleway.auto.tfvars` file:

    ```bash
    nano main.tf
    ```

2. Paste the following content into your file:

    ```bash
    
    terraform {
        required_providers {
        scaleway = {
            source  = "scaleway/scaleway"
            version = "2.64.0"
        }
        grafana = {
            source  = "grafana/grafana"
            version = "4.21.0"
        }
        }
    }
    
    variable "access_key" {
        type      = string
        sensitive = true
    }
    
    variable "secret_key" {
        type      = string
        sensitive = true
    }
    
    variable "organization_id" {
        type      = string
        sensitive = true
    }
    
    variable "project_id" {
        type      = string
        sensitive = true
    }
    
    provider "scaleway" {
        access_key      = var.access_key
        secret_key      = var.secret_key
        organization_id = var.organization_id
        project_id      = var.project_id
    }
    
    provider "grafana" {
        url          = "https://${var.project_id}.dashboard.cockpit.scaleway.com"
        auth         = "anonymous"
    
        http_headers = {
        "X-Auth-Token" = var.secret_key
        }
    }
    ```
3. Save your file and exit your text editor.
4. Run `terraform init` to load the newly created configuration file into Terraform/OpenTofu.
5. Plan the execution of the tasks to be done by Terraform using `terraform plan`.
6. Apply the new configuration by running `terraform apply`. Confirm the execution of the plan by typing `yes` when prompted.
7. Enter `yes` to confirm.

<Message type="note">
 The [Scaleway Terraform/OpenTofu provider](https://registry.terraform.io/providers/scaleway/scaleway/latest/docs) also allows you to manage Cockpit-specific resources such as alerting rules, access tokens, and data sources.
</Message>