How to prevent a resource from being created again (time_rotating)

Hi everyone, I’m using gitlab resources in Terraform and I have a problem.
The gitlab_group_access_token resource requires you to specify an expiration date for the token.

I tried to use the time_rotating resource because I thought I would only recreate the gitlab_group_access_token when I met a certain declared date but it is not.

Here my code:

resource "time_rotating" "gitlab_group_access_token" {
  rotation_days = 365
}
resource "time_static" "future_date" {
  depends_on = [time_rotating.gitlab_group_access_token]
  rfc3339 = formatdate("YYYY-MM-DD'T'hh:mm:ssZ", timeadd(timestamp(), "8760h"))
}
#Tokens
resource "gitlab_group_access_token" "kiu_pdf_argocd_token" {
  depends_on = [time_rotating.gitlab_group_access_token]

  group        = gitlab_group.kiu_pdf.id
  name         = "ArgoCD access token"
  expires_at   = substr(time_static.future_date.rfc3339, 0, 10)
  access_level = "developer"

  scopes = ["read_repository"]

}

resource "gitlab_group_access_token" "kiu_pdf_ci_token" {
  depends_on = [time_rotating.gitlab_group_access_token]

  group        = gitlab_group.kiu_pdf.id
  name         = "Gitlab CI access token"
  expires_at   = substr(time_static.future_date.rfc3339, 0, 10)
  access_level = "developer"

  scopes = ["read_repository", "write_repository"]

}
`

First I try to get the current date using the resource time_static and with the function substr I try to modify it to work in the gitlab resource.

I just need to update the tokens every 365 days but I don’t know the cleanest way to do it since every time I make a plan I try to recreate the resources and I don’t need to recreate them.

  `# gitlab_group_access_token.kiu_pdf_argocd_token must be replaced
-/+ resource "gitlab_group_access_token" "kiu_pdf_argocd_token" {
      ~ active       = true -> (known after apply)
      ~ created_at   = "2023-08-01T15:08:06Z" -> (known after apply)
      ~ expires_at   = "2024-07-31" # forces replacement -> (known after apply) # forces replacement
      ~ id           = "531:103" -> (known after apply)
        name         = "ArgoCD access token"
      ~ revoked      = false -> (known after apply)
      ~ token        = (sensitive value)
      ~ user_id      = 130 -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # gitlab_group_access_token.kiu_pdf_ci_token must be replaced
-/+ resource "gitlab_group_access_token" "kiu_pdf_ci_token" {
      ~ active       = true -> (known after apply)
      ~ created_at   = "2023-08-01T15:08:06Z" -> (known after apply)
      ~ expires_at   = "2024-07-31" # forces replacement -> (known after apply) # forces replacement
      ~ id           = "531:104" -> (known after apply)
        name         = "Gitlab CI access token"
      ~ revoked      = false -> (known after apply)
      ~ token        = (sensitive value)
      ~ user_id      = 131 -> (known after apply)
        # (3 unchanged attributes hidden)
    }`

Any helps?

Instead of using time_static use time_rotating resource to set expires_at.

  expires_at = formatdate("YYYY-MM-DD", time_rotating.gitlab_group_access_token.rotation_rfc3339)

You don’t even need to use timeadd as rotation_rfc3339 is already set to expiration date of time_rotating resource.