---
updatedAt: 2025-09-19T13:05:58.000Z
agentTools:
  projectIndex: https://docs.scalr.io/llms.txt
---

# scalr_assume_service_account_policy

## Resource: scalr\_assume\_service\_account\_policy

Manages an Assume Service Account Policy in Scalr.

## Example Usage

### Github Actions

```terraform
data "scalr_workload_identity_provider" "github" {
  url = "https://token.actions.githubusercontent.com"
}

resource "scalr_assume_service_account_policy" "ga-scalr-staging" {
  name                     = "ga-scalr-staging"
  service_account_id       = scalr_service_account.staging.id
  provider_id              = data.scalr_workload_identity_provider.github.id
  maximum_session_duration = 7200
  claim_condition {
    claim    = "sub"
    value    = "repo:GithubOrganization/repository:environment:staging"
    operator = "startswith"
  }
  claim_condition {
    claim    = "repository"
    value    = "GithubOrganization/repository"
    operator = "eq"
  }
}
```

### Gitlab CI

```terraform
data "scalr_workload_identity_provider" "gitlab" {
  url = "https://gitlab.com"
}

resource "scalr_assume_service_account_policy" "gitlab-ci-scalr-staging" {
  name                     = "gitlab-ci-scalr-staging"
  service_account_id       = scalr_service_account.staging.id
  provider_id              = data.scalr_workload_identity_provider.gitlab.id
  maximum_session_duration = 3600
  claim_condition {
    claim    = "sub"
    value    = "group/project:ref_type:type:ref:branch_name"
    operator = "eq"
  }
}
```

## Schema

### Required

* `name` (String) The name of the Assume Service Account Policy.
* `provider_id` (String) The ID of the Workload Identity Provider associated with this policy.
* `service_account_id` (String) The ID of the Service Account to which this policy is attached.

### Optional

* `claim_condition` (Block Set) A set of claim conditions for the policy. (see [below for nested schema](#nestedblock--claim_condition))
* `maximum_session_duration` (Number) The maximum session duration in seconds for the assumed role.

### Read-Only

* `id` (String) The ID of the Assume Service Account Policy.

<a id="nestedblock--claim_condition"></a>

### Nested Schema for `claim_condition`

Required:

* `claim` (String) The claim to match.
* `value` (String) The value to match for the claim.

Optional:

* `operator` (String) The operation to perform to evaluate the claim's value against the specified condition. Supported values: "eq": checks if the claim value is equal to the specified value; "contains": checks if the claim value contains the specified value as a substring; "startswith": checks if the claim value starts with the specified value; "endswith": checks if the claim value ends with the specified value; "like": checks whether the claim value matches a specified pattern using shell-style wildcards (\* any string, ? any char, \[seq] any in seq, \[!seq] any not in seq).

# Sibling pages

* [scalr\_endpoint](https://docs.scalr.io/scalr/docs/provider_resource_scalr_endpoint.md)
* [scalr\_access\_policy](https://docs.scalr.io/scalr/docs/provider_resource_scalr_access_policy.md)
* [scalr\_account\_allowed\_ips](https://docs.scalr.io/scalr/docs/provider_resource_scalr_account_allowed_ips.md)
* [scalr\_agent\_pool](https://docs.scalr.io/scalr/docs/provider_resource_scalr_agent_pool.md)
* [scalr\_agent\_pool\_token](https://docs.scalr.io/scalr/docs/provider_resource_scalr_agent_pool_token.md)
* [scalr\_checkov\_integration](https://docs.scalr.io/scalr/docs/provider_resource_scalr_checkov_integration.md)
* [scalr\_drift\_detection](https://docs.scalr.io/scalr/docs/provider_resource_scalr_drift_detection.md)
* [scalr\_environment](https://docs.scalr.io/scalr/docs/provider_resource_scalr_environment.md)
* [scalr\_environment\_hook](https://docs.scalr.io/scalr/docs/provider_resource_scalr_environment_hook.md)
* [scalr\_event\_bridge\_integration](https://docs.scalr.io/scalr/docs/provider_resource_scalr_event_bridge_integration.md)
* [scalr\_federated\_environments](https://docs.scalr.io/scalr/docs/provider_resource_scalr_federated_environments.md)
* [scalr\_hook](https://docs.scalr.io/scalr/docs/provider_resource_scalr_hook.md)
* [scalr\_iam\_team](https://docs.scalr.io/scalr/docs/provider_resource_scalr_iam_team.md)
* [scalr\_integration\_infracost](https://docs.scalr.io/scalr/docs/provider_resource_scalr_integration_infracost.md)
* [scalr\_module](https://docs.scalr.io/scalr/docs/provider_resource_scalr_module.md)
* [scalr\_module\_namespace](https://docs.scalr.io/scalr/docs/provider_resource_scalr_module_namespace.md)
* [scalr\_policy\_group](https://docs.scalr.io/scalr/docs/provider_resource_scalr_policy_group.md)
* [scalr\_policy\_group\_linkage](https://docs.scalr.io/scalr/docs/provider_resource_scalr_policy_group_linkage.md)
* [scalr\_provider\_configuration](https://docs.scalr.io/scalr/docs/provider_resource_scalr_provider_configuration.md)
* [scalr\_provider\_configuration\_default](https://docs.scalr.io/scalr/docs/provider_resource_scalr_provider_configuration_default.md)
* [scalr\_role](https://docs.scalr.io/scalr/docs/provider_resource_scalr_role.md)
* [scalr\_run\_schedule\_rule](https://docs.scalr.io/scalr/docs/provider_resource_scalr_run_schedule_rule.md)
* [scalr\_run\_trigger](https://docs.scalr.io/scalr/docs/provider_resource_scalr_run_trigger.md)
* [scalr\_service\_account](https://docs.scalr.io/scalr/docs/provider_resource_scalr_service_account.md)
* [scalr\_service\_account\_token](https://docs.scalr.io/scalr/docs/provider_resource_scalr_service_account_token.md)
* [scalr\_slack\_integration](https://docs.scalr.io/scalr/docs/provider_resource_scalr_slack_integration.md)
* [scalr\_ssh\_key](https://docs.scalr.io/scalr/docs/provider_resource_scalr_ssh_key.md)
* [scalr\_storage\_profile](https://docs.scalr.io/scalr/docs/provider_resource_scalr_storage_profile.md)
* [scalr\_tag](https://docs.scalr.io/scalr/docs/provider_resource_scalr_tag.md)
* [scalr\_var\_set](https://docs.scalr.io/scalr/docs/provider_resource_scalr_var_set.md)
* [scalr\_variable](https://docs.scalr.io/scalr/docs/provider_resource_scalr_variable.md)
* [scalr\_vcs\_provider](https://docs.scalr.io/scalr/docs/provider_resource_scalr_vcs_provider.md)
* [scalr\_webhook](https://docs.scalr.io/scalr/docs/provider_resource_scalr_webhook.md)
* [scalr\_workload\_identity\_provider](https://docs.scalr.io/scalr/docs/provider_resource_scalr_workload_identity_provider.md)
* [scalr\_workspace](https://docs.scalr.io/scalr/docs/provider_resource_scalr_workspace.md)
* [scalr\_workspace\_run\_schedule](https://docs.scalr.io/scalr/docs/provider_resource_scalr_workspace_run_schedule.md)
* [scalr\_workspace\_var\_set](https://docs.scalr.io/scalr/docs/provider_resource_scalr_workspace_var_set.md)