Yes — in Prefect 3.x you can provision Service Accounts via infrastructure-as-code using the official Terraform provider. Key links: - Provider: Terraform Registry: Prefect provider - Service Account resource: prefect_service_account - Workspace access (assign roles): prefect_workspace_access - Workspace role (lookup/create): data.prefect_workspace_role and prefect_workspace_role - Prefect docs on service accounts: Service accounts (Prefect Cloud) Minimal example:

terraform {
  required_providers {
    prefect = {
      source  = "PrefectHQ/prefect"
      version = ">= 0.7.0"
    }
  }
}

variable "prefect_api_key" { sensitive = true }
variable "prefect_account_id" {}
variable "workspace_id" {}

provider "prefect" {
  api_key    = var.prefect_api_key
  account_id = var.prefect_account_id
}

# Create a service account
resource "prefect_service_account" "bot" {
  name              = "ci-cd-bot"
  account_role_name = "Member"  # optional at the account level
}

# Look up a workspace role (e.g., Developer)
data "prefect_workspace_role" "developer" {
  name = "Developer"
}

# Grant the service account access to a workspace with a role
resource "prefect_workspace_access" "bot_access" {
  accessor_type     = "SERVICE_ACCOUNT"
  accessor_id       = prefect_service_account.bot.id
  workspace_id      = var.workspace_id
  workspace_role_id = data.prefect_workspace_role.developer.id
}

# Optionally output the API key (sensitive)
output "service_account_api_key" {
  value     = prefect_service_account.bot.api_key
  sensitive = true
}

Optional: automatic key rotation with hashicorp/time

terraform {
  required_providers {
    time = {
      source  = "hashicorp/time"
      version = ">= 0.9.0"
    }
  }
}

resource "time_rotating" "ninety_days" {
  rotation_days = 90
}

resource "prefect_service_account" "bot" {
  name               = "ci-cd-bot"
  api_key_expiration = time_rotating.ninety_days.rotation_rfc3339
  old_key_expires_in_seconds = 300
}

Notes: - The

api_key

attribute is generated on create/update; treat it as sensitive and store it in a secret manager. - You can also import existing service accounts:

terraform import prefect_service_account.bot id/<uuid>

or

name/<service-account-name>

. Would you like an example tailored to a specific workspace and role, or with automatic key rotation baked in?