chore: Adjust SA environment variables

[lantoli]

Adjust SA environment variables

Link to any related issue(s): CLOUDP-350205

Type of change:

• Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
• New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
• Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR. A migration guide must be created or updated.
• This change requires a documentation update
• Documentation fix/enhancement

Required Checklist:

• I have signed the MongoDB CLA
• I have read the contributing guides
• I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
• I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
• I have added any necessary documentation (if appropriate)
• I have run make fmt and formatted my code
• If changes include deprecations or removals I have added appropriate changelog entries.
• If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

[Copilot]

Pull Request Overview

This PR adds Service Account authentication support to the Terraform provider, enabling authentication via OAuth Client ID/Secret and Access Tokens. It also refactors the credential source selection to enforce a strict hierarchy (AWS Secrets Manager → provider vars → environment variables).

• Adds Service Account authentication with Client ID/Secret and Access Token support
• Refactors configuration system to use modular credential handling
• Updates the provider to prioritize different authentication methods properly

Reviewed Changes

Copilot reviewed 30 out of 31 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/config/service_account.go	Implements Service Account OAuth token source management
internal/config/credentials.go	Adds credential hierarchy and authentication method detection
internal/config/client.go	Refactors client creation to support multiple authentication methods
internal/provider/provider.go	Updates TPF provider to use new credential system
internal/provider/provider_sdk2.go	Updates SDK v2 provider to use new credential system
internal/provider/aws_credentials.go	Simplifies AWS credential handling
internal/testutil/acc/pre_check.go	Updates environment variable name for access token validation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] The sleep duration has been doubled from 1 to 2 minutes. Consider if this change is necessary or if there's a better way to handle the race condition without increasing test execution time.

Suggested change

	time.Sleep(2 * time.Minute) // decrease the chance of `CONTAINER_WAITING_FOR_FAST_RECORD_CLEAN_UP`: "A transient error occurred. Please try again in a minute or use a different name"
	// Poll for up to 2 minutes to ensure the cluster is fully deleted and avoid transient errors.
	const pollInterval = 5 * time.Second
	const pollTimeout = 2 * time.Minute
	deadline := time.Now().Add(pollTimeout)
	for time.Now().Before(deadline) {
	clusterResp, _ := advancedcluster.GetClusterDetails(t.Context(), diags, projectID, clusterName, acc.MongoDBClient, false)
	if clusterResp == nil {
	// Cluster is deleted, exit early.
	return
	}
	time.Sleep(pollInterval)
	}
	t.Fatalf("cluster %s was not fully deleted after waiting %v", clusterName, pollTimeout)

[Copilot]

The type name has changed from DiskBackupApiPolicyItem to BackupComplianceOnDemandPolicyItem. Ensure this type change is intentional and matches the expected API contract.