cloudstack/resource_cloudstack_role_permission.go:204

• With authoritative = true, Delete removes all role permissions, including any that may have been added out-of-band after the last apply. This is a significant behavioral edge case that is not currently documented in the new resource docs; please document this explicitly (or adjust behavior to only delete permissions known to be managed by this resource, if that’s the intended contract).

	if d.Get("authoritative").(bool) {
		for _, rp := range rolePermissions {
			if err := deleteCloudStackRolePermission(cs, rp.Id); err != nil {
				return err
			}
		}
		return nil
	}

cloudstack/resource_cloudstack_role_permission.go:81

• The schema uses permission as both the block name (permission { ... }) and an attribute inside the block (permission = \"allow\"|\"deny\"), which is confusing in configuration and documentation. Since this is a new resource, consider renaming the inner attribute to something unambiguous like effect, access, or action (keeping allow/deny values) to improve UX and reduce misreads.

			"permission": {
				Type:        schema.TypeList,
				Optional:    true,
				Description: "Ordered list of role permission rules. Rules are evaluated from top to bottom.",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "ID of the role permission.",
						},
						"rule": {
							Type:        schema.TypeString,
							Required:    true,
							Description: "The API name or wildcard (e.g. 'list*') the permission applies to.",
						},
						"permission": {
							Type:         schema.TypeString,
							Required:     true,
							ValidateFunc: validation.StringInSlice([]string{"allow", "deny"}, false),
							Description:  "Whether the rule is allowed or denied. Valid options are: allow, deny.",
						},

Suppressed comments (1)

cloudstack/resource_cloudstack_role_permission_test.go:274

• testAccCheckCloudStackRolePermissionDestroy currently only verifies that ListRolePermissions doesn’t error; it never asserts that managed permission rules were actually removed during destroy. This means the acceptance tests would still pass even if the resource Delete implementation were a no-op.

func testAccCheckCloudStackRolePermissionDestroy(s *terraform.State) error {
	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)

	for _, rs := range s.RootModule().Resources {
		if rs.Type != "cloudstack_role_permission" {

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite