Skip to content

Commit f5c3b09

Browse files
author
Markus Schwer
committed
feat(authorization): add custom role resource and data source
1 parent 6548065 commit f5c3b09

11 files changed

Lines changed: 1114 additions & 6 deletions

File tree

‎docs/data-sources/authorization_project_custom_role.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stackit_authorization_project_custom_role Data Source - stackit"
4+
subcategory: ""
5+
description: |-
6+
Custom Role resource schema.
7+
---
8+
9+
# stackit_authorization_project_custom_role (Data Source)
10+
11+
Custom Role resource schema.
12+
13+
## Example Usage
14+
15+
```terraform
16+
data "stackit_authorization_project_custom_role" "example" {
17+
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
18+
name = "my.custom.role"
19+
}
20+
```
21+
22+
<!-- schema generated by tfplugindocs -->
23+
## Schema
24+
25+
### Required
26+
27+
- `resource_id` (String) Resource to add the custom role to.
28+
- `role_id` (String) The ID of the role.
29+
30+
### Read-Only
31+
32+
- `description` (String) A human readable description of the role.
33+
- `id` (String) Terraform's internal resource identifier. It is structured as "[resource_id],[role_id]".
34+
- `name` (String) Name of the role
35+
- `permissions` (List of String) Permissions for the role

‎docs/resources/authorization_project_custom_role.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stackit_authorization_project_custom_role Resource - stackit"
4+
subcategory: ""
5+
description: |-
6+
Custom Role resource schema.
7+
---
8+
9+
# stackit_authorization_project_custom_role (Resource)
10+
11+
Custom Role resource schema.
12+
13+
## Example Usage
14+
15+
```terraform
16+
resource "stackit_resourcemanager_project" "example" {
17+
name = "example_project"
18+
owner_email = "foo.bar@stackit.cloud"
19+
parent_container_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
20+
}
21+
22+
resource "stackit_authorization_project_custom_role" "example" {
23+
resource_id = stackit_resourcemanager_project.example.project_id
24+
name = "my.custom.role"
25+
description = "Some description"
26+
permissions = [
27+
"iam.subject.get"
28+
]
29+
}
30+
31+
# Only use the import statement, if you want to import an existing custom role
32+
import {
33+
to = stackit_authorization_project_custom_role.import-example
34+
id = "${var.project_id},${var.custom_role_id}"
35+
}
36+
```
37+
38+
<!-- schema generated by tfplugindocs -->
39+
## Schema
40+
41+
### Required
42+
43+
- `description` (String) A human readable description of the role.
44+
- `name` (String) Name of the role
45+
- `permissions` (List of String) Permissions for the role
46+
- `resource_id` (String) Resource to add the custom role to.
47+
48+
### Read-Only
49+
50+
- `id` (String) Terraform's internal resource identifier. It is structured as "[resource_id],[role_id]".
51+
- `role_id` (String) The ID of the role.

‎examples/data-sources/stackit_authorization_project_custom_role/data-source.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "stackit_authorization_project_custom_role" "example" {
2+
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
3+
name = "my.custom.role"
4+
}
5+

‎examples/resources/stackit_authorization_project_custom_role/resource.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "stackit_resourcemanager_project" "example" {
2+
name = "example_project"
3+
owner_email = "foo.bar@stackit.cloud"
4+
parent_container_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
5+
}
6+
7+
resource "stackit_authorization_project_custom_role" "example" {
8+
resource_id = stackit_resourcemanager_project.example.project_id
9+
name = "my.custom.role"
10+
description = "Some description"
11+
permissions = [
12+
"iam.subject.get"
13+
]
14+
}
15+
16+
# Only use the import statement, if you want to import an existing custom role
17+
import {
18+
to = stackit_authorization_project_custom_role.import-example
19+
id = "${var.project_id},${var.custom_role_id}"
20+
}
21+

‎stackit/internal/services/authorization/authorization_acc_test.go‎

Lines changed: 116 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,15 @@ var (
4040

4141
//go:embed testdata/resource-org-role-assignment-duplicate.tf
4242
resourceOrgRoleAssignmentDuplicate string
43+
44+
//go:embed testdata/custom-role.tf
45+
customRole string
4346
)
4447

45-
var testProjectName = fmt.Sprintf("proj-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum))
46-
var testFolderName = fmt.Sprintf("folder-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum))
48+
var (
49+
testProjectName = fmt.Sprintf("proj-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum))
50+
testFolderName = fmt.Sprintf("folder-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum))
51+
)
4752

4853
var testConfigVarsProjectRoleAssignment = config.Variables{
4954
"name": config.StringVariable(testProjectName),
@@ -67,6 +72,24 @@ var testConfigVarsOrgRoleAssignment = config.Variables{
6772
"subject": config.StringVariable(testutil.TestProjectServiceAccountEmail),
6873
}
6974

75+
var testConfigVarsCustomRole = config.Variables{
76+
"project_id": config.StringVariable(testutil.ProjectId),
77+
"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
78+
"organization_id": config.StringVariable(testutil.OrganizationId),
79+
"role_name": config.StringVariable(fmt.Sprintf("tf-acc-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlpha))),
80+
"role_description": config.StringVariable("Some description"),
81+
"role_permissions_0": config.StringVariable("iam.role.list"),
82+
}
83+
84+
var testConfigVarsCustomRoleUpdated = config.Variables{
85+
"project_id": config.StringVariable(testutil.ProjectId),
86+
"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
87+
"organization_id": config.StringVariable(testutil.OrganizationId),
88+
"role_name": config.StringVariable(fmt.Sprintf("tf-acc-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlpha))),
89+
"role_description": config.StringVariable("Updated description"),
90+
"role_permissions_0": config.StringVariable("iam.role.edit"),
91+
}
92+
7093
func testConfigVarsProjectRoleAssignmentUpdated() config.Variables {
7194
tempConfig := make(config.Variables, len(testConfigVarsProjectRoleAssignment))
7295
maps.Copy(tempConfig, testConfigVarsProjectRoleAssignment)
@@ -480,3 +503,94 @@ func testAccCheckOrganizationRoleAssignmentDestroy(s *terraform.State) error {
480503
_, _ = client.RemoveMembers(ctx, containerParentId).RemoveMembersPayload(payload).Execute()
481504
return nil
482505
}
506+
507+
func TestAccProjectCustomRoleResource(t *testing.T) {
508+
t.Log("Testing org role assignment resource")
509+
resource.Test(t, resource.TestCase{
510+
ProtoV6ProviderFactories: testutil.TestAccProtoV6ProviderFactories,
511+
Steps: []resource.TestStep{
512+
{
513+
ConfigVariables: testConfigVarsCustomRole,
514+
Config: testutil.AuthorizationProviderConfig() + customRole,
515+
Check: resource.ComposeAggregateTestCheckFunc(
516+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRole["project_id"])),
517+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "name", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_name"])),
518+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "description", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_description"])),
519+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "permissions.#", "1"),
520+
resource.TestCheckTypeSetElemAttr("stackit_authorization_project_custom_role.custom-role", "permissions.*", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_permissions_0"])),
521+
resource.TestCheckResourceAttrSet("stackit_authorization_project_custom_role.custom-role", "role_id"),
522+
),
523+
},
524+
// Data source
525+
{
526+
ConfigVariables: testConfigVarsCustomRole,
527+
Config: fmt.Sprintf(`
528+
%s
529+
530+
data "stackit_authorization_project_custom_role" "custom-role" {
531+
resource_id = stackit_authorization_project_custom_role.custom-role.resource_id
532+
role_id = stackit_authorization_project_custom_role.custom-role.role_id
533+
}
534+
`,
535+
testutil.AuthorizationProviderConfig()+customRole,
536+
),
537+
Check: resource.ComposeAggregateTestCheckFunc(
538+
resource.TestCheckResourceAttr("data.stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRole["project_id"])),
539+
resource.TestCheckResourceAttrPair(
540+
"stackit_authorization_project_custom_role.custom-role", "resource_id",
541+
"data.stackit_authorization_project_custom_role.custom-role", "resource_id",
542+
),
543+
resource.TestCheckResourceAttrPair(
544+
"stackit_authorization_project_custom_role.custom-role", "role_id",
545+
"data.stackit_authorization_project_custom_role.custom-role", "role_id",
546+
),
547+
resource.TestCheckResourceAttrPair(
548+
"stackit_authorization_project_custom_role.custom-role", "name",
549+
"data.stackit_authorization_project_custom_role.custom-role", "name",
550+
),
551+
resource.TestCheckResourceAttrPair(
552+
"stackit_authorization_project_custom_role.custom-role", "description",
553+
"data.stackit_authorization_project_custom_role.custom-role", "description",
554+
),
555+
resource.TestCheckResourceAttrPair(
556+
"stackit_authorization_project_custom_role.custom-role", "permissions",
557+
"data.stackit_authorization_project_custom_role.custom-role", "permissions",
558+
),
559+
),
560+
},
561+
// Import
562+
{
563+
ConfigVariables: testConfigVarsCustomRole,
564+
ResourceName: "stackit_authorization_project_custom_role.custom-role",
565+
ImportStateIdFunc: func(s *terraform.State) (string, error) {
566+
r, ok := s.RootModule().Resources["stackit_authorization_project_custom_role.custom-role"]
567+
if !ok {
568+
return "", fmt.Errorf("couldn't find resource stackit_authorization_project_custom_role.custom-role")
569+
}
570+
roleId, ok := r.Primary.Attributes["role_id"]
571+
if !ok {
572+
return "", fmt.Errorf("couldn't find attribute role_id")
573+
}
574+
575+
return fmt.Sprintf("%s,%s", testutil.ProjectId, roleId), nil
576+
},
577+
ImportState: true,
578+
ImportStateVerify: true,
579+
},
580+
// Update
581+
{
582+
ConfigVariables: testConfigVarsCustomRoleUpdated,
583+
Config: testutil.AuthorizationProviderConfig() + customRole,
584+
Check: resource.ComposeAggregateTestCheckFunc(
585+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["project_id"])),
586+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "name", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_name"])),
587+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "description", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_description"])),
588+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "permissions.#", "1"),
589+
resource.TestCheckTypeSetElemAttr("stackit_authorization_project_custom_role.custom-role", "permissions.*", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_permissions_0"])),
590+
resource.TestCheckResourceAttrSet("stackit_authorization_project_custom_role.custom-role", "role_id"),
591+
),
592+
},
593+
// Deletion is done by the framework implicitly
594+
},
595+
})
596+
}

0 commit comments

Comments
 (0)