fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1369

andreaangiolillo · 2023-08-04T07:33:40Z

Description

JIRA ticket: INTMDB-898

Link to any related issue(s): #1278

Type of change:

Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR.
Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR.
This change requires a documentation update
Documentation fix/enhancement

Required Checklist:

I have signed the MongoDB CLA
I have read the contribution guidelines
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code

Further comments

I locally tested the provider with the following configuration files and checked that the resource was successfully created, the terraform plan did not return any changes and the terraform destroy worked as expected.

resource "mongodbatlas_project" "atlas-project" {
  name   = "Issue-1278"
  org_id = "60ddf55c27a5a20955a707d7"
}

resource "mongodbatlas_project_api_key" "api_1" {
  description = "test api_key multi"
  project_id  = mongodbatlas_project.atlas-project.id

  project_assignment {
    project_id = mongodbatlas_project.atlas-project.id
    role_names = ["ORG_BILLING_ADMIN", "GROUP_READ_ONLY"]
  }

  project_assignment {
    project_id = "63dcfc256af00a5934e60924"
    role_names = ["GROUP_READ_ONLY"]
  }

  project_assignment {
    project_id = "64c23af6f133166c39176cbf"
    role_names = ["GROUP_OWNER"]
  }
}

resource "mongodbatlas_project" "atlas-project" {
  name   = "Issue-1278"
  org_id = "60ddf55c27a5a20955a707d7"
}

resource "mongodbatlas_project_api_key" "api_1" {
  description = "test api_key multi"
  project_id  = mongodbatlas_project.atlas-project.id

  project_assignment {
    project_id = mongodbatlas_project.atlas-project.id
    role_names = ["GROUP_OWNER"]
  }

  project_assignment {
    project_id = "63dcfc256af00a5934e60924"
    role_names = ["GROUP_READ_ONLY"]
  }

  project_assignment {
    project_id = "64c23af6f133166c39176cbf"
    role_names = ["GROUP_OWNER"]
  }
}

Running tool: /Users/andrea.angiolillo/.asdf/shims/go test -timeout 300000s -run ^TestAccConfigRSProjectAPIKey_OrgRoles$ github.com/mongodb/terraform-provider-mongodbatlas/mongodbatlas

ok  	github.com/mongodb/terraform-provider-mongodbatlas/mongodbatlas	20.060s

mongodbatlas/resource_mongodbatlas_project_api_key_test.go

Zuhairahmed

Few doc comments below, also @andreaangiolillo can you confirm that this update includes no breaking changes?

website/docs/r/project_api_key.html.markdown

Co-authored-by: Zuhair Ahmed <[email protected]>

…mongodbatlas into INTMDB-898_3

andreaangiolillo · 2023-08-09T15:43:59Z

can you confirm that this update includes no breaking changes?

@Zuhairahmed I tested the changes with the following configuration which contains the examples in the doc and they were all successful. Is there any other scenario that you think I am missing? Thanks

resource "mongodbatlas_project" "atlas-project" {
  name   = "Issue-1278"
  org_id = "60ddf55c27a5a20955a707d7"
}

resource "mongodbatlas_project_api_key" "test1" {
  description = "Description of your API key"
  project_id  = mongodbatlas_project.atlas-project.id
  role_names  = ["GROUP_OWNER"]
}

resource "mongodbatlas_project_api_key" "test22" {
  description = "Description of your API key"
  project_id  = mongodbatlas_project.atlas-project.id

  project_assignment {
    project_id = mongodbatlas_project.atlas-project.id
    role_names = ["GROUP_READ_ONLY", "GROUP_OWNER"]
  }

  project_assignment {
    project_id = "63dcfc256af00a5934e60924"
    role_names = ["GROUP_READ_ONLY"]
  }
}

resource "mongodbatlas_project_api_key" "api_1" {
  description = "test api_key multi"
  project_id  = mongodbatlas_project.atlas-project.id

  project_assignment {
    project_id = mongodbatlas_project.atlas-project.id
    role_names = ["ORG_BILLING_ADMIN", "GROUP_READ_ONLY"]
  }

  project_assignment {
    project_id = "63dcfc256af00a5934e60924"
    role_names = ["GROUP_READ_ONLY"]
  }

  project_assignment {
    project_id = "64c23af6f133166c39176cbf"
    role_names = ["GROUP_OWNER"]
  }
}

maastha

LGTM

AgustinBettati · 2023-08-09T17:27:58Z

mongodbatlas/resource_mongodbatlas_project_api_key.go

+	orgReadOnlyRole   = "ORG_READ_ONLY"
+)
+
+var orgRoleProvided = false


is there a risk in having this global variable being used in separate operations? Set during create, and then used during read and delete.

no, I don't this is an issue but I renamed the var to make it more specific to the project API key resource

My only doubt is that this might work during acceptance tests as the test framework maintains one plugin gRPC server for the duration of each test case, while in normal Terraform operations the plugin server starts and stops (reference).
Approving the PR, I would just try a local build to be sure org roles are supported with no issue.

is there a risk in having this global variable being used in separate operations? Set during create, and then used during read and delete.

I think I misread this comment the first time. The reason why I defined this as a global var was to use it in the create and read operations as I need to know if the user has provided any ORG roles in the config:

The main reason for this is that the CREATE endpoint creates an org API key with ORG_READ_ONLY role if the user did not provide any ORG_ROLES as input. In this scenario, the READ will return the ORG_READ_ONLY role (in addition to the GROUP_* roles) even if the user provided only GROUP roles

while in normal Terraform operations the plugin server starts and stops (reference).

In this case, the READ operation is called as last step of the CREATE so we do not hit this issue

I tested the changes with the Terraform configurations provided in the description of the PR ( ORG_READ_ONLY is there) and in this comment #1369 (comment). Let me know if I should test locally another scenario

I tested with the following example:

resource "mongodbatlas_project_api_key" "api_1" { description = "test api_key multii" project_id = "<project_id>" project_assignment { project_id = "<project_id>" role_names = ["ORG_READ_ONLY", "GROUP_READ_ONLY"] } }

terraform apply creates the api key successfully.

then running terraform plan outputs incorrect diff showing that "ORG_READ_ONLY" will be added.

I believe the projectAPIKeyOrgRoleProvided is not preserving its value during the create and following read operation done in terraform plan, so it filters out the org role.

Let me know if you are able to reproduce the same, it is indeed an edge case but might be worth addressing.

I am not able to reproduce the issue

apply

tfa 6s  1.20.3  3.1.1  16.18.0 bazel 5.4.0 ﴃ cloud-local mongodbatlas_project.atlas-project: Refreshing state... [id=64d4acf6bf469a0c1549c869] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # mongodbatlas_project_api_key.api_1 will be created + resource "mongodbatlas_project_api_key" "api_1" { + api_key_id = (known after apply) + description = "test api_key multii" + id = (known after apply) + private_key = (sensitive value) + project_id = "64d4acf6bf469a0c1549c869" + public_key = (known after apply) + project_assignment { + project_id = "64d4acf6bf469a0c1549c869" + role_names = [ + "GROUP_READ_ONLY", + "ORG_READ_ONLY", ] } } Plan: 1 to add, 0 to change, 0 to destroy. mongodbatlas_project_api_key.api_1: Creating... mongodbatlas_project_api_key.api_1: Creation complete after 1s [id=YXBpX2tleV9pZA==:NjRkNGFkMWJlODA3YjAzNWZjMjlmNTY2-cHJvamVjdF9pZA==:NjRkNGFjZjZiZjQ2OWEwYzE1NDljODY5] Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

plan:

tf plan 3s  1.20.3  3.1.1  16.18.0 bazel 5.4.0 ﴃ cloud-local mongodbatlas_project.atlas-project: Refreshing state... [id=64d4acf6bf469a0c1549c869] mongodbatlas_project_api_key.api_1: Refreshing state... [id=YXBpX2tleV9pZA==:NjRkNGFkMWJlODA3YjAzNWZjMjlmNTY2-cHJvamVjdF9pZA==:NjRkNGFjZjZiZjQ2OWEwYzE1NDljODY5] No changes. Your infrastructure matches the configuration. Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed

I was able to reproduce the issue: the reason why it did not "fail" during the plan is that I was using the provider in debug mode. Thanks for the discussion here. I will see if I find a way around

Unfortunately, I have not found a way to allow the use of ORG_READ_ONLY since it is automatically added when ORG roles are not provided. As a result, I updated the logic to now allow the ORG_READ_ONLY for project assignments and update the documentation to explain why. This should not be a breaking change since customers were not able to use this resource with org roles.

website/docs/r/project_api_key.html.markdown

andreaangiolillo · 2023-08-10T10:27:58Z

website/docs/r/project_api_key.html.markdown

+
+~> **NOTE:** The organization level roles can be defined only in the first `project_assignment` element.
+
+~> **NOTE:** The `ORG_READ_ONLY` role at the organization level is invalid in this context. When the `project_assignment``` lacks organizational roles, the `mongodbatlas_project_api_key` resource generates an organization API key with the `ORG_READ_ONLY` role and associates it with `GROUP_*` roles. Consequently, the resource does not permit the use of `ORG_READ_ONLY` to ensure consistency between configuration and state.


andreaangiolillo · 2023-08-10T10:30:11Z

mongodbatlas/resource_mongodbatlas_project_api_key.go

+func (apiKey *APIProjectAssignmentKeyInput) validateOrgKeyRoles() error {
+	// When the user does not provide org roles
+	// the API key POST endpoing creates an org api key with
+	// the role ORG_READ_ONLY. We want to remove this from the state
+	// to avoid differences between config and state
+	for _, r := range apiKey.RoleNames {
+		if r == orgReadOnlyRole {
+			return fmt.Errorf(`%[1]s is not an allowed role for the resource. Remove %[1]s from the roles and run terraform apply again. Check out the resource documentation to know more`, orgReadOnlyRole)
+		}
+	}
+
+	return nil
+}


validating that the user did not provide ORG_READ_ONLY

AgustinBettati

LGTM

…illing Admin permission and Project Read Only for projects (#1369)" This reverts commit a7c4fdc.

…illing Admin permission and Project Read Only for projects (#1369)" (#1416) This reverts commit a7c4fdc.

INTMDB-898: fixing

122af77

andreaangiolillo changed the title ~~INTMDB-898: fixing~~ fix: INTMDB-898: fixing Aug 4, 2023

andreaangiolillo added 4 commits August 9, 2023 09:10

Merge remote-tracking branch 'origin/master' into INTMDB-898_3

301c978

fixed bug

28bdbfc

added acceptance tests

65c49f2

Updated doc

1be6d59

andreaangiolillo added the bug label Aug 9, 2023

andreaangiolillo changed the title ~~fix: INTMDB-898: fixing~~ fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects Aug 9, 2023

Update acceptance-tests.yml

f2e0820

andreaangiolillo marked this pull request as ready for review August 9, 2023 10:49

andreaangiolillo requested a review from a team as a code owner August 9, 2023 10:49

andreaangiolillo requested a review from Zuhairahmed August 9, 2023 10:49

maastha reviewed Aug 9, 2023

View reviewed changes

mongodbatlas/resource_mongodbatlas_project_api_key_test.go Show resolved Hide resolved

mongodbatlas/resource_mongodbatlas_project_api_key_test.go Show resolved Hide resolved

Zuhairahmed reviewed Aug 9, 2023

View reviewed changes

website/docs/r/project_api_key.html.markdown Show resolved Hide resolved

website/docs/r/project_api_key.html.markdown Outdated Show resolved Hide resolved

Update website/docs/r/project_api_key.html.markdown

1bf555b

Co-authored-by: Zuhair Ahmed <[email protected]>

Zuhairahmed approved these changes Aug 9, 2023

View reviewed changes

andreaangiolillo added 3 commits August 9, 2023 16:18

Addressed PR comments

0a1ad79

Merge remote-tracking branch 'origin/master' into INTMDB-898_3

038b90e

Merge branch 'INTMDB-898_3' of github.com:mongodb/terraform-provider-…

b728902

…mongodbatlas into INTMDB-898_3

andreaangiolillo requested a review from maastha August 9, 2023 15:28

maastha approved these changes Aug 9, 2023

View reviewed changes

AgustinBettati reviewed Aug 9, 2023

View reviewed changes

andreaangiolillo added 2 commits August 10, 2023 09:20

Addressed PR comments

955f875

Addressed PR comments

56774ae

andreaangiolillo requested review from AgustinBettati and Zuhairahmed August 10, 2023 08:22

AgustinBettati approved these changes Aug 10, 2023

View reviewed changes

Merge remote-tracking branch 'origin/master' into INTMDB-898_3

1105890

andreaangiolillo requested a review from AgustinBettati August 10, 2023 09:27

Addressed PR comments

fec47fa

andreaangiolillo commented Aug 10, 2023

View reviewed changes

AgustinBettati approved these changes Aug 10, 2023

View reviewed changes

Zuhairahmed approved these changes Aug 11, 2023

View reviewed changes

andreaangiolillo merged commit a7c4fdc into master Aug 11, 2023

andreaangiolillo deleted the INTMDB-898_3 branch August 11, 2023 08:53

andreaangiolillo added a commit that referenced this pull request Aug 25, 2023

Revert "fix: How do I create Organization API Key with Organization B…

aa5bae7

…illing Admin permission and Project Read Only for projects (#1369)" This reverts commit a7c4fdc.

andreaangiolillo mentioned this pull request Aug 25, 2023

revert: "fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects" #1416

Merged

andreaangiolillo added a commit that referenced this pull request Aug 25, 2023

revert:"fix: How do I create Organization API Key with Organization B…

317cbba

…illing Admin permission and Project Read Only for projects (#1369)" (#1416) This reverts commit a7c4fdc.

andreaangiolillo added a commit that referenced this pull request Sep 7, 2023

revert:"fix: How do I create Organization API Key with Organization B…

4ff8cf2

…illing Admin permission and Project Read Only for projects (#1369)" (#1416) This reverts commit a7c4fdc.

jmccarty3 mentioned this pull request Mar 14, 2024

Assigning existing Organization API key to new/updated projects #2030

Open

AgustinBettati mentioned this pull request Mar 15, 2024

How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1278

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1369

fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1369

andreaangiolillo commented Aug 4, 2023 •

edited

Loading

Zuhairahmed left a comment

andreaangiolillo commented Aug 9, 2023

maastha left a comment

AgustinBettati Aug 9, 2023

andreaangiolillo Aug 10, 2023

andreaangiolillo Aug 10, 2023

AgustinBettati Aug 10, 2023

andreaangiolillo Aug 10, 2023 •

edited

Loading

andreaangiolillo Aug 10, 2023 •

edited

Loading

AgustinBettati Aug 10, 2023

andreaangiolillo Aug 10, 2023

andreaangiolillo Aug 10, 2023

andreaangiolillo Aug 10, 2023

andreaangiolillo Aug 10, 2023

andreaangiolillo Aug 10, 2023

AgustinBettati left a comment


		~> NOTE: The organization level roles can be defined only in the first `project_assignment` element.

		~> NOTE: The `ORG_READ_ONLY` role at the organization level is invalid in this context. When the `project_assignment``` lacks organizational roles, the `mongodbatlas_project_api_key` resource generates an organization API key with the `ORG_READ_ONLY` role and associates it with `GROUP_*` roles. Consequently, the resource does not permit the use of `ORG_READ_ONLY` to ensure consistency between configuration and state.

fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1369

fix: How do I create Organization API Key with Organization Billing Admin permission and Project Read Only for projects #1369

Conversation

andreaangiolillo commented Aug 4, 2023 • edited Loading

Description

Type of change:

Required Checklist:

Further comments

Zuhairahmed left a comment

Choose a reason for hiding this comment

andreaangiolillo commented Aug 9, 2023

maastha left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andreaangiolillo Aug 10, 2023 • edited Loading

Choose a reason for hiding this comment

andreaangiolillo Aug 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AgustinBettati left a comment

Choose a reason for hiding this comment

andreaangiolillo commented Aug 4, 2023 •

edited

Loading

andreaangiolillo Aug 10, 2023 •

edited

Loading

andreaangiolillo Aug 10, 2023 •

edited

Loading