cloudflare_account_roles capped at 50 but 51 now exist - go SDK issue?

[evanrappe]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

terraform -v
Terraform v1.5.5
on darwin_amd64

• provider registry.terraform.io/cloudflare/cloudflare v4.7.1

Affected resource(s)

data.cloudflare_account_roles

Terraform configuration files

data "cloudflare_account_roles" "this" {
  account_id = local.accountid
}

locals {
  roles_by_name = {
    for role in data.cloudflare_account_roles.this.roles :
    role.name => role
  }

 editors = [
    "test@me.com",
 ]

  editor_roles = [
    local.roles_by_name["Administrator"].id,
  ]
}


resource "cloudflare_account_member" "editors" {
  for_each      = toset(local.editors)
  account_id    = cloudflare_account.account.id
  email_address = each.key
  role_ids      = local.editor_roles
}

Link to debug output

n/a

Panic output

No response

Expected output

Clean plan, this code is not new

Actual output

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: Invalid index
│ 
│   on users.tf line 23, in locals:
│   23:     local.roles_by_name["Administrator"].id,
│     ├────────────────
│     │ local.roles_by_name is object with 50 attributes
│ 
│ The given key does not identify an element in this collection value.

Steps to reproduce

Try to reference the Administrator role in this datasource. It is no longer returned because it's the 51st role returned by the API.

Additional factoids

Here's the output from pulling the roles from the api manually.
curl --request GET --url 'https://api.cloudflare.com/client/v4/accounts/accountID/roles?per_page=100

 "result_info": {
    "page": 1,
    "per_page": 100,
    "total_pages": 1,
    "count": 51,
    "total_count": 51

References

Seems like this is just a simple fix in the cloudflare-go sdk but I didn't have enough debug info to raise an issue or PR over there directly and the version will have to be bumped here if it's fixed there anyway.
https://github.com/cloudflare/cloudflare-go/blob/master/account_roles.go#L47

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

Thank you for reporting this issue! For maintainers to dig into issues it is required that all issues include the entirety of TF_LOG=DEBUG output to be provided. The only parts that should be redacted are your user credentials in the X-Auth-Key, X-Auth-Email and Authorization HTTP headers. Details such as zone or account identifiers are not considered sensitive but can be redacted if you are very cautious. This log file provides additional context from Terraform, the provider and the Cloudflare API that helps in debugging issues. Without it, maintainers are very limited in what they can do and may hamper diagnosis efforts.

This issue has been marked with triage/needs-information and is unlikely to receive maintainer attention until the log file is provided making this a complete bug report.

[evanrappe]

I don't see a good reason to bother with a debug log here since we can see what the issue is, but let me know if it's still required to get this fixed.

[romachalm]

I have the same issue, also having the Administrator role removed :

data "cloudflare_account_roles" "account_roles" {
    account_id = "XXX"
}

output "debug" {
    value = sort([ for role in data.cloudflare_account_roles.account_roles.roles : role.name ])
}

returns

  + debug = [
      + "API Gateway",
      + "API Gateway Read",
      + "Administrator Read Only",
      + "Analytics",
      + "Audit Logs Viewer",
      + "Billing",
      [...]

whereas the curl to the API returns it, and indeed, Administrator is the latest object in the json result, ie 51st

[acobaugh]

Same issue here. Hoping this can be resolved soon as this is more or less blocking us from managing cloudflare with terraform.

[garrettgalow]

There is a linked PR in the go library that fixes this. The team will review and merge which should fix this

[tiagoasousa]

this issue is still present why was it closed off as completed?

[garrettgalow]

The fix will be in the next release slated for this week

[jacobbednarz]

This functionality has been released in v4.16.0 of the Terraform Cloudflare Provider.

Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!