Fix inconsistencies in how IAM policies are stored in state #4722
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…p#6466) * Add tests for existing `dataSourceGoogleIamPolicyRead` function behaviour * Add red (non-passing) tests for new `dataSourceGoogleIamPolicyRead` behaviour * Update tests to check both numbers of bindings from config vs in policy_data output This is necessary because policy_data will need to consolidate bindings, and state for binding{} blocks needs to keep data separate * Update function to pass uncommented tests * Refactor test setup * Change structure of test input data to minimise processing in the test function + add and update test cases Need to check if test assumptions like `bindings on the same role with different conditions, with the same title, are next sorted by condition expression` is correct or not * WIP: Update sorting of bindings to include: role, condition presence, condition fields. * Formatting changes to make .erb match output .go file * Update tests to match the sorting behaviour of the API, update sorting function to pass tests * Refactor existing tests for clarity * Add tests for deduplication and complex sorting scenario * Fix sorting bug where 'lesser' roles is incorrectly sorted to a later index in a list if it has a condition * Refactor `dataSourceGoogleIamPolicyRead` to reduce looping and pull sorting function out into a named function * Make binding map use human-readable keys Signed-off-by: Modular Magician <magic-modules@google.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Partially fixes hashicorp/terraform-provider-google#8701
This PR changes how the
google_iam_policydata source stores the user-entered data in its computedpolicy_dataattribute. It is addressing the first issue I describe in this comment on the original issue.I've updated how the
google_iam_policydata source processes itsbindingblocks into a JSON string which it stores as thepolicy_dataattribute. I've made this processing resemble what happens in the API, so there should not be a mismatch between the JSON of the policy in the data source's state and the resource's state.Manual tests
Using the config I describe in this comment I apply the first plan to create everything and then make this small edit
When I generate a plan with the latest provider version I see lots of unnecessary diffs as reported in the original issue:
When I generate a plan using this PR's changes the diff is much smaller:
👆 The extra diffs for setting an empty description are another issue I'm thinking of handling in a separate PR to this one
Checklist
If this PR is for Terraform, I acknowledge that I have:
make testandmake lintto ensure it passes unit and linter tests.Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).N/ATestAccArtifactRegistryRepositoryIamPolicyGeneratedacceptance test that uses thegoogle_iam_policydata source and it passed okRelease Note Template for Downstream PRs (will be copied)
Derived from GoogleCloudPlatform/magic-modules#6466