-
Notifications
You must be signed in to change notification settings - Fork 135
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
IAM: permissions groups #521
Conversation
@@ -28,7 +28,6 @@ resource "ovh_iam_policy" "manager" { | |||
"account:apiovh:me/certificates/get", | |||
"account:apiovh:me/tag/get", | |||
"account:apiovh:services/get", | |||
"account:apiovh:*", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I found it was a good thing to have at least one example with a wildcard.
That illustrated that this field could take several values.
Thus I would keep at least a mention of wildcard (and thus either change the policy name or add a second one in example)
@@ -42,6 +41,7 @@ resource "ovh_iam_policy" "manager" { | |||
* `allow` - List of actions allowed on resources by identities | |||
* `except` - List of overrides of action that must not be allowed even if they are caught by allow. Only makes sens if allow contains wildcards. | |||
* `deny` - List of actions that will be denied no matter what policy exists. | |||
* `permissions_group` - Set of permissions group that apply to the policy. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
* `permissions_group` - Set of permissions group that apply to the policy. | |
* `permissions_group` - Set of permissions included in the policy. (They are overriden by allow, except & deny fields) |
I would also detail how the permission group behaves compared to the allow, except & deny fields in the policy (suggestion between parenthesis above)
* `description` - Group description. | ||
* `allow` - Set of actions allowed by the permissions group. | ||
* `except` - Set of actions that will be subtracted from the `allow` list. | ||
* `deny` - Set of actions that will be denied no matter what permissions group exists. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I find the wording surprising. Especially because a permission group doesn't reference a permission group
What about
* `deny` - Set of actions that will be denied no matter what permissions group exists. | |
* `deny` - Set of actions that will be denied no matter what permissions are defined in the permission group or policies using it. |
* `owner` - Owner of the permissions group. | ||
* `created_at` - Creation date of this group. | ||
* `updated_at` - Date of the last update of this group. | ||
* `read_only` - Indicates that the permissions group is a default one. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
* `read_only` - Indicates that the permissions group is a default one. | |
* `read_only` - Indicates that this is a default permission group, managed by OVHcloud. |
3b827b3
to
4ed9942
Compare
Description
Add support for the now available
permissions_groups
for the IAM.This means supporting them in the policies and adding them as datasource and resource.
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
make testacc TESTARGS="-run TestAccIamPerm.*"
Checklist:
go mod vendor
if I added or modifygo.mod
file