Inheritable role assignment using OS-INHERIT Identity API extension

[Carlotronics]

Hi,

OpenStack Identity API v3 OS-INHERIT Extension makes possible to assign inheritable permissions on project to an user/group. It would be nice to be able to use this feature with this provider, either with a inherit boolean in openstack_identity_role_assignment_v3 or a new resource (e.g. openstack_osinherit_identity_role_assignment_v3).

Terraform Version

v1.0.11

Affected Resource(s)

• openstack_identity_role_assignment_v3

Terraform Configuration Files

resource "openstack_identity_project_v3" "parent_project" {
  name = "parent_project"
}

resource "openstack_identity_project_v3" "child_project" {
  name = "child_project"
  parent_id = resource.openstack_identity_project_v3.parent_project.id
}

resource "openstack_identity_user_v3" "user_1" {
  name = "user_1"
  default_project_id = "${openstack_identity_project_v3.parent_project.id}"
}

resource "openstack_identity_role_v3" "role_1" {
  name = "role_1"
}

Behavior proposal

The following tf file should create a role assignment using the OS-INHERIT API extension, thus making it inheritable to child projects. user_1 should then have access to both parent_project and child_project.

resource "openstack_identity_role_assignment_v3" "role_assignment_1" {
  user_id = "${openstack_identity_user_v3.user_1.id}"
  project_id = "${openstack_identity_project_v3.parent_project.id}"
  role_id = "${openstack_identity_role_v3.role_1.id}"
  inherit = true
}

[nikParasyr]

Hello, thanks for reporting this.
It is indeed a nice feature we should support.

This needs to be implemented upstream first. Related ticket => gophercloud/gophercloud#2205