-
Notifications
You must be signed in to change notification settings - Fork 301
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #974 from JonasBak/main
Add azuread_directory_role_eligibility_schedule_request resource
- Loading branch information
Showing
5 changed files
with
321 additions
and
14 deletions.
There are no files selected for viewing
59 changes: 59 additions & 0 deletions
59
docs/resources/directory_role_eligibility_schedule_request.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| --- | ||
| subcategory: "Directory Roles" | ||
| --- | ||
|
|
||
| # Resource: azuread_directory_role_eligibility_schedule_request | ||
|
|
||
| Manages a single directory role eligibility schedule request within Azure Active Directory. | ||
|
|
||
| ## API Permissions | ||
|
|
||
| The following API permissions are required in order to use this resource. | ||
|
|
||
| The calling principal requires one of the following application roles: `RoleEligibilitySchedule.ReadWrite.Directory` or `RoleManagement.ReadWrite.Directory`. | ||
|
|
||
| The calling principal requires one of the following directory roles: `Privileged Role Administrator` or `Global Administrator`. | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| data "azuread_user" "example" { | ||
| user_principal_name = "[email protected]" | ||
| } | ||
| resource "azuread_directory_role" "example" { | ||
| display_name = "Application Administrator" | ||
| } | ||
| resource "azuread_directory_role_eligibility_schedule_request" "example" { | ||
| role_definition_id = azuread_directory_role.example.template_id | ||
| principal_id = azuread_user.example.object_id | ||
| directory_scope_id = "/" | ||
| justification = "Example" | ||
| } | ||
| ``` | ||
|
|
||
| ~> Note the use of the `template_id` attribute when referencing built-in roles. | ||
|
|
||
| ## Argument Reference | ||
|
|
||
| The following arguments are supported: | ||
|
|
||
| * `directory_scope_id` - (Required) Identifier of the directory object representing the scope of the role eligibility. Changing this forces a new resource to be created. | ||
| * `justification` - (Required) Justification for why the principal is granted the role eligibility. Changing this forces a new resource to be created. | ||
| * `principal_id` - (Required) The object ID of the principal to granted the role eligibility. Changing this forces a new resource to be created. | ||
| * `role_definition_id` - (Required) The template ID (in the case of built-in roles) or object ID (in the case of custom roles) of the directory role you want to assign. Changing this forces a new resource to be created. | ||
|
|
||
| ## Attributes Reference | ||
|
|
||
| In addition to all arguments above, the following attributes are exported: | ||
|
|
||
| *No additional attributes are exported* | ||
|
|
||
| ## Import | ||
|
|
||
| Directory role eligibility schedule requests can be imported using the ID of the assignment, e.g. | ||
|
|
||
| ```shell | ||
| terraform import azuread_directory_role_eligibility_schedule_request.example 822ec710-4c9f-4f71-a27a-451759cc7522 | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
168 changes: 168 additions & 0 deletions
168
internal/services/directoryroles/directory_role_eligibility_schedule_request_resource.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,168 @@ | ||
| package directoryroles | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "log" | ||
| "net/http" | ||
| "time" | ||
|
|
||
| "github.com/hashicorp/go-azure-sdk/sdk/odata" | ||
| "github.com/hashicorp/go-uuid" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/diag" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/clients" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/helpers" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/tf" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/utils" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/validate" | ||
| "github.com/manicminer/hamilton/msgraph" | ||
| ) | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResource() *schema.Resource { | ||
| return &schema.Resource{ | ||
| CreateContext: directoryRoleEligibilityScheduleRequestResourceCreate, | ||
| ReadContext: directoryRoleEligibilityScheduleRequestResourceRead, | ||
| DeleteContext: directoryRoleEligibilityScheduleRequestResourceDelete, | ||
|
|
||
| Timeouts: &schema.ResourceTimeout{ | ||
| Create: schema.DefaultTimeout(5 * time.Minute), | ||
| Read: schema.DefaultTimeout(5 * time.Minute), | ||
| Update: schema.DefaultTimeout(5 * time.Minute), | ||
| Delete: schema.DefaultTimeout(5 * time.Minute), | ||
| }, | ||
|
|
||
| Importer: tf.ValidateResourceIDPriorToImport(func(id string) error { | ||
| if _, err := uuid.ParseUUID(id); err != nil { | ||
| return fmt.Errorf("specified ID (%q) is not valid: %s", id, err) | ||
| } | ||
| return nil | ||
| }), | ||
|
|
||
| Schema: map[string]*schema.Schema{ | ||
| "role_definition_id": { | ||
| Description: "The object ID of the directory role for this role eligibility schedule request", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.UUID, | ||
| }, | ||
|
|
||
| "principal_id": { | ||
| Description: "The object ID of the member principal", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.UUID, | ||
| }, | ||
|
|
||
| "directory_scope_id": { | ||
| Description: "Identifier of the directory object representing the scope of the role eligibility schedule request", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.NoEmptyStrings, | ||
| }, | ||
|
|
||
| "justification": { | ||
| Description: "Justification for why the role is assigned", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.NoEmptyStrings, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| roleDefinitionId := d.Get("role_definition_id").(string) | ||
| principalId := d.Get("principal_id").(string) | ||
| justification := d.Get("justification").(string) | ||
| directoryScopeId := d.Get("directory_scope_id").(string) | ||
|
|
||
| now := time.Now() | ||
| properties := msgraph.UnifiedRoleEligibilityScheduleRequest{ | ||
| Action: utils.String(msgraph.UnifiedRoleScheduleRequestActionAdminAssign), | ||
| RoleDefinitionId: &roleDefinitionId, | ||
| PrincipalId: &principalId, | ||
| Justification: &justification, | ||
| DirectoryScopeId: &directoryScopeId, | ||
| ScheduleInfo: &msgraph.RequestSchedule{ | ||
| StartDateTime: &now, | ||
| Expiration: &msgraph.ExpirationPattern{ | ||
| Type: utils.String(msgraph.ExpirationPatternTypeNoExpiration), | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| roleEligibilityScheduleRequest, status, err := client.Create(ctx, properties) | ||
| if err != nil { | ||
| return tf.ErrorDiagF(err, "Eligibility schedule request for role %q to principal %q, received %d with error: %+v", roleDefinitionId, principalId, status, err) | ||
| } | ||
| if roleEligibilityScheduleRequest == nil || roleEligibilityScheduleRequest.ID == nil { | ||
| return tf.ErrorDiagF(errors.New("returned role roleEligibilityScheduleRequest ID was nil"), "API Error") | ||
| } | ||
|
|
||
| d.SetId(*roleEligibilityScheduleRequest.ID) | ||
|
|
||
| if err := helpers.WaitForUpdate(ctx, func(ctx context.Context) (*bool, error) { | ||
| defer func() { client.BaseClient.DisableRetries = false }() | ||
| client.BaseClient.DisableRetries = true | ||
|
|
||
| resr, status, err := client.Get(ctx, *roleEligibilityScheduleRequest.ID, odata.Query{}) | ||
| if err != nil { | ||
| if status == http.StatusNotFound { | ||
| return utils.Bool(false), nil | ||
| } | ||
| return nil, err | ||
| } | ||
| return utils.Bool(resr != nil), nil | ||
| }); err != nil { | ||
| return tf.ErrorDiagF(err, "Waiting for role eligibility schedule request for %q to be created for directory role %q", principalId, roleDefinitionId) | ||
| } | ||
|
|
||
| return directoryRoleEligibilityScheduleRequestResourceRead(ctx, d, meta) | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| id := d.Id() | ||
| roleEligibilityScheduleRequest, status, err := client.Get(ctx, id, odata.Query{}) | ||
| if err != nil { | ||
| if status == http.StatusNotFound { | ||
| log.Printf("[DEBUG] roleEligibilityScheduleRequest with ID %q was not found - removing from state", id) | ||
| d.SetId("") | ||
| return nil | ||
| } | ||
| return tf.ErrorDiagF(err, "Retrieving roleEligibilityScheduleRequest %q", id) | ||
| } | ||
|
|
||
| tf.Set(d, "role_definition_id", roleEligibilityScheduleRequest.RoleDefinitionId) | ||
| tf.Set(d, "principal_id", roleEligibilityScheduleRequest.PrincipalId) | ||
| tf.Set(d, "justification", roleEligibilityScheduleRequest.Justification) | ||
| tf.Set(d, "directory_scope_id", roleEligibilityScheduleRequest.DirectoryScopeId) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| id := d.Id() | ||
| roleEligibilityScheduleRequest, _, err := client.Get(ctx, id, odata.Query{}) | ||
| if err != nil { | ||
| return tf.ErrorDiagF(err, "Retrieving roleEligibilityScheduleRequest %q", id) | ||
| } | ||
|
|
||
| roleEligibilityScheduleRequest.Action = utils.String(msgraph.UnifiedRoleScheduleRequestActionAdminRemove) | ||
|
|
||
| if _, _, err := client.Create(ctx, *roleEligibilityScheduleRequest); err != nil { | ||
| return tf.ErrorDiagF(err, "Deleting role eligibility schedule request %q: %+v", d.Id(), err) | ||
| } | ||
| return nil | ||
| } |
74 changes: 74 additions & 0 deletions
74
...rnal/services/directoryroles/directory_role_eligibility_schedule_request_resource_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| package directoryroles_test | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/go-azure-sdk/sdk/odata" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/acceptance" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/acceptance/check" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/clients" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/utils" | ||
| ) | ||
|
|
||
| type RoleEligibilityScheduleRequestResource struct{} | ||
|
|
||
| func TestAccRoleEligibilityScheduleRequest_basic(t *testing.T) { | ||
| data := acceptance.BuildTestData(t, "azuread_directory_role_eligibility_schedule_request", "test") | ||
| r := RoleEligibilityScheduleRequestResource{} | ||
|
|
||
| data.ResourceTestIgnoreDangling(t, r, []resource.TestStep{ | ||
| { | ||
| Config: r.basic(data), | ||
| Check: resource.ComposeTestCheckFunc( | ||
| check.That(data.ResourceName).ExistsInAzure(r), | ||
| ), | ||
| }, | ||
| }) | ||
| } | ||
|
|
||
| func (r RoleEligibilityScheduleRequestResource) Exists(ctx context.Context, clients *clients.Client, state *terraform.InstanceState) (*bool, error) { | ||
| client := clients.DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| resr, status, err := client.Get(ctx, state.ID, odata.Query{}) | ||
| if err != nil { | ||
| fmt.Printf("%s, %v\n", err.Error(), status) | ||
| if status == http.StatusNotFound { | ||
| return nil, fmt.Errorf("Role Eligibility Schedule Request with ID %q does not exist", state.ID) | ||
| } | ||
| return nil, fmt.Errorf("failed to retrieve Role Eligibility Schedule Request with object ID %q: %+v", state.ID, err) | ||
| } | ||
|
|
||
| return utils.Bool(resr.ID != nil && *resr.ID == state.ID), nil | ||
| } | ||
|
|
||
| func (r RoleEligibilityScheduleRequestResource) basic(data acceptance.TestData) string { | ||
| return fmt.Sprintf(` | ||
| provider "azuread" {} | ||
| data "azuread_domains" "test" { | ||
| only_initial = true | ||
| } | ||
| resource "azuread_user" "test" { | ||
| user_principal_name = "acctestManager.%[1]d@${data.azuread_domains.test.domains.0.domain_name}" | ||
| display_name = "acctestManager-%[1]d" | ||
| password = "%[2]s" | ||
| } | ||
| resource "azuread_directory_role" "test" { | ||
| display_name = "Application Administrator" | ||
| } | ||
| resource "azuread_directory_role_eligibility_schedule_request" "test" { | ||
| role_definition_id = azuread_directory_role.test.template_id | ||
| principal_id = azuread_user.test.object_id | ||
| directory_scope_id = "/" | ||
| justification = "abc" | ||
| } | ||
| `, data.RandomInteger, data.RandomPassword) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters