vcd_catalog_access_control does not give the required rights for users

[scmi410]

Terraform Version

Terraform v1.5.7
on linux_amd64

Affected Resource(s)

Please list the resources as a list, for example:

• vcd_catalog
• vcd_catalog_access_control

Terraform Configuration Files

resource "vcd_catalog" "ubuntu-cloud-images" {
  org                = "my-org"
  name               = "ubuntu-cloud-images"
  delete_recursive   = "true"
  delete_force       = "true"
}

resource "vcd_catalog_access_control" "ubuntu-cloud-images" {
  org                            = "my-org"
  catalog_id                     = vcd_catalog.ubuntu-cloud-images.id
  shared_with_everyone           = false
  read_only_shared_with_all_orgs = true

  shared_with {
    user_id      = "urn:vcloud:user:93e4d0a7-b120-40ed-a5ed-baf2caad7b45"
    access_level = "Change"
  }
}

Debug Output

If necessary, logs can be provided

Expected Behavior

The catalog should be created in VCD with the user included.

Actual Behavior

The catalog is created in VCD, but without including the user.

Steps to Reproduce

create a resource vcs_catalog with code above

User Access rights

Org admin

[dataclouder]

Hi
Thanks for your report. I ran some tests. The behavior that you describe happens only when you have in the same resource read_only_shared_with_all_orgs = true and shared_with.
Fixing it is possible, but I am nit sure we can do it for the current release.
To help us evaluate the importance of this issue, could you describe a use case where this configuration would be important?

[scmi410]

Hi dataclouder,

shure, we are looking to create a catalog that distributes its vApp templates across all organizations. The goal is to keep these templates up-to-date automatically, potentially through a GitHub Action.
The interaction between the GitHub Action and the VCD ought to be executed by a user who holds only the essential permissions to update the templates. This guarantees that the procedure is secure and complies with the principle of least privilege.

Let me know if you need any additional information.

[dataclouder]

Addressed in #1291

[Didainius]

Both PRs are merged and are set for 3.14.