You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[#250](https://github.com/dbt-labs/terraform-provider-dbtcloud/issues/250) - [Experimental] Create a new resource called `dbtcloud_group_partial_permissions` to manage permissions of a single group from different resources which can be set across different Terraform projects/workspaces. The dbt Cloud API doesn't provide endpoints for adding/removing single permissions, so the logic in the provider is more complex than other resources. If the resource works as expected for the provider users we could create similar ones for "partial" notifications and "partial" license mappings.
Provide a partial set of permissions for a group. This is different from dbt_cloud_group as it allows to have multiple resources updating the same dbt Cloud group and is useful for companies managing a single dbt Cloud Account configuration from different Terraform projects/workspaces.
6
+
If a company uses only one Terraform project/workspace to manage all their dbt Cloud Account config, it is recommended to use dbt_cloud_group instead of dbt_cloud_group_partial_permissions.
7
+
~> This is currently an experimental resource and any feedback is welcome in the GitHub repository.
8
+
The current behavior of the resource is the following:
9
+
when using dbt_cloud_group_partial_permissions, don't use dbt_cloud_group for the same group in any other project/workspace. Otherwise, the behavior is undefined and partial permissions might be removed.when defining a new dbt_cloud_group_partial_permissions
10
+
11
+
if the group doesn't exist with the given name, it will be createdif a group exists with the given name, permissions will be added in the dbt Cloud group if they are not present yetin a given Terraform project/workspace, avoid having different ~~dbtcloudgrouppartialpermissions` for the same group name to prevent sync issues. Add all the permissions in the same resource.all resources for the same group name need to have the same values for assign_by_default and sso_mapping_groups. Those fields are not considered "partial". (Please raise feedback in GitHub if you think that sso_mapping_groups should be "partial" as well)when a resource is updated, the dbt Cloud group will be updated accordingly, removing and adding permissionswhen the resource is deleted/destroyed, if the resulting permission sets is empty, the group will be deleted ; otherwise, the group will be updated, removing the permissions from the deleted resource
12
+
---
13
+
14
+
# dbtcloud_group_partial_permissions (Resource)
15
+
16
+
17
+
Provide a partial set of permissions for a group. This is different from `dbt_cloud_group` as it allows to have multiple resources updating the same dbt Cloud group and is useful for companies managing a single dbt Cloud Account configuration from different Terraform projects/workspaces.
18
+
19
+
If a company uses only one Terraform project/workspace to manage all their dbt Cloud Account config, it is recommended to use `dbt_cloud_group` instead of `dbt_cloud_group_partial_permissions`.
20
+
21
+
~> This is currently an experimental resource and any feedback is welcome in the GitHub repository.
22
+
23
+
The current behavior of the resource is the following:
24
+
25
+
- when using `dbt_cloud_group_partial_permissions`, don't use `dbt_cloud_group` for the same group in any other project/workspace. Otherwise, the behavior is undefined and partial permissions might be removed.
26
+
- when defining a new `dbt_cloud_group_partial_permissions`
27
+
- if the group doesn't exist with the given `name`, it will be created
28
+
- if a group exists with the given `name`, permissions will be added in the dbt Cloud group if they are not present yet
29
+
- in a given Terraform project/workspace, avoid having different ~~dbt_cloud_group_partial_permissions` for the same group name to prevent sync issues. Add all the permissions in the same resource.
30
+
- all resources for the same group name need to have the same values for `assign_by_default` and `sso_mapping_groups`. Those fields are not considered "partial". (Please raise feedback in GitHub if you think that `sso_mapping_groups` should be "partial" as well)
31
+
- when a resource is updated, the dbt Cloud group will be updated accordingly, removing and adding permissions
32
+
- when the resource is deleted/destroyed, if the resulting permission sets is empty, the group will be deleted ; otherwise, the group will be updated, removing the permissions from the deleted resource
33
+
34
+
## Example Usage
35
+
36
+
```terraform
37
+
// we add some permissions to the group "TF Group 1" (existing or not) to a new project
// we add Admin permissions to the group "TF Group 2" (existing or not) to a new project
55
+
// it is possible to add more permissions to the same group name in other Terraform projects/workspaces, using another `dbtcloud_group_partial_permissions` resource
-`name` (String) The name of the group. This is used to identify an existing group
75
+
76
+
### Optional
77
+
78
+
-`assign_by_default` (Boolean) Whether the group will be assigned by default to users. The value needs to be the same for all partial permissions for the same group.
79
+
-`group_permissions` (Attributes Set) Partial permissions for the group. Those permissions will be added/removed when config is added/removed. (see [below for nested schema](#nestedatt--group_permissions))
80
+
-`sso_mapping_groups` (Set of String) Mapping groups from the IdP. At the moment the complete list needs to be provided in each partial permission for the same group.
81
+
82
+
### Read-Only
83
+
84
+
-`id` (Number) The ID of the group
85
+
86
+
<aid="nestedatt--group_permissions"></a>
87
+
### Nested Schema for `group_permissions`
88
+
89
+
Required:
90
+
91
+
-`all_projects` (Boolean) Whether access should be provided for all projects or not.
92
+
-`permission_set` (String) Set of permissions to apply. The permissions allowed are the same as the ones for the `dbtcloud_group` resource.
93
+
94
+
Optional:
95
+
96
+
-`project_id` (Number) Project ID to apply this permission to for this group.
// we add Admin permissions to the group "TF Group 2" (existing or not) to a new project
19
+
// it is possible to add more permissions to the same group name in other Terraform projects/workspaces, using another `dbtcloud_group_partial_permissions` resource
0 commit comments