Support JSON Object for Policy Statements in `launchdarkly_custom_role` Resource

[yonivoi96]

I would like to request a feature enhancement for the launchdarkly_custom_role resource in the LaunchDarkly Terraform provider. Currently, the policy statements must be defined using multiple policy_statements nested blocks.
The current approach makes it hard to manage complex roles with numerous policies.
The suggested behavior can help with it and in addition it will enable to use Terraform's powerful templating features.

Current behavior:

resource "launchdarkly_custom_role" "example" {
  key         = "example-role-key-1"
  name        = "example role"
  description = "This is an example role"

  policy_statements {
    effect    = "allow"
    resources = ["proj/*:env/production:flag/*"]
    actions   = ["*"]
  }
  policy_statements {
    effect    = "allow"
    resources = ["proj/*:env/production"]
    actions   = ["*"]
  }
}

Desired behavior:

[
  {
    "effect": "allow",
    "resources": ["proj/*:env/production:flag/*"],
    "actions": ["*"]
  },
  {
    "effect": "allow",
    "resources": ["proj/*:env/production"],
    "actions": ["*"]
  }
]

resource "launchdarkly_custom_role" "example" {
  key         = "example-role-key-1"
  name        = "example role"
  description = "This is an example role"

  policy = jsonencode(file("${path.module}/policy_statements.json"))
}

[sloloris]

Hi @yonivoi96 ! Thank you so much for reaching out to help us improve our Terraform provider!

I will file an internal ticket to follow up on this. I do not think it would be difficult to implement and I agree it would be cleaner. However, the existing pattern is unfortunately still quite common across Terraform providers from what we can see and this would likely be a breaking change requiring a major version release. Because of that, I think it is unlikely we will address this in the near future. That said, if you do see any similar examples from major providers please direct them our way! It will help us make a product case for the change :)

I will leave this issue open for now.

[yonivoi96]

Hi @sloloris,
Appreciate the quick response.
AWS provider uses this method in several resources such as:
aws_iam_role
aws_kms_key