How can I make a user a member of "Domain Admins" without importing to state?

[Lucero7919]

Description

Group Memberships works fine for groups created through TF, but I would like to add a user to an OOB AD Domain Group (Domain Admins). Ideally, I don't want to import this group into state first and as it wasn't created by TF, I don't think a Data call will work.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[jpatigny]

Hello @Lucero7919,

You can use a group datasource to select the group for the membership resource and and user datasource(s) to get existing users

Example:

Adding an existing user to built-in group "Domain Admins"

data "ad_group" "domain_admins" {
    group_id = "CN=Domain Admins,CN=Users,DC=jej,DC=net"
}

data "ad_user" "da1" {
    user_id = "jej"
}

resource ad_group_membership "gm" {
    group_id = data.ad_group.domain_admins.sam_account_name
    group_members  = [ data.ad_user.da1.sam_account_name ]
}

[Nothing4You]

That example above is currently not reliable, see #94.
A workaround would be referencing group members with .id instead of .sam_account_name .

@Lucero7919 is your intention to keep existing users in the group and only manage additional members via terraform next to unmanaged ones or just replace the full member list?
Replacing works just fine this way, this is exactly what data sources are intended for, partially managing the member list does not work this way.