Document why for_each in okta_app_group_assignments is discouraged

[MIJOTHY-V2]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

---

Description

The current documentation for okta_app_group_assignments states

Important: Do not use in conjunction with for_each

It is not clear why this is the case and if this applies to all for_each usage.

For example, this seems like an obvious "bad" usage of for_each, because a dynamic block achieves the same without clobbering other group assignments:

resource "okta_app_bookmark" "this" {
  label = "https://internet.com"
  url   = "https://internet.com"
}

resource "okta_app_group_assignments" "this" {
  # Naughty, use `dynamic` instead
  for_each = ["group-a", "group-b"]

  app_id = okta_app_bookmark.this.id

  group {
    id = each.value
  }
}

However, in the below example, a user is creating multiple applications, and assigning the same group to those multiple applications. This can't be achieved with dynamic, and seems like a logical usage of for_each. Does the recommendation to "not use in conjunction with for_each" also apply here?

resource "okta_app_bookmark" "this" {
  for_each = ["https://internet.com", "https://website.com"]

  label = each.value
  url   = each.value
}

resource "okta_app_group_assignments" "this" {
  # Why is this naughty?
  for_each = ["https://internet.com", "https://website.com"]

  app_id = okta_app_bookmark.this[each.value].id

  group {
    id = "group-a"
  }
}

New or Affected Resource(s)

• okta_app_group_assignments

References

• a28e366
• https://developer.hashicorp.com/terraform/language/expressions/dynamic-blocks

[exitcode0]

For example, this seems like an obvious "bad" usage of for_each, because a dynamic block achieves the same without clobbering other group assignments:

resource "okta_app_bookmark" "this" {
  label = "https://internet.com"
  url   = "https://internet.com"
}

resource "okta_app_group_assignments" "this" {
  # Naughty, use `dynamic` instead
  for_each = ["group-a", "group-b"]

  app_id = okta_app_bookmark.this.id

  group {
    id = each.value
  }
}

This approach would likely cause you issues because okta_app_group_assignments assumes that it will manage ALL Okta groups assigned to an application, thus this approach would leave you with only group-b assigned to the Okta application

---

However, in the below example, a user is creating multiple applications, and assigning the same group to those multiple applications. This can't be achieved with dynamic, and seems like a logical usage of for_each. Does the recommendation to "not use in conjunction with for_each" also apply here?

resource "okta_app_bookmark" "this" {
  for_each = ["https://internet.com", "https://website.com"]

  label = each.value
  url   = each.value
}

resource "okta_app_group_assignments" "this" {
  # Why is this naughty?
  for_each = ["https://internet.com", "https://website.com"]

  app_id = okta_app_bookmark.this[each.value].id

  group {
    id = "group-a"
  }
}

Based on my understanding of the resource's implementation, I don't see an issue with this approach, it looks like this was introduced in #2009, perhaps @duytiennguyen-okta can shed some light on this