Add IAM Groups resources

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/selectel/dbaas-go v0.12.1
 	github.com/selectel/domains-go v1.0.2
 	github.com/selectel/go-selvpcclient/v3 v3.1.1
-	github.com/selectel/iam-go v0.2.0
+	github.com/selectel/iam-go v0.3.0
 	github.com/selectel/mks-go v0.14.0
 	github.com/selectel/secretsmanager-go v0.2.1
 	github.com/stretchr/testify v1.8.4

go.sum

@@ -170,8 +170,8 @@ github.com/selectel/domains-go v1.0.2 h1:Si6iGaMnTFJxwiJVI50DOdZnwcxc87kqaWrVQYW
 github.com/selectel/domains-go v1.0.2/go.mod h1:SugRKfq4sTpnOHquslCpzda72wV8u0cMBHx0C0l+bzA=
 github.com/selectel/go-selvpcclient/v3 v3.1.1 h1:C1q2LqqosiapoLpnGITGmysg0YCSQYDo2Gh69CioevM=
 github.com/selectel/go-selvpcclient/v3 v3.1.1/go.mod h1:NM7IXhh1IzqZ88DOw1Qc5Ez3tULLViXo95l5+rKPuyQ=
-github.com/selectel/iam-go v0.2.0 h1:c6ldpbsa/8R3b29ML5B21FU9oyJ2A2AwBNzCbE+pGN8=
-github.com/selectel/iam-go v0.2.0/go.mod h1:OIAkW7MZK97YUm+uvUgYbgDhkI9SdzTCxwd4yZoOR1o=
+github.com/selectel/iam-go v0.3.0 h1:HRoxSBXwvASE9v/A4WgeEDeMvomARIWyj2essV4LmYc=
+github.com/selectel/iam-go v0.3.0/go.mod h1:OIAkW7MZK97YUm+uvUgYbgDhkI9SdzTCxwd4yZoOR1o=
 github.com/selectel/mks-go v0.14.0 h1:huNq/oTutPc3ezB8HRqlGN9WJubTDETpNKuIVqcZOn0=
 github.com/selectel/mks-go v0.14.0/go.mod h1:VxtV3dzwgOEzZc+9VMQb9DvxfSlej2ZQ8jnT8kqIGgU=
 github.com/selectel/secretsmanager-go v0.2.1 h1:OSBrA/07lm/Ecpwg59IJHFAoUHZR29oyfwUgTpr/dos=

selectel/provider.go

@@ -27,6 +27,8 @@ const (
 	objectUser                    = "user"
 	objectServiceUser             = "service user"
 	objectS3Credentials           = "s3 credentials"
+	objectGroup                   = "group"
+	objectGroupMembership         = "group-membership"
 	objectCluster                 = "cluster"
 	objectKubeConfig              = "kubeconfig"
 	objectKubeVersions            = "kube-versions"
@@ -135,6 +137,8 @@ func Provider() *schema.Provider {
 			"selectel_iam_serviceuser_v1":                           resourceIAMServiceUserV1(),
 			"selectel_iam_user_v1":                                  resourceIAMUserV1(),
 			"selectel_iam_s3_credentials_v1":                        resourceIAMS3CredentialsV1(),
+			"selectel_iam_group_v1":                                 resourceIAMGroupV1(),
+			"selectel_iam_group_membership_v1":                      resourceIAMGroupMembershipV1(),
 			"selectel_vpc_vrrp_subnet_v2":                           resourceVPCVRRPSubnetV2(),        // DEPRECATED
 			"selectel_vpc_crossregion_subnet_v2":                    resourceVPCCrossRegionSubnetV2(), // DEPRECATED
 			"selectel_mks_cluster_v1":                               resourceMKSClusterV1(),

selectel/resource_selectel_iam_group_membership_v1.go

@@ -0,0 +1,197 @@
+package selectel
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"slices"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func resourceIAMGroupMembershipV1() *schema.Resource {
+	return &schema.Resource{
+		CreateContext: resourceIAMGroupMembershipV1Create,
+		ReadContext:   resourceIAMGroupMembershipV1Read,
+		UpdateContext: resourceIAMGroupMembershipV1Update,
+		DeleteContext: resourceIAMGroupMembershipV1Delete,
+		Schema: map[string]*schema.Schema{
+			"group_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"user_ids": {
+				Type:     schema.TypeList,
+				Required: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+		},
+	}
+}
+
+func resourceIAMGroupMembershipV1Create(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	iamClient, diagErr := getIAMClient(meta)
+	if diagErr != nil {
+		return diagErr
+	}
+
+	userIDsInterface := d.Get("user_ids").([]interface{})
+	userIDs := make([]string, len(userIDsInterface))
+	for i, v := range userIDsInterface {
+		userIDs[i] = v.(string)
+	}
+
+	log.Print(msgCreate(objectGroupMembership, d.Id()))
+	if len(userIDs) == 0 {
+		createErr := fmt.Errorf("error creating group membership: no user ids specified")
+		return diag.FromErr(errCreatingObject(objectGroupMembership, createErr))
+	}
+	err := iamClient.Groups.AddUsers(ctx, d.Get("group_id").(string), userIDs)
+	if err != nil {
+		return diag.FromErr(errCreatingObject(objectGroupMembership, err))
+	}
+
+	d.SetId(d.Get("group_id").(string))
+
+	return resourceIAMGroupMembershipV1Read(ctx, d, meta)
+}
+
+func resourceIAMGroupMembershipV1Read(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	iamClient, diagErr := getIAMClient(meta)
+	if diagErr != nil {
+		return diagErr
+	}
+
+	groupID := d.Id()
+
+	userIDsInterface := d.Get("user_ids").([]interface{})
+	userIDs := make([]string, len(userIDsInterface))
+	for i, v := range userIDsInterface {
+		userIDs[i] = v.(string)
+	}
+
+	response, err := iamClient.Groups.Get(ctx, groupID)
+	if err != nil {
+		return diag.FromErr(errGettingObject(objectGroupMembership, d.Id(), err))
+	}
+
+	responseUserIDs := make([]string, 0)
+	for _, user := range response.Users {
+		responseUserIDs = append(responseUserIDs, user.KeystoneID)
+	}
+
+	responseServiceUserIDs := make([]string, 0)
+	for _, serviceUser := range response.ServiceUsers {
+		responseServiceUserIDs = append(responseServiceUserIDs, serviceUser.ID)
+	}
+
+	d.Set("group_id", groupID)
+	d.Set("user_ids", append(responseUserIDs, responseServiceUserIDs...))
+
+	return nil
+}
+
+func resourceIAMGroupMembershipV1Update(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	iamClient, diagErr := getIAMClient(meta)
+	if diagErr != nil {
+		return diagErr
+	}
+
+	groupID := d.Id()
+
+	oldValue, newValue := d.GetChange("user_ids")
+
+	oldUserIDs := make([]string, len(oldValue.([]interface{})))
+	for i, v := range oldValue.([]interface{}) {
+		oldUserIDs[i] = v.(string)
+	}
+
+	newUserIDs := make([]string, len(newValue.([]interface{})))
+	for i, v := range newValue.([]interface{}) {
+		newUserIDs[i] = v.(string)
+	}
+
+	usersToAdd, usersToRemove := diffUsers(oldUserIDs, newUserIDs)
+
+	if len(usersToAdd) > 0 {
+		err := iamClient.Groups.AddUsers(ctx, groupID, usersToAdd)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	if len(usersToRemove) > 0 {
+		err := iamClient.Groups.DeleteUsers(ctx, groupID, usersToRemove)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	d.SetId(groupID)
+
+	return resourceIAMGroupMembershipV1Read(ctx, d, meta)
+}
+
+func resourceIAMGroupMembershipV1Delete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	iamClient, diagErr := getIAMClient(meta)
+	if diagErr != nil {
+		return diagErr
+	}
+
+	groupID := d.Id()
+
+	userIDsInterface := d.Get("user_ids").([]interface{})
+	userIDs := make([]string, len(userIDsInterface))
+	for i, v := range userIDsInterface {
+		userIDs[i] = v.(string)
+	}
+
+	err := iamClient.Groups.DeleteUsers(ctx, groupID, userIDs)
+	if err != nil {
+		return diag.FromErr(errDeletingObject(objectGroupMembership, d.Id(), err))
+	}
+
+	d.SetId("")
+
+	return nil
+}
+
+func diffUsers(oldUsers, newUsers []string) ([]string, []string) {
+	usersToAdd := make([]string, 0)
+	usersToRemove := make([]string, 0)
+
+	for _, user := range newUsers {
+		if !slices.Contains(oldUsers, user) {
+			usersToAdd = append(usersToAdd, user)
+		}
+	}
+
+	for _, user := range oldUsers {
+		if !slices.Contains(newUsers, user) {
+			usersToRemove = append(usersToRemove, user)
+		}
+	}
+
+	return usersToAdd, usersToRemove
+}
+
+// containsAll checks if sliceB is a subset of sliceA.
+func containsAll(sliceA, sliceB []string) bool {
+	for _, b := range sliceB {
+		found := false
+		for _, a := range sliceA {
+			if a == b {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	return true
+}

selectel/resource_selectel_iam_group_membership_v1_test.go

@@ -0,0 +1,136 @@
+package selectel
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccIAMV1GroupMembershipBasic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccSelectelPreCheck(t) },
+		ProviderFactories: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIAMV1GroupMembershipBasic(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccIAMV1GroupUpdate(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccSelectelPreCheck(t) },
+		ProviderFactories: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIAMV1GroupMembershipBasic(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+				),
+			},
+			{
+				Config: testAccIAMV1GroupMembershipUpdate(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.1"),
+				),
+			},
+			{
+				Config: testAccIAMV1GroupMembershipBasic(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+					resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+					resource.TestCheckNoResourceAttr("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.1"),
+				),
+			},
+		},
+	})
+}
+
+func testAccIAMV1GroupMembershipBasic() string {
+	return `
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_1" {
+  name        = "test-service-user-1"
+  password    = "Qazwsxedc123"
+  role {
+    role_name = "reader"
+    scope = "account"
+  }
+}
+
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_2" {
+  name        = "test-service-user-2"
+  password    = "Qazwsxedc123"
+  role {
+    role_name = "reader"
+    scope = "account"
+  }
+}
+
+resource "selectel_iam_group_v1" "group_tf_acc_test_1" {
+	name = "test-group"
+	role {
+	  	role_name = "reader"
+	  	scope = "account"
+	}
+}
+
+resource "selectel_iam_group_membership_v1" "membership_tf_acc_test_1" {
+	group_id = selectel_iam_group_v1.group_tf_acc_test_1.id
+
+	user_ids = [
+		selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_1.id
+	]
+}
+`
+}
+
+func testAccIAMV1GroupMembershipUpdate() string {
+	return `
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_1" {
+  name        = "test-service-user-1"
+  password    = "Qazwsxedc123"
+  role {
+    role_name = "reader"
+    scope = "account"
+  }
+}
+
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_2" {
+  name        = "test-service-user-2"
+  password    = "Qazwsxedc123"
+  role {
+    role_name = "reader"
+    scope = "account"
+  }
+}
+
+resource "selectel_iam_group_v1" "group_tf_acc_test_1" {
+	name = "test-group"
+	role {
+	  	role_name = "reader"
+	  	scope = "account"
+	}
+}
+
+resource "selectel_iam_group_membership_v1" "membership_tf_acc_test_1" {
+	group_id = selectel_iam_group_v1.group_tf_acc_test_1.id
+
+	user_ids = [
+		selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_1.id,
+		selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_2.id
+	]
+}
+`
+}