Allow Cloud Identity group membership lookup by alias or email

[andrewesweet]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

I want to find the members of a Cloud Identity group. I'm synchronising them from another directory service, so I'd like to use the identifiers from that source system e.g. a name ("Group Alias" in Cloud Identity speak) or email ("Group Email"), so "foo" or "[email protected]".

Unfortunately, the existing google_cloud_identity_group_memberships datasource allows lookup by Group ID only ("groups/abcd1234"), a unique key per GCP organisation generated by Cloud Identity. The only way to discover this ID with this provider is to list all groups in the org using google_cloud_identity_groups and filter the result. For a large number of groups this is slow to execute. If you expect to frequently want to look this up, this is also a potential quota limit problem.

Ideally, I'd like google_cloud_identity_group_membership to allow one to specify a group alias, group email or group ID and Just Do The Right Thing (TM), as is the interface offered by the equivalent googleworkspace provider functionality. Alternatively, a datasource that exposes the search API or lookup API could be used to find the required group IDs and pass them into the existing data sources.

New or Affected Resource(s)

• google_cloud_identity_group_memberships

Potential Terraform Configuration

If expanding the set of identifiers accepted by the existing data source:

data "google_cloud_identity_group_memberships" "members" {
  group = "[email protected]"
}

If exposing the search API:

data "google_cloud_identity_groups_search" "search" {
  query = "groupKey == '[email protected]'" # Or "display_name == 'foo'" for alias lookup
  view = "FULL" # Or BASIC
}

data "google_cloud_identity_group_memberships" "members" {
  group = one(data.google_cloud_identity_groups_search.groups).name # Best to do some validation rather than take the first result in
}

If exposing the lookup API:

data "google_cloud_identity_group_lookup" "lookup" {
  id = "[email protected]"
  namespace = null # The default value
}

data "google_cloud_identity_group_memberships" "members" {
  group = data.google_cloud_identity_group_lookup.name
}

References

• groups.lookup API
• groups.search API
• b/300098791

[melinath]

Potentially related: #8255

[rileykarson]

Discussed in triage: We prefer the second option of implementing dedicated datasource(s) for the search/lookup APIs

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.