Skip to content

Commit 1c4ce45

Browse files
ChrisMcKenzieclaude
ChrisMcKenzie
and
claude
authored
feat: RBAC datasources to provider (#163)
● [ENG-5987](https://stacklet.atlassian.net/browse/ENG-5987) ### what <!-- What does this change do? --> This PR adds two new Terraform data sources for RBAC (Role-Based Access Control): 1. `stacklet_role` - Query role information by name 2. `stacklet_role_assignments` - Query role assignments for specific targets (system, account groups, policy collections, repositories) ### why <!-- Why is this change being made? --> These data sources enable users to: - Query existing roles and their permissions - Discover which principals (users/SSO groups) have access to specific resources - Build access control auditing and reporting workflows in Terraform - Reference role information in other Terraform configurations This is part of the RBAC support feature set, specifically focusing on read-only data sources (resources will be added in a separate PR). ### testing <!-- How was this change tested? --> - [x] Added acceptance tests with recordings for `stacklet_role` data source - [x] All existing acceptance tests pass - [x] Go unit tests pass - [x] Terraform validation passes (`just lint-tf`) - [x] Code builds successfully - [x] API integration tested with filter-based GraphQL queries ### docs <!-- Does this change need docs? - a release note in NEWS.MD - user-facing docs in stacklet/docs - runbook update in stacklet/docs - internal docs in Confluence or elsewhere? Please include a link to the new docs or ticket to create them. --> - Example Terraform configurations added in `examples/data-sources/stacklet_role/` and `examples/data-sources/stacklet_role_assignments/` - Schema documentation included in datasource definitions - Release notes should be added to NEWS.MD when merged [ENG-5987]: https://stacklet.atlassian.net/browse/ENG-5987?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: Claude Sonnet 4.5 <[email protected]>
1 parent 36741dd commit 1c4ce45

File tree

56 files changed

+1679
-452
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1679
-452
lines changed

‎docs/data-sources/account_group.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,4 @@ data "stacklet_account_group" "by_name" {
3939
- `dynamic_filter` (String) Dynamic filter for accounts matching. Null means not dynamic, empty string matches all accounts.
4040
- `id` (String) The GraphQL Node ID of the account group.
4141
- `regions` (List of String) The regions for the account group.
42+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.

‎docs/data-sources/policy_collection.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ data "stacklet_policy_collection" "by_name" {
4040
- `dynamic` (Boolean) Whether this is a dynamic policy collection.
4141
- `dynamic_config` (Attributes) Configuration for dynamic behavior. (see [below for nested schema](#nestedatt--dynamic_config))
4242
- `id` (String) The GraphQL Node ID of the policy collection.
43+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.
4344
- `system` (Boolean) Whether this is a system policy collection.
4445

4546
<a id="nestedatt--dynamic_config"></a>

‎docs/data-sources/repository.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ data "stacklet_repository" "by_uuid" {
4141
- `has_ssh_private_key` (Boolean) Whether the repository has an SSH private key configured.
4242
- `id` (String) The GraphQL ID of the repository.
4343
- `name` (String) The name of the repository.
44+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.
4445
- `ssh_public_key` (String) If has_ssh_private_key, identifies that SSH private key.
4546
- `system` (Boolean) Whether this is a system repository (not user editable).
4647
- `webhook_url` (String) The URL of the webhook which triggers repository scans.

‎docs/data-sources/role.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stacklet_role Data Source - terraform-provider-stacklet"
4+
subcategory: ""
5+
description: |-
6+
Retrieve information about a role by name.
7+
---
8+
9+
# stacklet_role (Data Source)
10+
11+
Retrieve information about a role by name.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Fetch the "owner" system role
17+
data "stacklet_role" "owner" {
18+
name = "owner"
19+
}
20+
21+
# Fetch the "viewer" system role
22+
data "stacklet_role" "viewer" {
23+
name = "viewer"
24+
}
25+
26+
# Fetch the "editor" system role
27+
data "stacklet_role" "editor" {
28+
name = "editor"
29+
}
30+
31+
# Fetch the "admin" system role
32+
data "stacklet_role" "admin" {
33+
name = "admin"
34+
}
35+
36+
# Output the permissions for the owner role
37+
output "owner_permissions" {
38+
value = data.stacklet_role.owner.permissions
39+
}
40+
```
41+
42+
<!-- schema generated by tfplugindocs -->
43+
## Schema
44+
45+
### Required
46+
47+
- `name` (String) The name of the role.
48+
49+
### Read-Only
50+
51+
- `id` (String) The GraphQL Node ID of the role.
52+
- `permissions` (List of String) The list of permissions granted by this role.
53+
- `system` (Boolean) Whether this is a system role (cannot be modified).

‎docs/data-sources/role_assignments.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stacklet_role_assignments Data Source - terraform-provider-stacklet"
4+
subcategory: ""
5+
description: |-
6+
Retrieve role assignments for a specific target. This data source allows you to query which principals (users or SSO groups) have been granted roles on a particular target (system, account group, policy collection, or repository).
7+
---
8+
9+
# stacklet_role_assignments (Data Source)
10+
11+
Retrieve role assignments for a specific target. This data source allows you to query which principals (users or SSO groups) have been granted roles on a particular target (system, account group, policy collection, or repository).
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Query all system-level role assignments
17+
data "stacklet_role_assignments" "system_access" {
18+
target = "system:all"
19+
}
20+
21+
# Query role assignments for a specific account group
22+
data "stacklet_role_assignments" "production_acl" {
23+
target = "account-group:00000000-0000-0000-0000-000000000001"
24+
}
25+
26+
# Query role assignments for a policy collection
27+
data "stacklet_role_assignments" "security_policies_access" {
28+
target = "policy-collection:00000000-0000-0000-0000-000000000002"
29+
}
30+
31+
# Query role assignments for a repository
32+
data "stacklet_role_assignments" "repo_access" {
33+
target = "repository:00000000-0000-0000-0000-000000000003"
34+
}
35+
36+
# Output all system administrators
37+
output "system_admins" {
38+
description = "All principals with system-level access"
39+
value = [
40+
for assignment in data.stacklet_role_assignments.system_access.assignments :
41+
{
42+
role = assignment.role_name
43+
principal = assignment.principal
44+
}
45+
]
46+
}
47+
48+
# Output production account group access control list
49+
output "production_access_summary" {
50+
description = "Summary of who has access to the production account group"
51+
value = {
52+
total_assignments = length(data.stacklet_role_assignments.production_acl.assignments)
53+
assignments = data.stacklet_role_assignments.production_acl.assignments
54+
}
55+
}
56+
57+
# Check if specific user has access
58+
locals {
59+
user_id_to_check = 123
60+
61+
user_has_production_access = anytrue([
62+
for assignment in data.stacklet_role_assignments.production_acl.assignments :
63+
assignment.principal.type == "user" && assignment.principal.id == local.user_id_to_check
64+
])
65+
}
66+
67+
output "user_has_access" {
68+
description = "Whether user 123 has any role on the production account group"
69+
value = local.user_has_production_access
70+
}
71+
```
72+
73+
<!-- schema generated by tfplugindocs -->
74+
## Schema
75+
76+
### Required
77+
78+
- `target` (String) An opaque target identifier to query role assignments for. Use the 'role_assignment_target' attribute from resource outputs.
79+
80+
### Read-Only
81+
82+
- `assignments` (Attributes List) The list of role assignments for the target. (see [below for nested schema](#nestedatt--assignments))
83+
84+
<a id="nestedatt--assignments"></a>
85+
### Nested Schema for `assignments`
86+
87+
Read-Only:
88+
89+
- `id` (String) The unique identifier of the role assignment.
90+
- `principal` (String) An opaque principal identifier.
91+
- `role_name` (String) The name of the role assigned.
92+
- `target` (String) An opaque target identifier.

‎docs/resources/account_group.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ resource "stacklet_account_group" "development" {
4646
### Read-Only
4747

4848
- `id` (String) The GraphQL Node ID of the account group.
49+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.
4950
- `uuid` (String) The UUID of the account group.
5051

5152
## Import

‎docs/resources/binding.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,14 @@ resource "stacklet_binding" "example" {
8282
- `policy_resource_limit` (Block List) Per-policy overrides for resource limits for binding execution. Map keys are policy unqualified names. (see [below for nested schema](#nestedblock--policy_resource_limit))
8383
- `resource_limits` (Attributes) Default resource limits for binding execution. (see [below for nested schema](#nestedatt--resource_limits))
8484
- `schedule` (String) The schedule for the binding (e.g., 'rate(1 hour)', 'rate(2 hours)', or cron expression).
85-
- `security_context` (String) The binding execution security context.
8685
- `security_context_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) The input value for the security context for the execution configuration.
8786
- `security_context_wo_version` (String) The version for the security context. Must be changed to update security_context_wo.
8887
- `variables` (String) JSON-encoded dictionary of values used for policy templating.
8988

9089
### Read-Only
9190

9291
- `id` (String) The GraphQL Node ID of the binding.
92+
- `security_context` (String) The binding execution security context.
9393
- `system` (Boolean) Whether the binding is a system one. Always false for resources.
9494
- `uuid` (String) The UUID of the binding.
9595

‎docs/resources/policy_collection.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ resource "stacklet_policy_collection" "policies" {
5555

5656
- `dynamic` (Boolean) Whether this is a dynamic policy collection.
5757
- `id` (String) The GraphQL Node ID of the policy collection.
58+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.
5859
- `system` (Boolean) Whether this is a system policy collection.
5960
- `uuid` (String) The UUID of the policy collection.
6061

‎docs/resources/repository.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ resource "stacklet_repository" "example_codecommit" {
8080
- `has_ssh_passphrase` (Boolean) Whether ssh_passphrase_wo has a value set.
8181
- `has_ssh_private_key` (Boolean) Whether ssh_private_key_wo has a value set.
8282
- `id` (String) The GraphQL node ID.
83+
- `role_assignment_target` (String) An opaque identifier for role assignments. Use this value when assigning roles to this resource.
8384
- `ssh_public_key` (String) The public key associated with the value set via ssh_private_key_wo.
8485
- `system` (Boolean) System repositories cannot be changed.
8586
- `uuid` (String) The UUID of the repository.

‎examples/data-sources/stacklet_role/data-source.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Fetch the "owner" system role
2+
data "stacklet_role" "owner" {
3+
name = "owner"
4+
}
5+
6+
# Fetch the "viewer" system role
7+
data "stacklet_role" "viewer" {
8+
name = "viewer"
9+
}
10+
11+
# Fetch the "editor" system role
12+
data "stacklet_role" "editor" {
13+
name = "editor"
14+
}
15+
16+
# Fetch the "admin" system role
17+
data "stacklet_role" "admin" {
18+
name = "admin"
19+
}
20+
21+
# Output the permissions for the owner role
22+
output "owner_permissions" {
23+
value = data.stacklet_role.owner.permissions
24+
}

0 commit comments

Comments
 (0)