[datadog_user_role] Creating a new datadog_user_role resource

[wangwillson1]

As part of ACCESS-2220, we want to create a datadog_user_role resource for user-role assignments via Terraform. These assignments should not overwrite existing ones that aren't managed by Terraform.

[srosenthal-dd]

Tested locally and it worked well!

I am trying to see how this and #2340 interact, doing some more local testing, will comment on the other PR.

[wangwillson1]

I am trying to see how this and #2340 interact, doing some more local testing, will comment on the other PR.

i wonder if i made those changes obsolete... assuming we don't use datadog_user and datadog_user_role together, it seems that the Computed: true attribute make it so that when the roles attribute is omitted, no changes take effect now (which is what we want!)

fwiw this was my test

data "datadog_role" "foo" {
  filter = "Datadog Standard Role"
}

resource "datadog_user" "a" {
	email = "[email protected]"
        roles = [data.datadog_role.foo.id]
}

resource "datadog_user" "b" {
	email = "[email protected]"
        roles = []
}

resource "datadog_user" "c" {
	email = "[email protected]"
}

resource "datadog_user_role" "c" {
	role_id = data.datadog_role.foo.id
	user_id = datadog_user.c.id
}

i could freely assign roles to user c (and it would get supplemented with the standard role), but the others had the datadog_user roles as the source of truth

EDIT: just saw your comment on importing

[srosenthal-dd]

I retested with your latest code, this time not including #2340.

I noted that:

1. ✅ Importing an existing datadog_user works and doesn't change the roles
2. ✅ The new datadog_user_role worked well for creations/deletions/imports
3. ✅ Changing datadog_user to have unset roles always leaves it alone, but setting to empty list removes all roles
4. ⚠️ One edge case I found, not caused by this PR: if you entirely replace the list of roles for a datadog_user, it'll first remove, then add, leaving a brief period where the user has no roles. If the user is the one whose key you are using for Terraform, you get locked out. Proposed fix for that is [datadog_user] Re-order role updates #2346.
5. ℹ️ I probably missed some discussion, but I'm curious about the decision to make datadog_role_users data source instead of a more direct data datadog_user_role. I tried using it and it worked OK but I wasn't sure what users would do with it.