[datadog_service_account] Role-assignment improvements for service accounts

[retsguj]

https://datadoghq.atlassian.net/browse/ACCESS-2568

datadog_user_role already allows for roles to be assigned to service accounts, luckily.

[retsguj]

Am having a hard time figuring out what I broke in the tests...

[srosenthal-dd]

✅ I tested locally the scenarios that I cared about:

Assigning and unassigning a role to a service account with datadog_user_role:

resource "datadog_user_role" "dur1" {
  role_id = data.datadog_role.admin.id
  user_id = data.datadog_user.svc_acct_2.id
}

Updating the roles on a service account with datadog_service_account:

resource datadog_service_account svc_acct_2 {
  email = "[email protected]"
  name  = "Stephen TF test 2"
  roles = [data.datadog_role.admin.id] # or [data.datadog_role.admin2.id]
}

... and ensuring that additions happen before removals, and the roles can be omitted and set via datadog_user_role instead.

One suggestion: can you update the docs that talk about "Conflicts may occur if used together with" to refer to both datadog_user and datadog_service_account? It looks like the source for that is

terraform-provider-datadog/datadog/fwprovider/resource_datadog_user_role.go

Line 51 in 835587c

Description: "Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the `datadog_user` resource's `roles` attribute. This resource is in beta and is subject to change.",

but it's also in a (generated?) Markdown file

[srosenthal-dd]

(I'm also not sure about the test failures at a glance, looks like you'll have to read them in more detail)

[wangwillson1]

code looks good to me, and basic functionality works too (assigning roles to service accounts without overwriting, creating new service accounts with/without roles)

i wasn't able to get the exact_match attribute working on my machine for reasons unknown, so i would appreciate if someone else could test for me 😄 maybe some unit tests for this attribute could be helpful

[srosenthal-dd]

✅ Re-tested locally today with the latest code and it worked well for me. Good to ship as far as I'm concerned.