[datadog_service_account] Role-assignment improvements for service accounts

datadog/fwprovider/data_source_datadog_service_account.go

@@ -33,7 +33,7 @@ type datadogServiceAccountDatasourceModel struct {
 	Status   types.String `tfsdk:"status"`
 	Title    types.String `tfsdk:"title"`
 	Verified types.Bool   `tfsdk:"verified"`
-	Roles    types.List   `tfsdk:"roles"`
+	Roles    types.Set    `tfsdk:"roles"`
 }
 
 type datadogServiceAccountDatasource struct {
@@ -102,7 +102,7 @@ func (d *datadogServiceAccountDatasource) Schema(_ context.Context, _ datasource
 				Computed:    true,
 				Description: "Whether the user is verified.",
 			},
-			"roles": schema.ListAttribute{
+			"roles": schema.SetAttribute{
 				Computed:    true,
 				Description: "Roles assigned to this service account.",
 				ElementType: types.StringType,
@@ -202,5 +202,5 @@ func (r *datadogServiceAccountDatasource) updateState(ctx context.Context, state
 			}
 		}
 	}
-	state.Roles, _ = types.ListValueFrom(ctx, types.StringType, roles)
+	state.Roles, _ = types.SetValueFrom(ctx, types.StringType, roles)
 }

datadog/fwprovider/resource_datadog_service_account.go

@@ -72,6 +72,7 @@ func (r *serviceAccountResource) Schema(_ context.Context, _ resource.SchemaRequ
 			"roles": schema.SetAttribute{
 				Description: "A list a role IDs to assign to the service account.",
 				Optional:    true,
+				Computed:    true,
 				ElementType: types.StringType,
 			},
 			"id": utils.ResourceIDAttribute(),
@@ -298,7 +299,9 @@ func buildDatadogServiceAccountV2Request(ctx context.Context, state *serviceAcco
 	serviceAccountCreate.SetAttributes(*serviceAccountAttributes)
 
 	var roles []string
-	diags.Append(state.Roles.ElementsAs(ctx, &roles, false)...)
+	if !state.Roles.IsUnknown() {
+		diags.Append(state.Roles.ElementsAs(ctx, &roles, false)...)
+	}
 	rolesData := make([]datadogV2.RelationshipToRoleData, len(roles))
 	for i, role := range roles {
 		roleData := datadogV2.NewRelationshipToRoleData()
@@ -347,6 +350,16 @@ func (r *serviceAccountResource) updateRolesFw(ctx context.Context, userID strin
 	rolesToRemove := utils.StringSliceDifference(oldRolesSlice, newRolesSlice)
 	rolesToAdd := utils.StringSliceDifference(newRolesSlice, oldRolesSlice)
 
+	for _, role := range rolesToAdd {
+		roleRelation := datadogV2.NewRelationshipToUserWithDefaults()
+		roleRelationData := datadogV2.NewRelationshipToUserDataWithDefaults()
+		roleRelationData.SetId(userID)
+		roleRelation.SetData(*roleRelationData)
+		_, _, err := r.RolesApiV2.AddUserToRole(r.Auth, role, *roleRelation)
+		if err != nil {
+			return diag.NewErrorDiagnostic("error adding user to role: ", err.Error())
+		}
+	}
 	for _, role := range rolesToRemove {
 		userRelation := datadogV2.NewRelationshipToUserWithDefaults()
 		userRelationData := datadogV2.NewRelationshipToUserDataWithDefaults()
@@ -358,15 +371,6 @@ func (r *serviceAccountResource) updateRolesFw(ctx context.Context, userID strin
 			return diag.NewErrorDiagnostic("error removing user from role: ", err.Error())
 		}
 	}
-	for _, role := range rolesToAdd {
-		roleRelation := datadogV2.NewRelationshipToUserWithDefaults()
-		roleRelationData := datadogV2.NewRelationshipToUserDataWithDefaults()
-		roleRelationData.SetId(userID)
-		roleRelation.SetData(*roleRelationData)
-		_, _, err := r.RolesApiV2.AddUserToRole(r.Auth, role, *roleRelation)
-		if err != nil {
-			return diag.NewErrorDiagnostic("error adding user to role: ", err.Error())
-		}
-	}
+
 	return nil
 }

datadog/fwprovider/resource_datadog_user_role.go

@@ -48,7 +48,7 @@ func (r *userRoleResource) Metadata(_ context.Context, request resource.Metadata
 
 func (r *userRoleResource) Schema(_ context.Context, _ resource.SchemaRequest, response *resource.SchemaResponse) {
 	response.Schema = schema.Schema{
-		Description: "Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the `datadog_user` resource's `roles` attribute. This resource is in beta and is subject to change.",
+		Description: "Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the `datadog_user` resource's `roles` attribute or the `datadog_service_account` resource's `roles` attribute. This resource is in beta and is subject to change.",
 		Attributes: map[string]schema.Attribute{
 			"id": utils.ResourceIDAttribute(),
 			"role_id": schema.StringAttribute{

docs/data-sources/service_account.md

@@ -28,7 +28,7 @@ Use this data source to retrieve information about an existing Datadog service a
 - `handle` (String) Handle of the user.
 - `icon` (String) URL of the user's icon.
 - `name` (String) Name of the user.
-- `roles` (List of String) Roles assigned to this service account.
+- `roles` (Set of String) Roles assigned to this service account.
 - `status` (String) Status of the user.
 - `title` (String) Title of the user.
 - `verified` (Boolean) Whether the user is verified.

docs/resources/user_role.md

@@ -3,12 +3,12 @@
 page_title: "datadog_user_role Resource - terraform-provider-datadog"
 subcategory: ""
 description: |-
-  Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the datadog_user resource's roles attribute. This resource is in beta and is subject to change.
+  Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the datadog_user resource's roles attribute or the datadog_service_account resource's roles attribute. This resource is in beta and is subject to change.
 ---
 
 # datadog_user_role (Resource)
 
-Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the `datadog_user` resource's `roles` attribute. This resource is in beta and is subject to change.
+Provides a Datadog UserRole resource. This can be used to create and manage Datadog User Roles. Conflicts may occur if used together with the `datadog_user` resource's `roles` attribute or the `datadog_service_account` resource's `roles` attribute. This resource is in beta and is subject to change.
 
 ## Example Usage