access_package_resource_package_association: allow eligible group assignments and AppRoles

[philband]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR add support for managing

• Eligible Member
• Eligible Owner
• AppRole Assignments

using the access_package_resource_package_association resource.

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevant documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• access_package_resource_package_association - support for eligible group member/owner assignments, support for AppRoles [access_package_resource_package_association: allow eligible group assignments and AppRoles #1853]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #1776

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

[hcoberdalhoff]

LGTM

[nb2708]

This would be really useful is there an ETA for when this will be merged

[sebbbbbby]

Any ETA on when this will be merged?

[nalberti]

Waiting patiently for this to be merged 👍

[james-seddon-paymentsense]

If it helps anyone, this is how we currently work around this missing functionality:

resource "terracurl_request" "role_association" {
  for_each = local.ap_groups

  name   = "role_association-${each.key}"
  method = "POST"
  url    = "https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/${azuread_access_package.packages[each.key].id}/accessPackageResourceRoleScopes"
  headers = {
    Authorization = "Bearer ${var.graph_access_token}"
    Content-Type  = "application/json"
  }
  request_body = jsonencode({
    accessPackageResourceRole = {
      id           = "00000000-0000-0000-0000-000000000000"
      originId     = "EligibleMember_${azuread_group.managed_groups[each.key].object_id}"
      displayName  = "Eligible Member"
      originSystem = "AadGroup"
      accessPackageResource = {
        id           = one(jsondecode(data.http.access_package_resource_scopes[each.key].response_body).value).id
        resourceType = "Security Group"
        originId     = azuread_group.managed_groups[each.key].object_id
        originSystem = "AadGroup"
        displayName  = azuread_group.managed_groups[each.key].display_name
      }
    }
    accessPackageResourceScope = {
      id           = one(one(jsondecode(data.http.access_package_resource_scopes[each.key].response_body).value).accessPackageResourceScopes).id
      originId     = azuread_group.managed_groups[each.key].object_id
      originSystem = "AadGroup"
      displayName  = "Root"
      description  = "Root Scope"
      isRootScope  = true
    }
  })

  response_codes = [201]

  # We don't need to destroy accessPackageResourceRoleScopes, it gets removed when the Access Package is destroyed.
  skip_destroy   = true
  destroy_url    = "https://graph.microsoft.com/beta/" # Placeholder to stop TF Plan destroying because this is undefined
  destroy_method = "GET"

  depends_on = [time_sleep.wait_for_catalog_association]

  lifecycle {
    postcondition {
      condition     = can(jsondecode(self.response).id)
      error_message = "Failed to create role association or response was invalid. Response: ${self.response}"
    }
  }
}

[alexiscarbillet]

Any updates?