Skip to content

INTMDB-448: custom_db_role error #1009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jan 19, 2023
Merged

INTMDB-448: custom_db_role error #1009

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bc75c9c
example fix
Zuhairahmed Jan 3, 2023
875c58c
log to file add
Zuhairahmed Jan 3, 2023
0ef145d
formating
Zuhairahmed Jan 3, 2023
ac8cc4f
formatting updates
Zuhairahmed Jan 3, 2023
65bcffc
Add mutex to prevent concurrent API calls datasource simplify count a…
martinstibbe Jan 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,8 @@ export TF_CLI_CONFIG_FILE=/mnt/c/Users/ZuhairAhmed/Desktop/Tenant_Upgrade/tf_cac
#### Logs
To help with dubbing issues, you can turn on Logs with `export TF_LOG=TRACE`. Note: this is very noisy.

To export logs to file, you can use `export TF_LOG_PATH=terraform.log`

### Running the acceptance test

#### Programmatic API key
Expand Down
2 changes: 1 addition & 1 deletion mongodbatlas/data_source_mongodbatlas_custom_db_roles_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ func TestAccConfigDSCustomDBRoles_basic(t *testing.T) {

// Test for Data source
resource.TestCheckResourceAttrSet(dataSourceName, "project_id"),
resource.TestCheckResourceAttr(dataSourceName, "results.#", "1"),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[q] Why did we pass "1" here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I fixed concurrency issue other acceptance tests in parallel would increase count > 1 and fail test

resource.TestCheckResourceAttrSet(dataSourceName, "results.#"),
),
},
},
Expand Down
9 changes: 9 additions & 0 deletions mongodbatlas/resource_mongodbatlas_custom_db_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"net/http"
"regexp"
"strings"
"sync"
"time"

"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
Expand Down Expand Up @@ -101,7 +102,13 @@ func resourceMongoDBAtlasCustomDBRole() *schema.Resource {
}
}

var (
customRoleLock sync.Mutex
)

func resourceMongoDBAtlasCustomDBRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
customRoleLock.Lock()
defer customRoleLock.Unlock()
Comment on lines +110 to +111
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[q] Could you give me more details about why we hit this issue? Thanks

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Atlas API if you run each terraform resource apply sequentially in slow motion i.e. debugger it updates state correctly
If you run all in parallel API does not come back with consistent values Zuhair's example test 3 separate roles that fail if run all together

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andreaangiolillo brief example here: https://drive.google.com/file/d/1aDfPwxjXm35qkEQgP135M6FxZAss5Qlv/view
also in body of jira ticket as well if you need: https://jira.mongodb.org/browse/INTMDB-448

conn := meta.(*MongoDBClient).Atlas
projectID := d.Get("project_id").(string)

Expand Down Expand Up @@ -180,6 +187,8 @@ func resourceMongoDBAtlasCustomDBRoleRead(ctx context.Context, d *schema.Resourc
}

func resourceMongoDBAtlasCustomDBRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
customRoleLock.Lock()
defer customRoleLock.Unlock()
conn := meta.(*MongoDBClient).Atlas
ids := decodeStateID(d.Id())
projectID := ids["project_id"]
Expand Down
1 change: 0 additions & 1 deletion mongodbatlas/resource_mongodbatlas_custom_db_role_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -412,7 +412,6 @@ func TestAccConfigRSCustomDBRoles_MultipleCustomRoles(t *testing.T) {
}

func TestAccConfigRSCustomDBRoles_MultipleResources(t *testing.T) {
t.Skip() // The error seems appear to be similar to whitelist behavior, skip it temporally
var (
resourceName = "mongodbatlas_custom_db_role.test"
projectID = os.Getenv("MONGODB_ATLAS_PROJECT_ID")
Expand Down
6 changes: 4 additions & 2 deletions website/docs/index.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ In order to enable the Terraform MongoDB Atlas Provider with AWS SM, please foll
"private_key":"secret2"
}
```
2. Create an AWS IAM Role to attach to the AWS STS (Security Token Service) generated short lived API keys. This is required since STS generated API Keys by default have restricted permissions and need to have their permissions elevated in order to authenticate with Terraform. Take note of Role ARN and ensure IAM Role has permission for “sts:AssumeRole” . For example:
2. Create an AWS IAM Role to attach to the AWS STS (Security Token Service) generated short lived API keys. This is required since STS generated API Keys by default have restricted permissions and need to have their permissions elevated in order to authenticate with Terraform. Take note of Role ARN and ensure IAM Role has permission for “sts:AssumeRole”. For example:
```
{
"Version": "2012-10-17",
Expand All @@ -102,8 +102,10 @@ In order to enable the Terraform MongoDB Atlas Provider with AWS SM, please foll
"Action": "sts:AssumeRole"
}
]
}
}
```
In addition, you are required to also attach the AWS Managed policy of `SecretsManagerReadWrite` to this IAM role.

Note: this policy may be overly broad for many use cases, feel free to adjust accordingly to your organization's needs.

3. In terminal, store as environmental variables AWS API Keys (while you can also hardcode in config files these will then be stored as plain text in .tfstate file and should be avoided if possible). For example:
Expand Down