Using ad group in access role make modification each run

[erezo9]

when using Active directory on checkpoint_management_access_role

i have entered the source = "myadserver"
selection = [mygroup]

it creates and publishes succefully

if i run terraform apply again, it tries to modify it because the api returns
cmpApi instead of my source
and in the group it returns the ad_group_mygroup

and it tries to modify/ recrate the resource

also - if no machines are selected and any are configured, it tries to readd them as any ( don know if thats expected)

[chkp-tomerassa]

Hi @erezo9,

This happens due to API limitations, as documented in the provider docs:
https://registry.terraform.io/providers/CheckPointSW/checkpoint/latest/docs/resources/checkpoint_management_access_role#source-2

You can also have further read about this bug here:
#93

Regarding you last question, can you please provide an example configuration?

Regards,
Tomer

[erezo9]

@chkp-tomerassa
So how should my role resource should look like?
Is it ok that it shows that it changes the values from my source to cmpapi?

Try create a role without any machines, and. On every run it wants to delete the machines because how the pair return the value

[chkp-tomerassa]

@erezo9
We have a bug in this resource which couldn't be resolved due to a limitation of the API response.
If you want to use this resource, you'll have to use the source group as any or a group named CpmiAdGroup only. Other group names won't work.

Regarding the machines, this is the expected behavior. We update the state of each field regarding of the response we get from the API response. If you want to avoid this deletion, you'll need to use the default value that returns from the API response in the resource itself

[erezo9]

@chkp-tomerassa
In other providers they just ignore default values (even if they return from api) or require to put a value if this is required
regarding the role api
so i put cpmiadgroup
and the group name is fixed in R82 ?

I checked with CpmiAdgroup
it says
Invalid paramet for [source]. the invalid value [CpmiAdGroup] should be replcaed by one of the following values: [Internval USer Groups,Ldap Groups, Guests, Identity Tag,my_domain name]

[chkp-tomerassa]

In our provider we do update every field that return in the response. You can check it in the tips & best practices in out documentation:
https://registry.terraform.io/providers/CheckPointSW/checkpoint/latest/docs#tips--best-practices

The bug that was fixed in R82 regarding this api probably doesn't related to this field. The limitation still exists here in this field.
We support only CpmiAdgroup active directory name, and you'll probably need to create it on your machine first

[erezo9]

@chkp-tomerassa so how do you deal with multiple active directories?
and how i fix the issue with the ? or is that for the r82
ad_group_(mygroup)

[chkp-tomerassa]

Due to the API limitation, we currently support only one Active Directory for this resource in our provider, which also enforces a prefix on group names.

[erezo9]

@chkp-tomerassa
Can you please provide an example on how the resource should look like? With the ad group?

[chkp-tomerassa]

resource "checkpoint_management_access_role" "example" {
  name = "New Access Role 1"
  machines {
    source = "any"
    selection = ["any"]
  }
  users {
    source = CpmiAdGroup
    selection = ["AD1", "AD2"]
  }
}

Note that after the resource creation, the group name will be:
ad_group_AD1 and ad_group_AD2

so for you to not see any diff, you'll need to add after the first run the ad_group_ prefix for every group in your selection.

[erezo9]

Well that kind of inconviente when using auotmation + git
I think ill just add an ignore lifecycle for the selection and source and terraform will just ignore it