iam-identity should not let you create a policy with Resource Group

[lionelmace]

The Terraform provider version 1.56.2 lets you create an iam-identity IAM policy with a Resource Group.

resource "ibm_iam_access_group_policy" "policy-k8s-identity-administrator" {
  access_group_id = ibm_iam_access_group.accgrp.id
  roles           = ["Administrator", "User API key creator", "Service ID creator"]

  resources {
    service           = "iam-identity"
    resource_group_id = ibm_resource_group.group.id
  }
}

Yet this is not supported

ic iam api-key-create TEST
Creating API key TEST under 0b5a00334eaf9eb9339d2ab48f7326b4 as [email protected]...
FAILED
Following errors returned from server:
Code        Message                                   Details
forbidden   You are not authorized to use this API.   Reason: Access check for action 'iam-identity.user-apikey.create' for subject 'IBMid-270002R30A' for resource 'a/0b5a00334eaf9eb9339d2ab48f7326b4' was denied due to lack of access policy. Outbound transaction id 'ZjYybjk-9324ee9940374abba62a0b61ad9a3159-003'.

The provider should not let you create a policy with a Resource Group so your force to create a correct policy. Something like this

resource "ibm_iam_access_group_policy" "policy-k8s-identity-administrator" {
  access_group_id = ibm_iam_access_group.accgrp.id
  roles           = ["Administrator", "User API key creator", "Service ID creator"]

  resources {
    service           = "iam-identity"
  }
}

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

Affected Resource(s)

• ibm_XXXXX

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please share a link to the ZIP file.

Debug Output

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[lionelmace]

It turns out latest V2 version of policy we have support for conditions (shown in the UI).
If policy doesn’t contain rule or pattern it will treat as V1Policy

[lionelmace]

Closed too fast. This V1 policy is not related to this issue.