Add support for roles in google_sql_user

[enocom]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The SqlServerUserDetails in the SQL Admin API supports specifying serverRoles that will be attached to a user on creation. This is a request to expose that functionality in the google_sql_user resource.

New or Affected Resource(s)

• google_sql_user

Potential Terraform Configuration

resource "google_sql_user" "users" {
  name     = "me@example.com"
  instance = google_sql_database_instance.master.name
  type     = "CLOUD_IAM_USER"
  roles     = [ "read", "write", "admin" ] # or whatever roles a user might have in a database
}

References

• https://issuetracker.google.com/issues/195676939

b/314111627

[arnisoph]

Is there some documentation for serverRoles? Is this even PostgreSQL-specific? I haven't found it in the API docs nor in the gcloud CLI docs.

[enocom]

@arnisoph The best I've found is under the SqlServerUserDetails, which in spite of the name, does seem to apply to all three engines. Other than that, a person would probably have to experiment with the API to be certain.

[Illidanek]

Yes please! This seems to be a basic feature that the provider should have.
Without this we are forced to set permissions via magic scripts 🤮

[villesau]

@enocom @rileykarson what about postgres & mysql?

[enocom]

It seems I'm wrong: this applies to just SQL Server :-/

[villesau]

I think there's fairly sizeable amount of postres & mysql databases managed by Google too. When could we expect the same feature to land in those as well? This is a feature that prevents the system from being fully managed by Terraform.

[enocom]

I agree this would be a useful addition to the Cloud SQL Admin API so we could support all engines.

Since this isn't a Google provider limitation, let's track this work here: https://issuetracker.google.com/issues/195676939. Meanwhile, I'll bring this to the team that handles the Admin API.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

[melinath]

Reopening this ticket. It is not actually resolved for any sql database types, even sql server. Per GoogleCloudPlatform/magic-modules#6165 (review) SqlServerUserDetails is actually read-only.

[roaks3]

Marking as a feature request because the only mention of this being available through other surfaces is the SqlServerUserDetails, which as mentioned above is read-only. If this can already be done through the API, someone please correct me and we can change this to a coverage gap.