Datadog user role not working as designed about terraform-provider-datadog

[nyanshak]

I believe you're actually looking for 'access_role' field (that's what it's called in the Datadog api), but it's unfortunately not yet supported by this provider. Issue #4 is an open feature request to add the behavior you're looking for.

The current 'role' field refers to something different, something akin to "title" (such as "SRE" or "Lead Developer"). Unfortunately, there is a bug with this field referenced here #12, where it's impossible to actually set that role field after creation.

[s4mur4i]

Then there is the second behavior which is strange, why is the read-only user converted back to standard user?
Could it be that: https://docs.datadoghq.com/api/#user-update
if no access_role is defined it reverts back to standard user? which would sound strange to me.

[nyanshak]

As far as I can tell, with 0.10.7 terraform, 1.0.0 datadog provider, the provider never specifically sets access_role. The go-datadog-api user struct doesn't even have an access_role field.

Since we're not specifically sending access_role, this should be the equivalent of doing:

user="[email protected]"

curl -X PUT -H "Content-type: application/json" \                               
     -d "{\"email\": \"${user}\", \"name\": \"alt user\"}" \
    "https://app.datadoghq.com/api/v1/user/${user}?api_key=${api_key}&application_key=${app_key}"

I've tested this (on a read-only user), and I still get back a read-only user. I've also tested sending both of these:

"access_role":  "", # empty string
"access_role": null, # explicitly send null

Sending either of those did not result in the role being changed back to 'st' for standard.

[crivetechie]

as of go-datadog-api v2.8 the user struct supports the access_role field and the is_admin field has been marked as deprecated. any chance to leverage on this to add feature #4 ?

[masci]

The role argument is confusing to say the least, I'm going to close this issue as the provider behaviour is (unfortunately) correct in terms of API calls. Going to schedule work to deprecate role (was removed from datadog docs too) and is_admin in favor of the solutions proposed in #4.