Allow bypassing ACL validation for groups

[amaccuish]

Is your feature request related to a problem? Please describe.
We create our IdP groups via Terraform. If we reference a group in our ACL that is due to be created in the same PR, the provider will error with "ACL validation failed: group not found".

Describe the solution you'd like
Either the provider should recognise that the group will be created (we enforce the dependency) or provide the option to disable group validation.

[mcoulombe]

Hey @amaccuish , typically in Terraform if resource A depends on resource B, but the relation is not clear to Terraform because resource B does not reference attributes from resource A, the solution is to enforce the relation with meta-arguments like depends_on.

Is this what you mean by (we enforce the dependency)? If not, can you give that depends_on solution a try?

Disabling group validation is dangerous, and resolving dependencies correctly should be left to the Terraform engine and mechanisms, not with custom logic in individual providers. So we will not support bypassing ACL validation for groups.

Let us know if depends_on does not work or if you'd need help to make your deployments work properly.

[amaccuish]

Hi @mcoulombe, thank you for your reply.

What I mean is, even if we make the dependency explicit, such that the group is created before the ACL is updated, it doesn't matter since we never get that far, because we are blocked at the plan stage with

│ Error: ACL validation failed: group not found: "group:xxx xxx xxx xxx"; []
│
│ with module.network.module.tailscale[0].tailscale_acl.hujson,
│ on ../../../network/tailscale/policy.tf line 53, in resource "tailscale_acl" "hujson":
│ 53: resource "tailscale_acl" "hujson" {
│

[mcoulombe]

Thanks for that additional context. I agree plans should not fail in these conditions. I'll bring this up to the team and experiment a bit with that scenario to better understand what would be an appropriate solution.

If you can create and post the smallest example that fails, that'd be helpful to ensure we are talking about exactly the same problem.

[amaccuish]

Thank you! And something like this should show it. Would make sense for sure to fully validate during apply, but only check syntax during plan.

resource "okta_group" "test" {
  name = "Test Group"
}

resource "tailscale_acl" "policy" {
  depends_on = [okta_group.test]

  hujson = <<HUJSON
{
  "acls": [
    {
      "action": "accept",
      "src": ["group:test group@domain.com"],
      "dst": ["*:*"]
    }
  ]
}
HUJSON
}