(Not Essential) Fix bug in stringExists operator in subject attributes for IAM policy templates

ibm/service/iampolicy/resource_ibm_iam_authorization_policy.go

@@ -262,7 +262,7 @@ func resourceIBMIAMAuthorizationPolicyCreate(d *schema.ResourceData, meta interf
 				} else if value == "false" {
 					resourceValue = false
 				} else {
-					return fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %s.", value)
+					return fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %v.", value)
 				}
 				at := iampolicymanagementv1.V2PolicySubjectAttribute{
 					Key:      &name,
@@ -365,7 +365,7 @@ func resourceIBMIAMAuthorizationPolicyCreate(d *schema.ResourceData, meta interf
 				} else if value == "false" {
 					resourceValue = false
 				} else {
-					return fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %s", value)
+					return fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %v", value)
 				}
 				at := iampolicymanagementv1.V2PolicyResourceAttribute{
 					Key:      &name,
@@ -592,7 +592,7 @@ func resourceIBMIAMAuthorizationPolicyUpdate(d *schema.ResourceData, meta interf
 					} else if value == "false" {
 						resourceValue = false
 					} else {
-						return fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %s.", value)
+						return fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %v.", value)
 					}
 					at := iampolicymanagementv1.V2PolicySubjectAttribute{
 						Key:      &name,
@@ -695,7 +695,7 @@ func resourceIBMIAMAuthorizationPolicyUpdate(d *schema.ResourceData, meta interf
 					} else if value == "false" {
 						resourceValue = false
 					} else {
-						return fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %s", value)
+						return fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %v", value)
 					}
 					at := iampolicymanagementv1.V2PolicyResourceAttribute{
 						Key:      &name,

ibm/service/iampolicy/resource_ibm_iam_policy_template.go

@@ -357,7 +357,7 @@ func generateTemplatePolicy(d *schema.ResourceData, iamPolicyManagementClient *i
 				} else if attributesItemModel.Value == "false" {
 					attributesItemModel.Value = false
 				} else {
-					return model, fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %s",
+					return model, fmt.Errorf("[ERROR] When operator equals stringExists, value should be either \"true\" or \"false\", instead of %v",
 						attributesItemModel.Value)
 				}
 			}
@@ -395,12 +395,21 @@ func generateTemplatePolicy(d *schema.ResourceData, iamPolicyManagementClient *i
 					sourceServiceName = item.((map[string]interface{}))["value"].(string)
 				}
 				if *attributesItemModel.Operator == "stringExists" {
-					if attributesItemModel.Value == "true" {
+					// Get the string value regardless of whether it's a pointer or not
+					var valueStr string
+					if strPtr, ok := attributesItemModel.Value.(*string); ok {
+						valueStr = *strPtr
+					} else {
+						valueStr = fmt.Sprintf("%v", attributesItemModel.Value)
+					}
+
+					// Now handle the string value
+					if valueStr == "true" {
 						attributesItemModel.Value = true
-					} else if attributesItemModel.Value == "false" {
+					} else if valueStr == "false" {
 						attributesItemModel.Value = false
 					} else {
-						return model, fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %s.", attributesItemModel.Value)
+						return model, fmt.Errorf("[ERROR] Only values \"true\" and \"false\" are allowed when operator is \"stringExists\". Received %v.", valueStr)
 					}
 				}
 				if *model.Type == "authorization" && *attributesItemModel.Operator == "" && attributesItemModel.Value == "*" && *attributesItemModel.Key == "resourceGroupId" {

ibm/service/iampolicy/resource_ibm_iam_policy_template_test.go

@@ -221,6 +221,26 @@ func TestAccIBMIAMPolicyTemplateBasicS2SUpdate(t *testing.T) {
 	})
 }
 
+func TestAccIBMIAMPolicyTemplateSubjectStringExists(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { acc.TestAccPreCheck(t) },
+		Providers:    acc.TestAccProviders,
+		CheckDestroy: testAccCheckIBMPolicyTemplateDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckIBMPolicyS2STemplateSubjectStringExists("TerraformS2SSubjectTest", "is", "is", "true"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckIBMPolicyTemplateExists("ibm_iam_policy_template.policy_template", conf),
+					resource.TestCheckResourceAttr("ibm_iam_policy_template.policy_template", "name", "TerraformS2SSubjectTest"),
+					resource.TestCheckResourceAttr("ibm_iam_policy_template.policy_template", "policy.0.resource.0.attributes.0.value", "is"),
+					resource.TestCheckResourceAttr("ibm_iam_policy_template.policy_template", "policy.0.subject.0.attributes.0.value", "is"),
+					resource.TestCheckResourceAttr("ibm_iam_policy_template.policy_template", "policy.0.subject.0.attributes.1.value", "true"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckIBMPolicyTemplateExists(n string, obj iampolicymanagementv1.PolicyTemplate) resource.TestCheckFunc {
 
 	return func(s *terraform.State) error {
@@ -515,3 +535,36 @@ func testAccCheckIBMPolicyTemplateConfigBasicWithTags(name string, serviceName s
 		}
 	`, name, serviceName, tagValue)
 }
+
+func testAccCheckIBMPolicyS2STemplateSubjectStringExists(name string, resourceServiceName string, subjectServiceName string, vpcIdValue string) string {
+	return fmt.Sprintf(`
+		resource "ibm_iam_policy_template" "policy_template" {
+			name = "%s"
+			policy {
+				type = "authorization"
+				description = "Test terraform enterprise S2S with stringExists in subject"
+				resource {
+					attributes {
+						key = "serviceName"
+						operator = "stringEquals"
+						value = "%s"
+					}
+				}
+				subject {
+					attributes {
+						key = "serviceName"
+						operator = "stringEquals"
+						value = "%s"
+					}
+					attributes {
+						key = "vpcId"
+						operator = "stringExists"
+						value = "%s"
+					}
+				}
+				roles = ["Reader"]
+			}
+			committed=true
+		}
+	`, name, resourceServiceName, subjectServiceName, vpcIdValue)
+}