Remove requirement to provide accountId in mws_credentials resource (#3028)

Author: hectorcast-db

common/client.go

@@ -67,6 +67,20 @@ func (c *DatabricksClient) WorkspaceClient() (*databricks.WorkspaceClient, error
 	return w, nil
 }
 
+func (c *DatabricksClient) SetAccountId(accountId string) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if accountId == "" {
+		return nil
+	}
+	oldAccountID := c.DatabricksClient.Config.AccountID
+	if oldAccountID != "" && oldAccountID != accountId {
+		return fmt.Errorf("account ID is already set to %s", oldAccountID)
+	}
+	c.DatabricksClient.Config.AccountID = accountId
+	return nil
+}
+
 func (c *DatabricksClient) AccountClient() (*databricks.AccountClient, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()

mws/resource_mws_credentials.go

@@ -49,6 +49,10 @@ func ResourceMwsCredentials() *schema.Resource {
 	p := common.NewPairSeparatedID("account_id", "credentials_id", "/")
 	return common.Resource{
 		Create: func(ctx context.Context, d *schema.ResourceData, c *common.DatabricksClient) error {
+			err := c.SetAccountId(d.Get("account_id").(string))
+			if err != nil {
+				return err
+			}
 			acc, err := c.AccountClient()
 			if err != nil {
 				return err
@@ -105,6 +109,10 @@ func ResourceMwsCredentials() *schema.Resource {
 			}
 			return acc.Credentials.DeleteByCredentialsId(ctx, credsId)
 		},
-		Schema: common.StructToSchema(CredentialInfo{}, common.NoCustomize),
+		Schema: common.StructToSchema(CredentialInfo{}, func(s map[string]*schema.Schema) map[string]*schema.Schema {
+			// nolint
+			s["account_id"].Deprecated = "`account_id` should be set as part of the Databricks Config, not in the resource."
+			return s
+		}),
 	}.ToResource()
 }

mws/resource_mws_credentials_test.go

@@ -56,6 +56,109 @@ func TestResourceCredentialsCreate(t *testing.T) {
 	})
 }
 
+func TestAccountIdOnlyInState(t *testing.T) {
+	qa.ResourceFixture{
+		Fixtures: []qa.HTTPFixture{
+			{
+				Method:   "POST",
+				Resource: "/api/2.0/accounts/abc/credentials",
+				ExpectedRequest: Credentials{
+					CredentialsName: "Cross-account ARN",
+					AwsCredentials: &AwsCredentials{
+						StsRole: &StsRole{
+							RoleArn: "arn:aws:iam::098765:role/cross-account",
+						},
+					},
+				},
+				Response: Credentials{
+					CredentialsID: "cid",
+				},
+			},
+			{
+				Method:   "GET",
+				Resource: "/api/2.0/accounts/abc/credentials/cid?",
+				Response: Credentials{
+					CredentialsID:   "cid",
+					CredentialsName: "Cross-account ARN",
+					AwsCredentials: &AwsCredentials{
+						StsRole: &StsRole{
+							RoleArn: "arn:aws:iam::098765:role/cross-account",
+						},
+					},
+				},
+			},
+		},
+		Resource: ResourceMwsCredentials(),
+		State: map[string]any{
+			"account_id":       "abc",
+			"credentials_name": "Cross-account ARN",
+			"role_arn":         "arn:aws:iam::098765:role/cross-account",
+		},
+		Create: true,
+	}.ApplyAndExpectData(t, map[string]any{
+		"id":       "abc/cid",
+		"role_arn": "arn:aws:iam::098765:role/cross-account",
+	})
+}
+
+func TestAccountIdOnlyInConfig(t *testing.T) {
+	qa.ResourceFixture{
+		Fixtures: []qa.HTTPFixture{
+			{
+				Method:   "POST",
+				Resource: "/api/2.0/accounts/abc/credentials",
+				ExpectedRequest: Credentials{
+					CredentialsName: "Cross-account ARN",
+					AwsCredentials: &AwsCredentials{
+						StsRole: &StsRole{
+							RoleArn: "arn:aws:iam::098765:role/cross-account",
+						},
+					},
+				},
+				Response: Credentials{
+					CredentialsID: "cid",
+				},
+			},
+			{
+				Method:   "GET",
+				Resource: "/api/2.0/accounts/abc/credentials/cid?",
+				Response: Credentials{
+					CredentialsID:   "cid",
+					CredentialsName: "Cross-account ARN",
+					AwsCredentials: &AwsCredentials{
+						StsRole: &StsRole{
+							RoleArn: "arn:aws:iam::098765:role/cross-account",
+						},
+					},
+				},
+			},
+		},
+		Resource: ResourceMwsCredentials(),
+		State: map[string]any{
+			"credentials_name": "Cross-account ARN",
+			"role_arn":         "arn:aws:iam::098765:role/cross-account",
+		},
+		Create:    true,
+		AccountID: "abc",
+	}.ApplyAndExpectData(t, map[string]any{
+		"id":       "abc/cid",
+		"role_arn": "arn:aws:iam::098765:role/cross-account",
+	})
+}
+
+func TestFailIfDifferentAccountIds(t *testing.T) {
+	qa.ResourceFixture{
+		Resource: ResourceMwsCredentials(),
+		State: map[string]any{
+			"account_id":       "another",
+			"credentials_name": "Cross-account ARN",
+			"role_arn":         "arn:aws:iam::098765:role/cross-account",
+		},
+		Create:    true,
+		AccountID: "abc",
+	}.ExpectError(t, "account ID is already set to abc")
+}
+
 func TestResourceCredentialsCreateWithoutAccId(t *testing.T) {
 	qa.ResourceFixture{
 		Fixtures: []qa.HTTPFixture{