Add description to kibana role resource

Author: tobio

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 - Add `headers` for the provider connection ([#1057](https://github.com/elastic/terraform-provider-elasticstack/pull/1057))
 - Add custom `endpoint` configuration support for snapshot repository setup ([#1158](https://github.com/elastic/terraform-provider-elasticstack/pull/1158))
+- Add `description` to `elasticstack_kibana_security_role` ([#1172](https://github.com/elastic/terraform-provider-elasticstack/issues/1172))
 
 ## [0.11.15] - 2025-04-23
 

internal/kibana/role.go

@@ -15,7 +15,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
-var minSupportedRemoteIndicesVersion = version.Must(version.NewVersion("8.10.0"))
+var (
+	minSupportedRemoteIndicesVersion = version.Must(version.NewVersion("8.10.0"))
+	minSupportedDescriptionVersion   = version.Must(version.NewVersion("8.15.0"))
+)
 
 func ResourceRole() *schema.Resource {
 	roleSchema := map[string]*schema.Schema{
@@ -232,6 +235,11 @@ func ResourceRole() *schema.Resource {
 			ValidateFunc:     validation.StringIsJSON,
 			DiffSuppressFunc: utils.DiffJsonSuppress,
 		},
+		"description": {
+			Description: "Optional description for the role",
+			Type:        schema.TypeString,
+			Optional:    true,
+		},
 	}
 
 	return &schema.Resource{
@@ -293,6 +301,14 @@ func resourceRoleUpsert(ctx context.Context, d *schema.ResourceData, meta interf
 		}
 	}
 
+	if v, ok := d.GetOk("description"); ok {
+		if serverVersion.LessThan(minSupportedDescriptionVersion) {
+			return diag.FromErr(fmt.Errorf("'description' is supported only for Kibana v%s and above", minSupportedDescriptionVersion.String()))
+		}
+
+		kibanaRole.Description = v.(string)
+	}
+
 	roleManageResponse, err := kibana.KibanaRoleManagement.CreateOrUpdate(&kibanaRole)
 	if err != nil {
 		return diag.FromErr(err)
@@ -334,6 +350,9 @@ func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	if err := d.Set("kibana", flattenKibanaRoleKibanaData(&role.Kibana)); err != nil {
 		return diag.FromErr(err)
 	}
+	if err := d.Set("description", role.Description); err != nil {
+		return diag.FromErr(err)
+	}
 	if role.Metadata != nil {
 		metadata, err := json.Marshal(role.Metadata)
 		if err != nil {

internal/kibana/role_data_source.go

@@ -217,6 +217,11 @@ func DataSourceRole() *schema.Resource {
 			ValidateFunc:     validation.StringIsJSON,
 			DiffSuppressFunc: utils.DiffJsonSuppress,
 		},
+		"description": {
+			Description: "Description for the role",
+			Type:        schema.TypeString,
+			Optional:    true,
+		},
 	}
 
 	return &schema.Resource{

internal/kibana/role_test.go

@@ -19,6 +19,7 @@ func TestAccResourceKibanaSecurityRole(t *testing.T) {
 	roleName := sdkacctest.RandStringFromCharSet(10, sdkacctest.CharSetAlphaNum)
 	roleNameRemoteIndices := sdkacctest.RandStringFromCharSet(10, sdkacctest.CharSetAlphaNum)
 	minSupportedRemoteIndicesVersion := version.Must(version.NewSemver("8.10.0"))
+	minSupportedDescriptionVersion := version.Must(version.NewVersion("8.15.0"))
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(t) },
@@ -48,6 +49,16 @@ func TestAccResourceKibanaSecurityRole(t *testing.T) {
 					utils.TestCheckResourceListAttr("elasticstack_kibana_security_role.test", "kibana.0.spaces", []string{"default"}),
 				),
 			},
+			{
+				SkipFunc: versionutils.CheckIfVersionIsUnsupported(minSupportedDescriptionVersion),
+				Config:   testAccResourceSecurityRoleWithDescription(roleName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("elasticstack_kibana_security_role.test", "name", roleName),
+					resource.TestCheckNoResourceAttr("elasticstack_kibana_security_role.test", "kibana.0.feature.#"),
+					resource.TestCheckNoResourceAttr("elasticstack_kibana_security_role.test", "elasticsearch.0.indices.0.field_security.#"),
+					resource.TestCheckResourceAttr("elasticstack_kibana_security_role.test", "description", "Role description"),
+				),
+			},
 			{
 				SkipFunc: versionutils.CheckIfVersionIsUnsupported(minSupportedRemoteIndicesVersion),
 				Config:   testAccResourceSecurityRoleRemoteIndicesCreate(roleNameRemoteIndices),
@@ -174,6 +185,32 @@ resource "elasticstack_kibana_security_role" "test" {
 	`, roleName)
 }
 
+func testAccResourceSecurityRoleWithDescription(roleName string) string {
+	return fmt.Sprintf(`
+provider "elasticstack" {
+  elasticsearch {}
+  kibana {}
+}
+
+resource "elasticstack_kibana_security_role" "test" {
+	name    = "%s"
+	description = "Role description"
+	elasticsearch {
+	  cluster = [ "create_snapshot" ]
+	  indices {
+		names = ["sample"]
+		privileges = ["create", "read", "write"]
+	  }
+	  run_as = ["kibana", "elastic"]
+	}
+	kibana {
+	  base = [ "all" ]
+	  spaces = ["default"]
+	}
+}
+	`, roleName)
+}
+
 func testAccResourceSecurityRoleRemoteIndicesCreate(roleName string) string {
 	return fmt.Sprintf(`
 provider "elasticstack" {

libs/go-kibana-rest/kbapi/api.kibana_role_management.go

@@ -14,12 +14,13 @@ const (
 
 // KibanaRole is the API role object
 type KibanaRole struct {
-	Name            string                       `json:"name,omitempty"`
-	Metadata        map[string]interface{}       `json:"metadata,omitempty"`
-	TransientMedata *KibanaRoleTransientMetadata `json:"transient_metadata,omitempty"`
-	Elasticsearch   *KibanaRoleElasticsearch     `json:"elasticsearch,omitempty"`
-	Kibana          []KibanaRoleKibana           `json:"kibana,omitempty"`
-	CreateOnly      bool                         `json:"-"`
+	Name              string                       `json:"name,omitempty"`
+	Metadata          map[string]interface{}       `json:"metadata,omitempty"`
+	TransientMetadata *KibanaRoleTransientMetadata `json:"transient_metadata,omitempty"`
+	Elasticsearch     *KibanaRoleElasticsearch     `json:"elasticsearch,omitempty"`
+	Kibana            []KibanaRoleKibana           `json:"kibana,omitempty"`
+	Description       string                       `json:"description,omitempty"`
+	CreateOnly        bool                         `json:"-"`
 }
 
 // KibanaRoleTransientMetadata is the API TransientMedata object