feat: Add new resource mongodbatlas_cloud_user_project_assignment #3568

csanx · 2025-08-07T11:40:19Z

Description

Add new resource: mongodbatlas_cloud_user_project_assignment

Link to any related issue(s): CLOUDP-333176

Type of change:

Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR. A migration guide must be created or updated.
This change requires a documentation update
Documentation fix/enhancement

Required Checklist:

I have signed the MongoDB CLA
I have read the contributing guides
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code
If changes include deprecations or removals I have added appropriate changelog entries.
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

This reverts commit f8d2d0a.

…m-provider-mongodbatlas into CLOUDP-320243-dev-2.0.0

github-actions · 2025-08-11T08:00:26Z

APIx bot: a message has been sent to Docs Slack channel

Copilot

Pull Request Overview

This PR adds a new Terraform resource mongodbatlas_cloud_user_project_assignment for managing user assignments to MongoDB Atlas projects with specific roles.

Key changes:

Implements a new resource with full CRUD operations and import functionality
Adds comprehensive test coverage including basic functionality and migration scenarios
Integrates the resource into the provider registration and CI/CD workflows

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/service/clouduserprojectassignment/resource.go	Core resource implementation with CRUD operations and import logic
internal/service/clouduserprojectassignment/resource_schema.go	Generated schema definition and TFModel struct
internal/service/clouduserprojectassignment/model.go	Data transformation functions between Terraform and Atlas SDK models
internal/service/clouduserprojectassignment/resource_test.go	Basic acceptance tests with create, update, and import scenarios
internal/service/clouduserprojectassignment/resource_migration_test.go	Migration tests for transitioning from project invitation to user assignment
internal/service/clouduserprojectassignment/model_test.go	Unit tests for model transformation functions
internal/service/clouduserprojectassignment/main_test.go	Test setup and teardown
internal/service/clouduserprojectassignment/tfplugingen/generator_config.yml	Configuration for code generation
internal/provider/provider.go	Registration of the new resource in the provider
.github/workflows/acceptance-tests-runner.yml	CI configuration updates for the new service
.changelog/3568.txt	Release note for the new resource

csanx · 2025-08-11T08:02:34Z

internal/service/clouduserprojectassignment/resource.go

+	resp.Diagnostics.Append(resp.State.Set(ctx, newCloudUserProjectAssignmentModel)...)
+}
+
+func fetchProjectUser(ctx context.Context, connV2 *admin.APIClient, projectID, userID, username string) (*admin.GroupUserResponse, error) {


fetchProjectUser function is introduced here and reused in #3569 to extract common functionality between the resource and the data source.

internal/service/clouduserprojectassignment/model.go

marcosuma · 2025-08-11T10:00:10Z

internal/service/clouduserprojectassignment/resource.go

+	}
+
+	for _, removeReq := range removeRequests {
+		_, _, err := connV2.MongoDBCloudUsersApi.RemoveProjectRole(ctx, projectID, userID, removeReq).Execute()


not blocking - if this API fails, the update will be partially applied (only the addprojectRole). This should be documented at minimum, but also we should check if we're consistent in similar situations

cc @maastha

by documented, do you mean add a comment here or mention something in the public documentation?

I think we should publicly document it? because I can see a question coming, like: "the update failed but then I logged in and saw some users were added ..."

yes but after failure when they run terraform plan again they will see the exact status of what roles were added vs which were not so I think that should suffice

ok, you have a fair point with this one. I'd say an extra clarification in the doc doesn't hurt, especially in case of customers reaching out. But it's a nice to have.

internal/service/clouduserprojectassignment/resource.go

maastha · 2025-08-11T11:28:26Z

internal/service/clouduserprojectassignment/model_test.go

+		plan     *clouduserprojectassignment.TFModel
+		expected *admin.GroupUserRequest
+	}{
+		"Complete model": {


also add test cases for empty/nil values (for all unit tests)

Done 59950ba

maastha · 2025-08-11T11:44:50Z

internal/service/clouduserprojectassignment/model.go

+	return &addProjectUserReq, nil
+}
+
+func NewAtlasUpdateReq(ctx context.Context, plan, state *TFModel) (addRequests, removeRequests []*admin.AddOrRemoveGroupRole, diags diag.Diagnostics) {


I'm thinking if instead of getting roles from the state here, would it be better to compare against what is returned by the API instead? That ways any partially applied calls can be handled correctly WDYT?

Do you mean making another API call before calling this method in the Update?

maastha · 2025-08-11T11:53:02Z

internal/service/clouduserprojectassignment/resource_test.go

+	resource.ParallelTest(t, *basicTestCase(t))
+}
+
+func basicTestCase(t *testing.T) *resource.TestCase {


should we also have a test case to import an existing (ACTIVE) project user? is that possible?

jwilliams-mongo

@csanx are there any docs updates for this feature? If not, LGTM

jwilliams-mongo · 2025-08-11T18:13:59Z

@csanx are there any docs updates for this feature? If not, LGTM

I see https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3578/files so I'll review that and approve this

AgustinBettati

LGTM, leaving some doubts which seem more API related

internal/service/clouduserprojectassignment/resource_schema.go

AgustinBettati · 2025-08-12T07:18:57Z

internal/service/clouduserprojectassignment/resource.go

+	importID := req.ID
+	ok, parts := conversion.ImportSplit(req.ID, 2)
+	if !ok {
+		resp.Diagnostics.AddError("invalid import ID format", "expected 'project_id/user_id' or 'project_id/username', got: "+importID)


q: Why do we support import with user_id as well? Does it help with a particular migration journey? Asking as this does add some complexity to our read operation.

It’s mainly for consistency, since we provide both keys in all Cloud User resources

internal/service/clouduserprojectassignment/resource_migration_test.go

AgustinBettati · 2025-08-12T07:28:41Z

internal/service/clouduserprojectassignment/resource_migration_test.go

+		resource "mongodbatlas_project_invitation" "mig_test" {
+			project_id  = mongodbatlas_project.mig_test.id
+			username    = local.username
+			roles       = local.roles
+		}
+
+		resource "mongodbatlas_cloud_user_project_assignment" "user_mig_test" {
+			project_id = mongodbatlas_project.mig_test.id
+			username   = local.username
+			roles      = local.roles
+		}


Can user_project_assignment be created with project_invitation already existing? I suppose this is how the API behaves but wanted to confirm.

Yes, after running this, the state shows:

{ "mode": "managed", "type": "mongodbatlas_project_invitation", "name": "mig_test", ... }, { "mode": "managed", "type": "mongodbatlas_cloud_user_project_assignment", "name": "user_mig_test", ... },

We can also see in Cloud Dev that the same user is invited twice.

I see, thanks. This sentence for the Tech design helped me understand this migration journey, potentially we can leave it as a comment:

we only need to consider the migration path for mongodbatlas_project_invitation resources with a PENDING invite (similar to org_invites) - which are not discoverable by the new APIs - so the only way to migrate here is to re-create the pending users.

Got it, I’ll take that into account

internal/service/clouduserprojectassignment/resource_migration_test.go

csanx · 2025-08-12T08:26:20Z

@jwilliams-mongo Yes, my upcoming PRs will add documentation for all new resources and data sources. The one you mention is related to another resource actually

maastha · 2025-08-12T15:35:19Z

.github/workflows/acceptance-tests-runner.yml

@@ -601,8 +602,10 @@ jobs:
          MONGODB_ATLAS_PROJECT_OWNER_ID: ${{ inputs.mongodb_atlas_project_owner_id }}
          MONGODB_ATLAS_ORG_ID: ${{ inputs.mongodb_atlas_org_id }}
          MONGODB_ATLAS_USERNAME: ${{ vars.MONGODB_ATLAS_USERNAME }}
+          MONGODB_ATLAS_USERNAME_2: ${{ vars.MONGODB_ATLAS_USERNAME_2 }}


is there any difference between MONGODB_ATLAS_USERNAME & MONGODB_ATLAS_USERNAME_2? or we're just adding for more test cases? thinking if we should add a comment here on what MONGODB_ATLAS_USERNAME_2 signifies

Cristina Sánchez Sánchez added 16 commits July 28, 2025 10:24

WIP- Created resource

84513be

Added model tests

cb5b312

Added tests

b92ebf9

Fixed import

2f6bfee

Typo

bc7fe7b

Merge branch 'CLOUDP-320243-dev-2.0.0' into CLOUDP-333176

8d3db26

Merge branch 'CLOUDP-320243-dev-2.0.0' into CLOUDP-333176

7271d8a

Preview new SDK version

9601faa

WIP - Migration test

fdd1ded

WIP - migration test

b42949c

Updated SDK

f8d2d0a

Revert "Updated SDK"

ece5d8d

This reverts commit f8d2d0a.

Merge branch 'CLOUDP-320243-dev-2.0.0' of github.com:mongodb/terrafor…

c7029fc

…m-provider-mongodbatlas into CLOUDP-320243-dev-2.0.0

Merge branch 'CLOUDP-320243-dev-2.0.0' into CLOUDP-333176

ece229a

Updated SDK

8690f0e

Fixed migration test

fa00932

github-actions bot added the enhancement label Aug 7, 2025

csanx changed the base branch from master to CLOUDP-320243-dev-2.0.0 August 7, 2025 11:41

Cristina Sánchez Sánchez added 7 commits August 7, 2025 13:42

Changelog

21b815a

Merge branch 'CLOUDP-320243-dev-2.0.0' of github.com:mongodb/terrafor…

4e3f64a

…m-provider-mongodbatlas into CLOUDP-320243-dev-2.0.0

Merge branch 'CLOUDP-320243-dev-2.0.0' into CLOUDP-333176

0e54c53

Merge branch 'CLOUDP-320243-dev-2.0.0' into CLOUDP-333176

072a4b2

CheckDestroy

b396420

Refactor

aa22dc6

typo

d2d1136

csanx marked this pull request as ready for review August 11, 2025 08:00

Copilot AI review requested due to automatic review settings August 11, 2025 08:00

csanx requested review from a team as code owners August 11, 2025 08:00

Copilot AI reviewed Aug 11, 2025

View reviewed changes

csanx commented Aug 11, 2025

View reviewed changes

Fix

542fa5e

marcosuma reviewed Aug 11, 2025

View reviewed changes

maastha reviewed Aug 11, 2025

View reviewed changes

Added TestNewAtlasUpdateReq

c48e857

jwilliams-mongo reviewed Aug 11, 2025

View reviewed changes

AgustinBettati reviewed Aug 12, 2025

View reviewed changes

Empty/nil test cases

59950ba

Cristina Sánchez Sánchez added 4 commits August 12, 2025 10:42

Fix

e011813

Added active user to test

12bbfa7

Added MONGODB_ATLAS_USERNAME_2

866306d

Changed Update to read from API

a2ea83a

marcosuma approved these changes Aug 12, 2025

View reviewed changes

maastha reviewed Aug 12, 2025

View reviewed changes

jwilliams-mongo approved these changes Aug 12, 2025

View reviewed changes

maastha approved these changes Aug 12, 2025

View reviewed changes

feat: Add new resource mongodbatlas_cloud_user_project_assignment #3568

Are you sure you want to change the base?

feat: Add new resource mongodbatlas_cloud_user_project_assignment #3568

Uh oh!

Conversation

csanx commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change:

Required Checklist:

Further comments

Uh oh!

github-actions bot commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

maastha Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jwilliams-mongo left a comment

Choose a reason for hiding this comment

Uh oh!

jwilliams-mongo commented Aug 11, 2025

Uh oh!

AgustinBettati left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

csanx commented Aug 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

csanx commented Aug 7, 2025 •

edited

Loading

maastha Aug 11, 2025 •

edited

Loading