Add limited role and existing users to datadog

datadog-roles.tf

@@ -1,3 +1,6 @@
+# check permissions
+data "datadog_permissions" "permissions" {}
+
 # Create new role resources
 variable "dd_roles" {
   description = "Map of Role Resources"
@@ -6,30 +9,40 @@ variable "dd_roles" {
     permissions = optional(list(string), [])
   }))
 
-  default = {
-    # Example role configuration - replace with actual roles
-    # "custom-readonly" = {
-    #   name        = "Custom Read Only"
-    #   permissions = [
-    #     "dashboards_read",
-    #     "monitors_read",
-    #     "logs_read_data"
-    #   ]
-    # },
-    # "custom-admin" = {
-    #   name        = "Custom Admin"
-    #   permissions = [
-    #     "admin",
-    #     "dashboards_write",
-    #     "monitors_write",
-    #     "logs_write_exclusion_filters"
-    #   ]
-    # }
+  default = {}
+}
+
+locals {
+  default_roles = {
+    "custom-read-write" = {
+      name = "Custom Read Write"
+      permissions = [
+        # Read permissions (similar to read-only role)
+        data.datadog_permissions.permissions.permissions["logs_read_data"],
+        data.datadog_permissions.permissions.permissions["logs_read_index_data"],
+        data.datadog_permissions.permissions.permissions["logs_read_archives"],
+        data.datadog_permissions.permissions.permissions["synthetics_read"],
+        data.datadog_permissions.permissions.permissions["cases_read"],
+        data.datadog_permissions.permissions.permissions["audit_logs_read"],
+
+        # Additional write permissions
+        data.datadog_permissions.permissions.permissions["dashboards_write"],
+        data.datadog_permissions.permissions.permissions["dashboards_public_share"],
+        data.datadog_permissions.permissions.permissions["monitors_write"],
+        data.datadog_permissions.permissions.permissions["synthetics_write"],
+        data.datadog_permissions.permissions.permissions["cases_write"],
+        data.datadog_permissions.permissions.permissions["notebooks_write"],
+        data.datadog_permissions.permissions.permissions["incident_write"],
+      ]
+    }
   }
+
+  # Merge default roles with any custom roles provided via variable
+  roles = merge(local.default_roles, var.dd_roles)
 }
 
 resource "datadog_role" "roles" {
-  for_each = var.dd_roles
+  for_each = local.roles
   name     = each.value.name
 
   dynamic "permission" {
@@ -38,4 +51,4 @@ resource "datadog_role" "roles" {
       id = permission.value
     }
   }
-}
+}

datadog-users.tf

@@ -3,26 +3,36 @@ variable "dd_users" {
   description = "Map of User Resources"
   type = map(object({
     email    = string
-    name     = string
     roles    = optional(list(string), [])
     disabled = optional(bool, false)
   }))
 
   default = {
-    # Example user configuration - replace with actual users
-    # "example-user" = {
-    #   email    = "[email protected]"
-    #   name     = "Example User"
-    #   roles    = ["standard"]  # roles can include: "standard", "admin", "read_only"
-    #   disabled = false
-    # }
+    "jconway" = {
+      email    = "[email protected]"
+      roles    = ["admin"]
+      disabled = false
+    },
+    "tha" = {
+      email    = "[email protected]"
+      roles    = ["admin"]
+      disabled = false
+    },
+    "rdetjens" = {
+      email    = "[email protected]"
+      roles    = ["admin"]
+      disabled = false
+    },
+    "rgrigar" = {
+      email    = "[email protected]"
+      roles    = ["admin"]
+      disabled = false
+    }
   }
 }
-
 resource "datadog_user" "users" {
   for_each = var.dd_users
   email    = each.value.email
-  name     = each.value.name
   roles    = each.value.roles
   disabled = each.value.disabled
 }