azuredevops_securityrole_assignment doesn't detect missing permissions correctly

[drdamour]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Affected Resource(s)

• azuredevops_securityrole_assignment

Terraform Configuration Files

resource "azuredevops_project" "example" {
  name               = "Example Project"
  visibility         = "private"
  version_control    = "Git"
  work_item_template = "Agile"
  description        = "Managed by Terraform"
}

resource "azuredevops_group" "example" {
  scope        = azuredevops_project.example.id
  display_name = "Example group"
  description  = "Description of example group"
}

resource "azuredevops_securityrole_assignment" "example" {
  scope       = "distributedtask.globalenvironmentreferencerole"
  resource_id = azuredevops_project.appd.id
  identity_id = azuredevops_group.example.origin_id
  role_name   = "User"
}

Debug Output

Panic Output

Expected Behavior

After applying this successfully, i went into web gui and delete this permissions.

I expected a subsequent apply to detect that this permissions was no longer present and show in plan trying to set it back

also i expected if i removed the resource "azuredevops_securityrole_assignment" "example" block after manual deleting for the plan to come back clean / show no changes necessary

Actual Behavior

subsequent apply showed that there were no change needed

when removing the resource "azuredevops_securityrole_assignment" "example" block from .tf file, the plan showed it needed to delete the resource

it was kinda like it was reading the current values from state and NOT from the response from azdo http services.

Steps to Reproduce

1. terraform apply

Important Factoids

sniffing the traffic i was able to confirm GET https://dev.azure.com//_apis/securityroles/scopes/distributedtask.globalenvironmentreferencerole/roleassignments/resources/ did NOT return the assignment in the list..so azdo was giving back good info..seems like provider wasn't using it

References