Skip to content

refactor: Uses createOnlyWithDefault for delete_on_create_timeout in flexcluster #3625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 17 commits into from
Closed

refactor: Uses createOnlyWithDefault for delete_on_create_timeout in flexcluster #3625

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
978dd91
refactor: Use createOnly with default for delete_on_create_timeout fo…
EspenAlbert Aug 27, 2025
5f79c13
feat: Adds support for `role_id` in `google_cloud_kms_config` on `mon…
oarbusi Sep 3, 2025
b31e7c2
chore: Updates CHANGELOG.md for #3636
svc-apix-Bot Sep 3, 2025
995e614
feat: Supports GCP for `mongodbatlas_cloud_provider_access_authorizat…
oarbusi Sep 3, 2025
3ec1bc6
chore: Updates CHANGELOG.md for #3639
svc-apix-Bot Sep 3, 2025
ed27cba
feat: Adds support for `service_account_for_atlas` and `status` field…
marcabreracast Sep 3, 2025
eeee5db
chore: Updates CHANGELOG.md for #3637
svc-apix-Bot Sep 3, 2025
b56c808
chore: Bump amannn/action-semantic-pull-request from 6.1.0 to 6.1.1 (…
dependabot[bot] Sep 3, 2025
394cf89
chore: Bump github.com/pb33f/libopenapi from 0.25.3 to 0.25.6 (#3621)
dependabot[bot] Sep 3, 2025
a16827e
chore: Update Go to 1.25.0 (#3641)
lantoli Sep 3, 2025
308f682
test: Ensures project `withDefaultAlertsSettings` works with import a…
EspenAlbert Sep 3, 2025
b0cd21c
Merge branch 'master' into create-only-with-default
EspenAlbert Sep 3, 2025
221ad5e
refactor: Remove references to old plan modifier
EspenAlbert Sep 3, 2025
6eb3789
Merge branch 'CLOUDP-320243-dev-2.0.0' into create-only-with-default
EspenAlbert Sep 3, 2025
4b184dd
test: Add ImportStateVerifyIgnore for delete_on_create_timeout in bas…
EspenAlbert Sep 4, 2025
31d1ecf
Merge branch 'CLOUDP-320243-dev-2.0.0' into create-only-with-default
EspenAlbert Sep 5, 2025
bd92500
Update docs/resources/project.md
EspenAlbert Sep 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changelog/3636.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
```release-note:enhancement
resource/mongodbatlas_encryption_at_rest: Supports role_id in google_cloud_kms_config
```

```release-note:enhancement
data-source/mongodbatlas_encryption_at_rest: Supports role_id in google_cloud_kms_config
```
7 changes: 7 additions & 0 deletions .changelog/3637.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
```release-note:enhancement
resource/mongodbatlas_cloud_provider_access_setup: Adds support for GCP as a Cloud Provider.
```

```release-note:enhancement
data-source/mongodbatlas_cloud_provider_access_setup: Adds support for GCP as a Cloud Provider.
```
3 changes: 3 additions & 0 deletions .changelog/3639.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
resource/mongodbatlas_cloud_provider_access_authorization: Supports GCP cloud provider
```
2 changes: 1 addition & 1 deletion .github/workflows/code-health.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ jobs:
- name: golangci-lint
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9
with:
version: v2.3.1 # Also update GOLANGCI_VERSION variable in GNUmakefile when updating this version
version: v2.4.0 # Also update GOLANGCI_VERSION variable in GNUmakefile when updating this version
- name: actionlint
run: |
make tools
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pull-request-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
permissions:
pull-requests: write # Needed by sticky-pull-request-comment
steps:
- uses: amannn/action-semantic-pull-request@7f33ba792281b034f64e96f4c0b5496782dd3b37
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50
id: lint_pr_title
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
## (Unreleased)

ENHANCEMENTS:

* data-source/mongodbatlas_cloud_provider_access_setup: Adds support for GCP as a Cloud Provider. ([#3637](https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3637))
* data-source/mongodbatlas_encryption_at_rest: Supports role_id in google_cloud_kms_config ([#3636](https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3636))
* resource/mongodbatlas_cloud_provider_access_authorization: Supports GCP cloud provider ([#3639](https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3639))
* resource/mongodbatlas_cloud_provider_access_setup: Adds support for GCP as a Cloud Provider. ([#3637](https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3637))
* resource/mongodbatlas_encryption_at_rest: Supports role_id in google_cloud_kms_config ([#3636](https://github.com/mongodb/terraform-provider-mongodbatlas/pull/3636))

## 1.40.0 (August 21, 2025)

ENHANCEMENTS:
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ GITTAG=$(shell git describe --always --tags)
VERSION=$(GITTAG:v%=%)
LINKER_FLAGS=-s -w -X 'github.com/mongodb/terraform-provider-mongodbatlas/version.ProviderVersion=${VERSION}'

GOLANGCI_VERSION=v2.3.1 # Also update golangci-lint GH action in code-health.yml when updating this version
GOLANGCI_VERSION=v2.4.0 # Also update golangci-lint GH action in code-health.yml when updating this version

export PATH := $(shell go env GOPATH)/bin:$(PATH)
export SHELL := env PATH=$(PATH) /bin/bash
Expand Down
28 changes: 22 additions & 6 deletions docs/data-sources/cloud_provider_access_setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ subcategory: "Cloud Provider Access"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@EspenAlbert could we first trigger https://github.com/mongodb/terraform-provider-mongodbatlas/actions/workflows/update-dev-branches.yml so that all the changes you need from master are already present in the dev branch? Or alternatively provide the isolated commits for the changes associated to flex cluster

Copy link
Collaborator Author

@EspenAlbert EspenAlbert Sep 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it got a bit messy since I needed to merge with master.
Running the update manually will create a merge conflict that would require updates in other files... So it is a bit complicated :/
Changes to flex cluster is in this commit: 978dd91

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can also recommend checking the changes to create_only.go to compare the plan modifiers

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my concern with this is that if for whatever reason we need to revert the createOnlyWithDefault, we would also revert some unrelated pieces of code. What is the complication in merging master in 2.0.0 in the automated PR and open a new PR on top of that in 2.0.0 with your create_only changes?

# Data Source: mongodbatlas_cloud_provider_access_setup

`mongodbatlas_cloud_provider_access_setup` allows you to get a single role for a provider access role setup, currently only AWS and Azure are supported.
`mongodbatlas_cloud_provider_access_setup` allows you to get a single role for a provider access role setup. Supported providers: AWS, AZURE and GCP.

-> **NOTE:** Groups and projects are synonymous terms. You may find `groupId` in the official documentation.

Expand Down Expand Up @@ -40,27 +40,43 @@ data "mongodbatlas_cloud_provider_access_setup" "single_setup" {
role_id = mongodbatlas_cloud_provider_access_setup.test_role.role_id
}
```

## Example Usage with GCP

```terraform
resource "mongodbatlas_cloud_provider_access_setup" "test_role" {
project_id = "64259ee860c43338194b0f8e"
provider_name = "GCP"
}

data "mongodbatlas_cloud_provider_access_setup" "single_setup" {
project_id = mongodbatlas_cloud_provider_access_setup.test_role.project_id
provider_name = mongodbatlas_cloud_provider_access_setup.test_role.provider_name
role_id = mongodbatlas_cloud_provider_access_setup.test_role.role_id
}
```

## Argument Reference

* `project_id` - (Required) The unique ID for the project to get all Cloud Provider Access
* `provider_name` - (Required) cloud provider name, currently only AWS is supported
* `role_id` - (Required) unique role id among all the aws roles provided by mongodb atlas
* `provider_name` - (Required) cloud provider name. Supported values: `AWS`, `AZURE`, and `GCP`.
* `role_id` - (Required) unique role id among all the roles provided by MongoDB Atlas.

## Attributes Reference

In addition to all arguments above, the following attributes are exported:

* `id` - Autogenerated Unique ID for this data source.
* `aws` - aws related role information
* `atlas_assumed_role_external_id` - Unique external ID Atlas uses when assuming the IAM role in your AWS account.
* `atlas_aws_account_arn` - ARN associated with the Atlas AWS account used to assume IAM roles in your AWS account.
* `aws_config` - aws related role information
* `atlas_assumed_role_external_id` - Unique external ID Atlas uses when assuming the IAM role in your AWS account.
* `atlas_aws_account_arn` - ARN associated with the Atlas AWS account used to assume IAM roles in your AWS account.
* `azure_config` - azure related configurations
* `atlas_azure_app_id` - Azure Active Directory Application ID of Atlas.
* `service_principal_id`- UUID string that identifies the Azure Service Principal.
* `tenant_id` - UUID String that identifies the Azure Active Directory Tenant ID.
* `gcp_config` - gcp related configurations
* `status` - The status of the GCP cloud provider access setup. See [MongoDB Atlas API](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getgroupcloudprovideraccess#operation-getgroupcloudprovideraccess-200-body-application-vnd-atlas-2023-01-01-json-gcp-object-status).
* `service_account_for_atlas` - The GCP service account email that Atlas uses.
* `created_date` - Date on which this role was created.
* `last_updated_date` - Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

Expand Down
3 changes: 3 additions & 0 deletions docs/data-sources/encryption_at_rest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,8 @@ output "is_azure_encryption_at_rest_valid" {
-> **NOTE:** It is possible to configure Atlas Encryption at Rest to communicate with Customer Managed Keys (Azure Key Vault or AWS KMS) over private network interfaces (Azure Private Link or AWS PrivateLink). This requires enabling the `azure_key_vault_config.require_private_networking` or the `aws_kms_config.require_private_networking` attribute, together with the configuration of the `mongodbatlas_encryption_at_rest_private_endpoint` resource. Please review the `mongodbatlas_encryption_at_rest_private_endpoint` resource for details.

### Configuring encryption at rest using customer key management in GCP
For authentication, you must provide either serviceAccountKey (static credentials) or roleId (service-account–based authentication). Once roleId is configured, serviceAccountKey is no longer supported.

```terraform
resource "mongodbatlas_encryption_at_rest" "test" {
project_id = var.atlas_project_id
Expand Down Expand Up @@ -185,6 +187,7 @@ Read-Only:

- `enabled` (Boolean) Flag that indicates whether someone enabled encryption at rest for the specified project. To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
- `key_version_resource_id` (String, Sensitive) Resource path that displays the key version resource ID for your Google Cloud KMS.
- `role_id` (String) Unique 24-hexadecimal digit string that identifies the Google Cloud Provider Access Role that MongoDB Cloud uses to access the Google Cloud KMS.
- `service_account_key` (String, Sensitive) JavaScript Object Notation (JSON) object that contains the Google Cloud Key Management Service (KMS). Format the JSON as a string and not as an object.
- `valid` (Boolean) Flag that indicates whether the Google Cloud Key Management Service (KMS) encryption key can encrypt and decrypt data.

Expand Down
24 changes: 21 additions & 3 deletions docs/resources/cloud_provider_access.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,15 +48,25 @@ resource "mongodbatlas_cloud_provider_access_setup" "test_role" {

```

## Example Usage with GCP

```terraform

resource "mongodbatlas_cloud_provider_access_setup" "test_role" {
project_id = "64259ee860c43338194b0f8e"
provider_name = "GCP"
}

```

### Further Examples
- [AWS Cloud Provider Access](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_cloud_provider_access/aws)
- [Azure Cloud Provider Access](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_cloud_provider_access/azure)


## Argument Reference

* `project_id` - (Required) The unique ID for the project
* `provider_name` - (Required) The cloud provider for which to create a new role. Currently only AWS and AZURE are supported. **WARNING** Changing the `provider_name` will result in destruction of the existing resource and the creation of a new resource.
* `provider_name` - (Required) The cloud provider for which to create a new role. Currently, AWS, AZURE and GCP are supported. **WARNING** Changing the `provider_name` will result in destruction of the existing resource and the creation of a new resource.
* `azure_config` - azure related configurations
* `atlas_azure_app_id` - Azure Active Directory Application ID of Atlas. This property is required when `provider_name = "AZURE".`
* `service_principal_id`- UUID string that identifies the Azure Service Principal. This property is required when `provider_name = "AZURE".`
Expand All @@ -68,6 +78,9 @@ resource "mongodbatlas_cloud_provider_access_setup" "test_role" {
* `aws_config` - aws related arn roles
* `atlas_assumed_role_external_id` - Unique external ID Atlas uses when assuming the IAM role in your AWS account.
* `atlas_aws_account_arn` - ARN associated with the Atlas AWS account used to assume IAM roles in your AWS account.
* `gcp_config` - gcp related configuration
* `status` - The status of the GCP cloud provider access setup. See [MongoDB Atlas API](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getgroupcloudprovideraccess#operation-getgroupcloudprovideraccess-200-body-application-vnd-atlas-2023-01-01-json-gcp-object-status).
* `service_account_for_atlas` - The GCP service account email that Atlas uses.
* `created_date` - Date on which this role was created.
* `last_updated_date` - Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
* `role_id` - Unique ID of this role.
Expand Down Expand Up @@ -144,13 +157,18 @@ resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
Conditional
* `aws`
* `iam_assumed_role_arn` - (Required) ARN of the IAM Role that Atlas assumes when accessing resources in your AWS account. This value is required after the creation (register of the role) as part of [Set Up Unified AWS Access](https://docs.atlas.mongodb.com/security/set-up-unified-aws-access/#set-up-unified-aws-access).

* `azure`
* `atlas_azure_app_id` - (Required) Azure Active Directory Application ID of Atlas.
* `service_principal_id` - (Required) UUID string that identifies the Azure Service Principal.
* `tenant_id` - (Required) UUID String that identifies the Azure Active Directory Tenant ID.

## Attributes Reference

* `id` - Unique identifier used by terraform for internal management.
* `authorized_date` - Date on which this role was authorized.
* `feature_usages` - Atlas features this AWS IAM role is linked to.
* `gcp`
* `service_account_for_atlas` - Email address for the Google Service Account created by Atlas.



Expand Down
3 changes: 3 additions & 0 deletions docs/resources/encryption_at_rest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,8 @@ Please review the [`mongodbatlas_encryption_at_rest_private_endpoint` resource d


### Configuring encryption at rest using customer key management in GCP
For authentication, you must provide either serviceAccountKey (static credentials) or roleId (service-account–based authentication). Once roleId is configured, serviceAccountKey is no longer supported.

```terraform
resource "mongodbatlas_encryption_at_rest" "test" {
project_id = var.atlas_project_id
Expand Down Expand Up @@ -219,6 +221,7 @@ Optional:

- `enabled` (Boolean) Flag that indicates whether someone enabled encryption at rest for the specified project. To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
- `key_version_resource_id` (String, Sensitive) Resource path that displays the key version resource ID for your Google Cloud KMS.
- `role_id` (String) Unique 24-hexadecimal digit string that identifies the Google Cloud Provider Access Role that MongoDB Cloud uses to access the Google Cloud KMS.
- `service_account_key` (String, Sensitive) JavaScript Object Notation (JSON) object that contains the Google Cloud Key Management Service (KMS). Format the JSON as a string and not as an object.

Read-Only:
Expand Down
2 changes: 1 addition & 1 deletion docs/resources/project.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ resource "mongodbatlas_project" "test" {
* `org_id` - (Required) The ID of the organization you want to create the project within.
* `project_owner_id` - (Optional) Unique 24-hexadecimal digit string that identifies the Atlas user account to be granted the [Project Owner](https://docs.atlas.mongodb.com/reference/user-roles/#mongodb-authrole-Project-Owner) role on the specified project. If you set this parameter, it overrides the default value of the oldest [Organization Owner](https://docs.atlas.mongodb.com/reference/user-roles/#mongodb-authrole-Organization-Owner).
* `tags` - (Optional) Map that contains key-value pairs between 1 to 255 characters in length for tagging and categorizing the project. See [below](#tags).
* `with_default_alerts_settings` - (Optional) It allows users to disable the creation of the default alert settings. By default, this flag is set to true.
* `with_default_alerts_settings` - (Optional) Flag that indicates whether the project is created with default alert settings. This setting cannot be updated after project creation. By default, this flag is set to true.
* `is_collect_database_specifics_statistics_enabled` - (Optional) Flag that indicates whether to enable statistics in [cluster metrics](https://www.mongodb.com/docs/atlas/monitor-cluster-metrics/) collection for the project. By default, this flag is set to true.
* `is_data_explorer_enabled` - (Optional) Flag that indicates whether to enable Data Explorer for the project. If enabled, you can query your database with an easy to use interface. When Data Explorer is disabled, you cannot terminate slow operations from the [Real-Time Performance Panel](https://www.mongodb.com/docs/atlas/real-time-performance-panel/#std-label-real-time-metrics-status-tab) or create indexes from the [Performance Advisor](https://www.mongodb.com/docs/atlas/performance-advisor/#std-label-performance-advisor). You can still view Performance Advisor recommendations, but you must create those indexes from [mongosh](https://www.mongodb.com/docs/mongodb-shell/#mongodb-binary-bin.mongosh). By default, this flag is set to true.
* `is_extended_storage_sizes_enabled` - (Optional) Flag that indicates whether to enable extended storage sizes for the specified project. Clusters with extended storage sizes must be on AWS or GCP, and cannot span multiple regions. When extending storage size, initial syncs and cross-project snapshot restores will be slow. This setting should only be used as a measure of temporary relief; consider sharding if more storage is required.
Expand Down
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/mongodb/terraform-provider-mongodbatlas

go 1.24.6
go 1.25.0

require (
github.com/andygrunwald/go-jira/v2 v2.0.0-20240116150243-50d59fe116d6
Expand All @@ -25,7 +25,7 @@ require (
github.com/jarcoal/httpmock v1.4.1
github.com/mongodb-forks/digest v1.1.0
github.com/mongodb/atlas-sdk-go v1.0.1-0.20250825084037-c95a65f18752
github.com/pb33f/libopenapi v0.25.3
github.com/pb33f/libopenapi v0.25.8
github.com/sebdah/goldie/v2 v2.7.1
github.com/spf13/cast v1.9.2
github.com/stretchr/testify v1.11.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1215,8 +1215,8 @@ github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
github.com/openlyinc/pointy v1.1.2 h1:LywVV2BWC5Sp5v7FoP4bUD+2Yn5k0VNeRbU5vq9jUMY=
github.com/openlyinc/pointy v1.1.2/go.mod h1:w2Sytx+0FVuMKn37xpXIAyBNhFNBIJGR/v2m7ik1WtM=
github.com/pb33f/libopenapi v0.25.3 h1:B0rf9Reo63tAx54gpoP9778Y84gk3JQoFtj7yg8vKfo=
github.com/pb33f/libopenapi v0.25.3/go.mod h1:IefJDi7uJpflLs2wEnkiier/Y21w+dEbOrMCP5LB2aw=
github.com/pb33f/libopenapi v0.25.8 h1:vA6NZAu6YClmpf4oceqdHowUkeOp79CODXGZAukhxQQ=
github.com/pb33f/libopenapi v0.25.8/go.mod h1:3MKMFLcYAnTgOuueDd2HIidMphtHHAhPdspgjKVVFq8=
github.com/pb33f/ordered-map/v2 v2.2.0 h1:+6D6e0nkcEjVPh6kF48ynz2Cb+D/ECH/Q3AOunHtj7E=
github.com/pb33f/ordered-map/v2 v2.2.0/go.mod h1:rAwLzJPAha8J3pY5otLGRbGH2L077wij3W/ftbgPwNs=
github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
Expand Down
Loading
Loading