terraform-provider-sumologic icon indicating copy to clipboard operation
terraform-provider-sumologic copied to clipboard

Add ability to make sure the right sumo account is being used

Open mmrobins opened this issue 4 years ago • 1 comments

It'd be nice if you could limit which account / organization the terraform code applied to, something like

provider "sumologic" {
    environment = "us2"
    account_id = "myworkaccount"
}

Probably not a common issue people are going to hit, but we recently had someone with multiple sumo accounts, so they set environment variables for the wrong account

export SUMOLOGIC_ACCESSID=
export SUMOLOGIC_ACCESSKEY=

And then when they ran the terraform written for the other sumo account the plans were very confusing. It would use terraform state for some resources (like collectors) to make plans for other resources (like http sources). Took awhile to realize they were running credentials for a different sumo account, and would have been nice to prevent this confusing.

I couldn't find API docs for something that returns an account or organization ID either, and the best I could find for figuring out what user pertains to a key was a 2 step process

curl -s \
  -u "$SUMOLOGIC_ACCESSID:$SUMOLOGIC_ACCESSKEY" \
  https://api.us2.sumologic.com/api/v1/users/$(curl -s -u "$SUMOLOGIC_ACCESSID:$SUMOLOGIC_ACCESSKEY" https://api.us2.sumologic.com/api/v1/accessKeys/personal | jq -r '.data | first | .createdBy') \
  | jq '.email'

Obviously not directly a terraform provider issue, but would be nice there was an endpoint like https://api.us2.sumologic.com/api/v1/users/whoami that returned the user's name, email, and what account / org the token was part of. I assume some of that info would be necessary to implement this in terraform anyway though

mmrobins avatar Jun 17 '21 17:06 mmrobins

There's https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/caller_identity which I think does what is requested here.

mccartney avatar Sep 17 '21 14:09 mccartney