[BUG] Adding more than one opensearch_roles_mapping per role will cause inconsistency

[strobeti]

What is the bug?

Adding more than one opensearch_roles_mapping per role will cause inconsistency between the terraform state and the actual mapping in OpenSearch.

OpenSearch's REST API provides an endpoint for role mapping using the role name as identifier: _plugins/_security/api/rolesmapping/<role>. OpenSearch Documentation

Multiple opensearch_roles_mappings for the same role will result in multiple calls to this REST API, overwriting or deleting existing role mappings.

How can one reproduce the bug?

Add role:

• Create multiple opensearch_roles_mappings resources with the same role_name.

Resource "opensearch_roles_mapping" "a" {
  role_name = a_role
   ...
}

resource "opensearch_roles_mapping" "b" {
  role_name = a_role
   ...
}

• Terraform will create both resources by calling the same API, thus overwriting the first role_mapping with the second.

Remove one of these roles:

resource "opensearch_roles_mapping" "a" {
  role_name = a_role
   ...
}

• Terraform will destroy the resource calling the API and delete the role_mapping completely.

What is the expected behavior?

• Terraform should either merge the role_mappings per role before calling the REST endpoint, or prevent multiple mappings from happening in the first place.

What is your host/environment?

• Opensearch >= 1.x
• Provider version 1.0.0

[zelinh]

[Triage] Could you help look into this? Thanks! @prudhvigodithi @phillbaker

[drew-altana]

other AWS resource providers tend to have two resources for additive versus complete set resources: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group_membership vs https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership I'd expect opensearch_roles_mapping could remain as is, but add something like: opensearch_user_roles_mapping in addition that has the additive behavior. Though honestly the later is usually all I use.

[cameronattard]

At the very least I think this behaviour should be documented. Very easy to lock yourself out of a cluster without knowing.