Opsgenie user removal wrong order

[zonArt]

Hi there,

I've got some issue when trying to remove a user from an opsgenie_user resource when this user is also referenced as a team member or a participant to a schedule rotation

Terraform Version

Terraform v0.12.29

• provider.opsgenie v0.5.0

Affected Resource(s)

• opsgenie_user
• opsgenie_schedule_rotation
• opsgenie_team

Debug Output

  # opsgenie_team.teams["teamtest"] will be updated in-place
  ~ resource "opsgenie_team" "teams" {
        delete_default_resources = true
        description              = "Testing intgerations and stuff"
        id                       = "589b1cf3-8e6c-431d-80a5-a02951f2a45c"
        name                     = "teamtest"

        member {
            id   = "551eae0c-9c3f-4adb-afee-e3998fe6dd42"
            role = "admin"
        }
      ~ member {
          ~ id   = "6551164a-6344-48ee-a68e-6a0d9012d1cb" -> "4a3e014a-9fc6-4104-baa1-d303d5a4cb92"
            role = "user"
        }
      - member {
          - id   = "4a3e014a-9fc6-4104-baa1-d303d5a4cb92" -> null
          - role = "user" -> null
        }
    }

  # opsgenie_user.users["usertest"] will be destroyed
  - resource "opsgenie_user" "users" {
      - full_name = "User Test" -> null
      - id        = "6551164a-6344-48ee-a68e-6a0d9012d1cb" -> null
      - locale    = "fr_CH" -> null
      - role      = "Admin" -> null
      - timezone  = "Europe/Belgrade" -> null
      - username  = "user.test@example.com" -> null
    }

Plan: 0 to add, 10 to change, 1 to destroy.

Do you want to perform these actions in workspace "staging"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

opsgenie_user.users["user.test@example.com"]: Destroying... [id=6551164a-6344-48ee-a68e-6a0d9012d1cb]

Error: Error occurred with Status code: 428, Message: User cannot be modified. Please remove it from teams: [teamtest], Took: 0.040000, RequestId: 6f3a73f1-19d2-488d-9559-4ec423ab5713

Expected Behavior

Terraform should remove the user from the team(s) and the schedule rotation(s) and then remove the user

Actual Behavior

An error occurs mentioning that the user is still part of team(s) and/or schedule rotation(s)

Steps to Reproduce

1. Create a user with
2. Create a team and attach the user to it as a member
3. Remove the user from the tf file and remove the member in the team tf file

[zdcthomas]

I'm also trying to figure out the preferred way to do this, and I'm hitting the exact same problem.

[jaceq]

It might depend on your state definition. How are you referring to that user in schedule / team? can you post you state definition?       Interested in terraform? Check out my articles!

[zonArt]

Sure:

users.yml

usertest:
  email: usertest@example.com
  full_name: User Test
  role: Admin
  locale: fr_CH
  timezone: Europe/Belgrade
otherexample:
  email: otherexample@foobar.com
  full_name: Other Example
  role: User
  locale: en_US
  timezone: Asia/Kolkata

users.tf

locals {
  users = yamldecode(file("users.yml"))
}

resource "opsgenie_user" "users" {
  for_each  = local.users
  username  = each.value.email
  full_name = each.value.full_name
  role      = each.value.role
  locale    = each.value.locale
  timezone  = each.value.timezone
}

teams.yml

otherexample:
  description: Other example
  members:
    usertest@example.com: user
    otherexample@foobar.com: admin
teamtest:
  description: Teamtest
  members:
    usertest@example.com:user

teams.tf

locals {
  teams = yamldecode(file("teams.yml"))
}

resource "opsgenie_team" "teams" {
  for_each                 = local.teams
  name                     = each.key
  description              = each.value.description
  delete_default_resources = true

  dynamic "member" {
    for_each = each.value.members
    content {
      id   = opsgenie_user.users[member.key].id
      role = member.value
    }
  }
}

schedule_rotations.yml

rotationtest:
  start_date: '2019-08-05T05:30:00Z'
  schedule_id: teamtest_schedule
  participants:
  - otherexample@foobar.com
  - usertest@example.com
anotherrotation:
  start_date: '2020-07-19T22:00:00Z'
  schedule_id: otherexample_schedule
  participants:
  - otherexample@foobar.com

schedule_rotations.tf

locals {
  schedule_rotations_file = yamldecode(file("schedule_rotations.yml"))
  schedule_rotations      = { for k, v in local.schedule_rotations_file : k => local.schedule_rotations_file[k] if v.participants != [] }
}

resource "opsgenie_schedule_rotation" "schedule_rotations" {
  for_each    = local.schedule_rotations
  name        = each.key
  start_date  = each.value.start_date
  length      = 1
  type        = "weekly"
  schedule_id = opsgenie_schedule.schedules[each.value.schedule_id].id
  dynamic "participant" {
    for_each = each.value.participants
    content {
      type = "user"
      id   = opsgenie_user.users[participant.value].id
    }
  }
}

schedules.yml

otherexample_schedule:
  description: ""
  timezone: "Asia/Kolkata"
  owner_team_id: "otherexample"
  enabled: true

teamtest_schedule:
  description: ""
  timezone: "Europe/Paris"
  owner_team_id: "teamtest"
  enabled: true

schedules.tf

locals {
  schedules = yamldecode(file("schedules.yml"))
}

resource "opsgenie_schedule" "schedules" {
  for_each      = local.schedules
  name          = each.key
  description   = each.value.description
  timezone      = each.value.timezone
  owner_team_id = opsgenie_team.teams[each.value.owner_team_id].id
  enabled       = each.value.enabled
}

[zonArt]

Now when I remove usertest it will be removed from the users.yml file but also from teams.yml and schedule_rotations.yml, then terraform apply will fail as mentioned in the ticket description

[edgarasg]

any progress with this?

[zonArt]

Would really be nice to have a solution since otherwise it's not possible to manage users through the provider. By the way I notice the same similar stuff is happening when doing a removal from let's say JIRA, you receive an email telling that the person has been removed from an Atlassian product but cannot be removed from opsgenie for the same reasons

[zsolt-p]

Hello, I'm having the exact same problem. Can't think of a non-hacky solution

[frknyldz]

Hello, thanks for reporting. I've tried to reproduce the exact same scenario with the modified version of example @zonArt shared. The Terraform version is : v1.3.1 The Opsgenie Terraform Provider version is : 0.6.15

The actual behavior is correct indeed. Opsgenie API does not allow you to delete the user unless removing it from teams and schedule rotations(any dependent place actually). The problem here is when you update all your ymls and remove the user from everywhere with 1 apply, the terraform updates/destroys resources out of order.

The solution is 2 different apply,

• Remove the user from teams and schedule rotations and apply
• Remove user resource itself and apply

Tested and confirmed.

[stefanandres]

Sorry, but this is NOT a solution, but a mere workaround. Please consider reviewing and merging https://github.com/opsgenie/terraform-provider-opsgenie/pull/335 since this actually solves the problem that you can do this in one apply.

[frknyldz]

Sorry, but this is NOT a solution, but a mere workaround. Please consider reviewing and merging #335 since this actually solves the problem that you can do this in one apply.

Hi @stefanandres, thanks for your collaboration. You can be sure it's reviewed and tested. The user is being deleted from teams only with pr mentioned and it's not solving the problem in one apply as you said. The user must be deleted from all the other resources. The test result can be seen below.

╷
│ Error: Error occurred with Status code: 428, Message: User cannot be modified. Please remove it from schedules: [teamtest_schedule,otherexample_schedule], Took: 0.058000, RequestId: 5114acfe-a2b1-4820-a0b9-2d4203b722e9

[frknyldz]

Hi, @zonArt and @stefanandres, could you please check the latest version to confirm? Thanks for your contributions.