cloudflare / cloudflare/tf-migrate
cloudflare_api_token_permission_groups decommissioned in v5, tool doesn't migrate existing usage in cloudflare_api_token resources
- Dominant language
- Go
- Stars
- 33
- Forks
- 12
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 2
Description
### tf-migrate version
v1.0.1
### Migration path
v4 to v5
### Affected resource type(s)
cloudflare_api_token_permission_groups, cloudflare_api_token
### Description
The tool is not handling the deprecation of `cloudflare_api_token_permission_groups` data source properly.
Specifically in the context of a `cloudflare_api_token` resource, any reference to the above data source is being replaced with incorrect hard-coded permission group id values like `DNS Read` or `DNS Write`.
### Input configuration
```hcl
data "cloudflare_api_token_permission_groups" "all" {}
resource "cloudflare_api_token" "example_api_token" {
name = "example_api_token"
policy {
permission_groups = [
data.cloudflare_api_token_permission_groups.all.permissions["Zone Read"],
data.cloudflare_api_token_permission_groups.all.permissions["DNS Read"],
data.cloudflare_api_token_permission_groups.all.permissions["DNS Write"],
]
..
..
..
```
### Expected output
```hcl
Permission_groups properly set. Example like in the provider guide:
resource "cloudflare_api_token" "example_api_token" {
name = "workers read-only token"
policies = [{
resources = jsonencode({
"com.cloudflare.api.account.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" = "*",
"com.cloudflare.api.account.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" = "*",
})
effect = "allow"
permission_groups = [{
id = "1a71c399035b4950a1bd1466bbe4f420" // expect replacement for the data source instead of hardcode
}, {
id = "8b47d2786a534c08a1f94ee8f9f599ef" // expect replacement for the data source instead of hardcode
}]
```
### Actual output
```shell
resource "cloudflare_api_token" "example_api_token" {
name = "example_api_token"
policies = [{
resources = jsonencode({
"com.cloudflare.api.account.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" = "*",
"com.cloudflare.api.account.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" = "*",
})
effect = "allow"
permission_groups = [{
id = "DNS Read"
}, {
id = "DNS Write"
}, {
id = "Zone Read"
}]
}]
```
### Steps to reproduce
# Preview changes without modifying files (dry run)
tf-migrate migrate --dry-run --source-version v4 --target-version v5
# Apply the migration in-place
tf-migrate migrate --source-version v4 --target-version v5
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.