integrations / integrations/terraform-provider-github

[BUG]: Error 403 SAML Enforcement when creating `github_enterprise_organization` with PAT (classic) in EMU environment

Open
#2,631 8 comments 3 reactions 0 assignees View on GitHub
r/enterprise_organization Status: Blocked Status: Triage Type: Bug
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Expected Behavior

I am attempting to create a new GitHub organization within a GitHub Enterprise Cloud environment where Enterprise Managed Users (EMU) is enabled, using the `github_enterprise_organization` resource.

Given that the PAT (classic) has `admin:org` and `admin:enterprise` scopes, I expected `terraform apply` to successfully create the new organization within the specified GitHub Enterprise (EMU) environment.

### Actual Behavior

The `terraform apply` command fails during the creation of the `github_enterprise_organization` resource with a 403 error related to SAML enforcement.

> Error: PATCH https://api.github.com/orgs/myorg784d0vmrzmku8sudwzpdavbwxuv: 403 Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization. []

Is there a known workaround for this specific 403 error when creating organizations via Terraform in an EMU environment using a PAT (classic)?

### Terraform Version

Terraform v1.11.3
on darwin_arm64
- provider registry.terraform.io/integrations/github v6.6.0

### Affected Resource(s)

- github_enterprise_organization

### Terraform Configuration Files

```hcl
terraform {
required_version = "1.11.3"

required_providers {
github = {
source = "integrations/github"
version = "6.6.0"
}
}

backend "local" {}
}

provider "github" {
owner = "xxx"
token = "ghp_xxx"
}

data "github_enterprise" "this" {
slug = "xxx"
}

resource "github_enterprise_organization" "this" {
enterprise_id = data.github_enterprise.this.id
name = "myorg784d0vmrzmku8sudwzpdavbwxuv"
display_name = "my org"
description = "my org"
billing_email = "admin@example.com"
admin_logins = ["admin_user"]
}
```

### Steps to Reproduce

```zsh
❯❯❯ terraform init & terraform apply
```

### Debug Output

```shell
❯❯❯ terraform apply
data.github_enterprise.this: Reading...
data.github_enterprise.this: Read complete after 1s [id=xxx] # Redacted

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# github_enterprise_organization.this will be created
+ resource "github_enterprise_organization" "this" {
+ admin_logins = [
+ "admin_user",
]
+ billing_email = "admin@example.com"
+ database_id = (known after apply)
+ description = "my org"
+ display_name = "my org"
+ enterprise_id = "xxx" # Redacted
+ id = (known after apply)
+ name = "myorg784d0vmrzmku8sudwzpdavbwxuv"
}

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

github_enterprise_organization.this: Creating...

│ Error: PATCH https://api.github.com/orgs/myorg784d0vmrzmku8sudwzpdavbwxuv: 403 Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization. []

│ with github_enterprise_organization.this,
│ on main.tf line 10, in resource "github_enterprise_organization" "this":
│ 10: resource "github_enterprise_organization" "this" {
```

### Panic Output

```shell

```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.