Onboard logs service access token by GokceGK · Pull Request #1165 · stackitcloud/terraform-provider-stackit

GokceGK · 2026-01-28T18:19:43Z

Description

relates to STACKITTPR-449

Checklist

Issue was linked above
Code format was applied: make fmt
Examples were added / adjusted (see examples/ directory)
Docs are up-to-date: make generate-docs (will be checked by CI)
Unit tests got implemented or updated
Acceptance tests got implemented or updated (see e.g. here)
Unit tests are passing: make test (will be checked by CI)
No linter issues: make lint (will be checked by CI)

…-token' into feat/onboard-logs-service-access-token

examples/resources/stackit_logs_access_token/resource.tf

marceljk · 2026-02-04T12:18:44Z

stackit/internal/services/logs/accesstoken/datasource.go

+		var oapiErr *oapierror.GenericOpenAPIError
+		ok := errors.As(err, &oapiErr)
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		core.LogAndAddError(ctx, &resp.Diagnostics, "Error reading Logs access token", fmt.Sprintf("Calling API: %v", err))
+		return


You can adjust the error handling in datasources like here:

terraform-provider-stackit/stackit/internal/services/iaas/network/datasource.go

Lines 220 to 231 in 53a3697

if err != nil {

utils.LogError(

ctx,

&resp.Diagnostics,

err,

"Reading network",

fmt.Sprintf("Network with ID %q does not exist in project %q.", networkId, projectId),

map[int]string{

http.StatusForbidden: fmt.Sprintf("Project with ID %q not found or forbidden access", projectId),

},

)

resp.State.RemoveResource(ctx)

This makes it easier to handle different kinds of error, like for example 403

stackit/internal/services/logs/accesstoken/resource.go

marceljk · 2026-02-04T13:24:14Z

stackit/internal/services/logs/accesstoken/resource.go

+
+	instanceId := model.InstanceID.ValueString()
+	projectId := model.ProjectID.ValueString()
+	region := model.Region.ValueString()


you don't need to read the region directly, you can just use the GetRegionWithOverride function

Suggested change

region := model.Region.ValueString()

region := r.providerData.GetRegionWithOverride(model.Region)

and remove the second call to this function, which is before the call to CreateAccessToken()

stackit/internal/services/logs/accesstoken/resource.go

stackit/internal/services/logs/logs_acc_test.go

marceljk · 2026-02-04T15:10:10Z

stackit/internal/services/logs/logs_acc_test.go

+						"stackit_logs_instance.logs", "instance_id",
+					),
+					resource.TestCheckResourceAttr("stackit_logs_access_token.accessToken", "display_name", testutil.ConvertConfigVariable(testConfigAccessTokenVarsMin["display_name"])),
+					resource.TestCheckResourceAttr("stackit_logs_access_token.accessToken", "permissions.0", testutil.ConvertConfigVariable(testConfigAccessTokenVarsMin["permissions"])),


some attribute checks are missing here like: "creator", "expires", "id", "status", "valid_until".
For most of them it's enough if you check if they are just set, because you may don't know the value they will have. Except expires, there you should know if it's false or true and same for status, there it will be probably always "active"

I am only not sure about the valid_until field as it is not required field, it might be also nil.

Didn't tested it yet, but I assume that valid_until is set when expires is true and is not set when expires is false.

github-actions · 2026-02-04T17:18:25Z

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/stackitcloud/terraform-provider-stackit/stackit	1.48% (ø)
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs	0.00% (ø)
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/accesstoken	24.73% (+24.73%)	🌟

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/accesstoken/datasource.go	37.14% (+37.14%)	70 (+70)	26 (+26)	44 (+44)	🌟
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/accesstoken/resource.go	20.49% (+20.49%)	205 (+205)	42 (+42)	163 (+163)	🌟
github.com/stackitcloud/terraform-provider-stackit/stackit/provider.go	1.48% (ø)	135	2	133

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/accesstoken/datasource_test.go
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/accesstoken/resource_test.go
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/logs/logs_acc_test.go

marceljk · 2026-02-05T08:03:46Z

stackit/internal/services/logs/accesstoken/datasource.go

+			&resp.Diagnostics,
+			err,
+			"Reading Logs access token",
+			fmt.Sprintf("Calling API: %v", err),


This is the default error message and will mostly be a 404.
So the message should be something like "Access token with ID $q does not exist in project %q"

marceljk · 2026-02-05T08:13:48Z

stackit/internal/services/logs/accesstoken/resource.go

-		var oapiErr *oapierror.GenericOpenAPIError
-		ok := errors.As(err, &oapiErr)
-		if ok && oapiErr.StatusCode == http.StatusNotFound {
-			resp.State.RemoveResource(ctx)
-			return
-		}
-		core.LogAndAddError(ctx, &resp.Diagnostics, "Error reading Logs access token", fmt.Sprintf("Calling API: %v", err))
+		tfutils.LogError(
+			ctx,
+			&resp.Diagnostics,
+			err,
+			"Reading Logs access token",
+			fmt.Sprintf("Calling API: %v", err),
+			map[int]string{
+				http.StatusForbidden: fmt.Sprintf("Project with ID %q not found or forbidden access", projectID),
+			},
+		)
+		resp.State.RemoveResource(ctx)


Can you revert this change? The error logging with the LogError function should only be used in the datasource, because in the datasource we don't care about the exact status code and remove there always the resource from the state. There we can easily "restore" the state by running again $ terraform apply.
But in the resource we should remove the resource from the state only when we get a 404. So we need to explicit check here, which status code was sent.

marceljk · 2026-02-05T08:23:03Z

stackit/internal/services/logs/logs_acc_test.go

 					resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "expires"),
 					resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "status"),


The value of these two attributes can be checked as well. They should have the same value like in the resource

Suggested change

resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "expires"),

resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "status"),

resource.TestCheckResourceAttr("data.stackit_logs_access_token.accessToken", "expires", testutil.ConvertConfigVariable(testConfigAccessTokenVarsMin["expires"])),

resource.TestCheckResourceAttr("data.stackit_logs_access_token.accessToken", "status", testutil.ConvertConfigVariable(testConfigAccessTokenVarsMin["status"])),

marceljk · 2026-02-05T08:56:31Z

stackit/internal/services/logs/accesstoken/resource.go

+			"permissions": schema.ListAttribute{
+				Description: schemaDescriptions["permissions"],
+				ElementType: types.StringType,
+				Required:    true,


optional: you can add here a validator to check if the size of the list is always at least 1. Because when it's an empty list, the api throws an error

GokceGK added 2 commits January 28, 2026 18:31

onboard logs access token resource

3d9afb3

fixes in acceptance test

d7ab784

GokceGK requested a review from a team as a code owner January 28, 2026 18:19

GokceGK marked this pull request as draft January 28, 2026 18:19

GokceGK and others added 6 commits January 28, 2026 19:23

use correct config variable in test

16d90a8

Merge branch 'main' into feat/onboard-logs-service-access-token

6cf661c

remove access-token field

c20bf7c

Merge remote-tracking branch 'origin/feat/onboard-logs-service-access…

dc65f21

…-token' into feat/onboard-logs-service-access-token

Merge branch 'main' into feat/onboard-logs-service-access-token

c038e75

separate model for resource and datasource

49b7140

marceljk reviewed Feb 2, 2026

View reviewed changes

examples/resources/stackit_logs_access_token/resource.tf Outdated Show resolved Hide resolved

GokceGK and others added 3 commits February 4, 2026 10:58

ignore lifetime field in acceptance test import section

4bca0a8

add info about the lifetime field in examples

7621fa3

Merge branch 'main' into feat/onboard-logs-service-access-token

ce7e17b

GokceGK marked this pull request as ready for review February 4, 2026 11:11

marceljk reviewed Feb 4, 2026

View reviewed changes

stackit/internal/services/logs/logs_acc_test.go Show resolved Hide resolved

marceljk reviewed Feb 4, 2026

View reviewed changes

GokceGK and others added 2 commits February 4, 2026 17:02

Merge branch 'main' into feat/onboard-logs-service-access-token

f5e095c

review changes

f84f38d

marceljk reviewed Feb 5, 2026

View reviewed changes

	if err != nil {
	utils.LogError(
	ctx,
	&resp.Diagnostics,
	err,
	"Reading network",
	fmt.Sprintf("Network with ID %q does not exist in project %q.", networkId, projectId),
	map[int]string{
	http.StatusForbidden: fmt.Sprintf("Project with ID %q not found or forbidden access", projectId),
	},
	)
	resp.State.RemoveResource(ctx)

	region := model.Region.ValueString()
	region := r.providerData.GetRegionWithOverride(model.Region)

		resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "expires"),
		resource.TestCheckResourceAttrSet("data.stackit_logs_access_token.accessToken", "status"),

Conversation

GokceGK commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 4, 2026

Merging this branch will increase overall coverage

Changed files (no unit tests)

Changed unit test files

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

GokceGK commented Jan 28, 2026 •

edited

Loading