feat: add folder role assignment resource

docs/resources/authorization_folder_role_assignment.md

@@ -0,0 +1,43 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_authorization_folder_role_assignment Resource - stackit"
+subcategory: ""
+description: |-
+  folder Role Assignment resource schema.
+  ~> This resource is part of the iam experiment and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.
+---
+
+# stackit_authorization_folder_role_assignment (Resource)
+
+folder Role Assignment resource schema.
+
+~> This resource is part of the iam experiment and is likely going to undergo significant changes or be removed in the future. Use it at your own discretion.
+
+## Example Usage
+
+```terraform
+resource "stackit_authorization_folder_role_assignment" "example" {
+  resource_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  role        = "owner"
+  subject     = "john.doe@stackit.cloud"
+}
+
+# Only use the import statement, if you want to import an existing folder role assignment
+import {
+  to = stackit_authorization_folder_role_assignment.import-example
+  id = "${var.folder_id},${var.folder_role_assignment_role},${var.folder_role_assignment_subject}"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `resource_id` (String) folder Resource to assign the role to.
+- `role` (String) Role to be assigned
+- `subject` (String) Identifier of user, service account or client. Usually email address or name in case of clients
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource identifier. It is structured as "[resource_id],[role],[subject]".

examples/resources/stackit_authorization_folder_role_assignment/resource.tf

@@ -0,0 +1,11 @@
+resource "stackit_authorization_folder_role_assignment" "example" {
+  resource_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  role        = "owner"
+  subject     = "john.doe@stackit.cloud"
+}
+
+# Only use the import statement, if you want to import an existing folder role assignment
+import {
+  to = stackit_authorization_folder_role_assignment.import-example
+  id = "${var.folder_id},${var.folder_role_assignment_role},${var.folder_role_assignment_subject}"
+}

stackit/internal/services/authorization/authorization_acc_test.go

@@ -33,6 +33,9 @@ var invalidRole string
 //go:embed testfiles/organization-role.tf
 var organizationRole string
 
+//go:embed testfiles/folder-role.tf
+var folderRole string
+
 var testConfigVars = config.Variables{
 	"project_id":           config.StringVariable(testutil.ProjectId),
 	"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
@@ -73,6 +76,11 @@ func TestAccProjectRoleAssignmentResource(t *testing.T) {
 				ConfigVariables: testConfigVars,
 				Config:          testutil.AuthorizationProviderConfig() + prerequisites + organizationRole,
 			},
+			{
+				// Assign a resource to a folder
+				ConfigVariables: testConfigVars,
+				Config:          testutil.AuthorizationProviderConfig() + prerequisites + folderRole,
+			},
 			{
 				// The Service Account inherits owner permissions for the project from the organization. Check if you can still assign owner permissions on the project explicitly
 				ConfigVariables: testConfigVars,

stackit/internal/services/authorization/roleassignments/resource.go

@@ -30,6 +30,7 @@ import (
 var roleTargets = []string{
 	"project",
 	"organization",
+	"folder",
 }
 
 // Ensure the implementation satisfies the expected interfaces.

stackit/internal/services/authorization/testfiles/folder-role.tf

@@ -0,0 +1,6 @@
+
+resource "stackit_authorization_folder_role_assignment" "serviceaccount" {
+  resource_id = stackit_resourcemanager_folder.test.folder_id
+  role        = "owner"
+  subject     = var.test_service_account
+}

stackit/internal/services/authorization/testfiles/prerequisites.tf

@@ -8,3 +8,9 @@ resource "stackit_authorization_project_role_assignment" "serviceaccount" {
   role        = "reader"
   subject     = var.test_service_account
 }
+
+resource "stackit_resourcemanager_folder" "test" {
+  name                = "test"
+  owner_email         = "foo.bar@stackit.cloud"
+  parent_container_id = var.organization_id
+}