Implicit dependancy missing from role membership

[sophie-warner-annalise-ai]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this provider and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

If you create a user, org member, and org member role; the provider tries to create the org member role before the org membership resulting in failure.

Workarounds:

• Running apply twice
• Use the depends_on meta-argument.

Expectation

The provider creates org members before it creates org member roles. This would prevent.

Error: 404 Not Found: User is not a member of this organization

Reproduction

variable "static_users" {
  type = list(object({
    email = string
    org   = string
    role  = string
    store_creds_in = object({
      github = optional(object({
        env = object({
          repo = string
          name = string
        })
      }))
    })
  }))
  default = []
}

resource "auth0_user" "static_user" {
  for_each = { for u in var.static_users : u.email => u }
  ...
}

resource "auth0_organization_member" "static_user" {
  for_each        = { for u in var.static_users : u.email => u }
  organization_id = auth0_organization.this[each.value.org].id
  user_id         = auth0_user.static_user[each.value.email].id
}

resource "auth0_organization_member_role" "static_user" {
  for_each        = { for u in var.static_users : u.email => u }
  organization_id = auth0_organization.this[each.value.org].id
  user_id         = auth0_user.static_user[each.value.email].id
  role_id         = auth0_role.roles[each.value.role].id
}

Auth0 Terraform Provider version

1.35.0

Terraform version

OpenTofu v1.11.0-rc1

[duedares-rvj]

Hello @sophie-warner-annalise-ai
This might be same as #1007

Please consider using depends_on or a sleep timer resource.
Thanks.

[sophie-warner-annalise-ai]

I have done so but just raising this as an issue

[duedares-rvj]

@sophie-warner-annalise-ai That makes sense. For #1007, we reached out to the API team to better understand the root cause, and here’s what they shared:

This seems to be because POST /api/v2/organizations/{id}/members reads users from Mongo (the source of truth), whereas GET /api/v2/organizations/{id}/members retrieves users from the user search indexer, which has a small indexing delay

Since these are two separate Terraform resources, we unfortunately can’t add an explicit wait or delay between them. The only thing we could theoretically do is introduce a sleep before returning the auth0_user response, but that wouldn’t be ideal. In this case, depends_on is clearly the more reliable and intentional solution.

The API team also mentioned that they don’t currently have plans to optimize this behaviour in the near future.
With that in mind, I’d recommend continuing to use depends_on - it’s the most consistent approach given the API’s current design.
Thank you again for raising this so thoughtfully!

[duedares-rvj]

@sophie-warner-annalise-ai Hey again.
I sense your dissatisfaction with the reaction on my last response.

To ensure this doesn't get slipped off under the rug, I'm moving this under Discussions; so that we can revisit this at a later point in time - most probably during the next major release or if there's an update introduced on the API that handles this behaviour.
Kind of feedback that helps us improve the provider.

Regards.