fix: address PR review feedback and CI failures

- Domain: add Computed+ForceNew to domain_id and parent_domain_id to
  fix perpetual diffs causing 19 acceptance test failures
- Account: remove unnecessary ForceNew from email/first_name/last_name/
  password; implement user-level updates via updateUser API; add
  Sensitive to password field
- Disk offering: mark disk_size as ForceNew since updateDiskOffering
  does not support size changes
- User: mark account and username as ForceNew to prevent silent drift;
  add Sensitive to password; wrap Update error with resource context
- Remove tests/ directory (manual TF configs, not Go acceptance tests)
  which also fixes Apache RAT check failures from missing headers

Author: atlas-cloud-agent[bot]

cloudstack/resource_cloudstack_account.go

@@ -37,22 +37,19 @@ func resourceCloudStackAccount() *schema.Resource {
 			"email": {
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"first_name": {
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"last_name": {
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			"password": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:      schema.TypeString,
+				Required:  true,
+				Sensitive: true,
 			},
 			"username": {
 				Type:     schema.TypeString,
@@ -159,22 +156,59 @@ func resourceCloudStackAccountUpdate(d *schema.ResourceData, meta interface{}) e
 
 	log.Printf("[DEBUG] Updating Account %s", d.Id())
 
-	p := cs.Account.NewUpdateAccountParams()
-	p.SetId(d.Id())
-
-	if d.HasChange("role_id") {
-		p.SetRoleid(d.Get("role_id").(string))
-	}
-	if d.HasChange("account") {
-		p.SetNewname(d.Get("account").(string))
-	}
-	if d.HasChange("domain_id") {
-		p.SetDomainid(d.Get("domain_id").(string))
+	// Handle account-level changes
+	if d.HasChange("role_id") || d.HasChange("account") || d.HasChange("domain_id") {
+		p := cs.Account.NewUpdateAccountParams()
+		p.SetId(d.Id())
+
+		if d.HasChange("role_id") {
+			p.SetRoleid(d.Get("role_id").(string))
+		}
+		if d.HasChange("account") {
+			p.SetNewname(d.Get("account").(string))
+		}
+		if d.HasChange("domain_id") {
+			p.SetDomainid(d.Get("domain_id").(string))
+		}
+
+		_, err := cs.Account.UpdateAccount(p)
+		if err != nil {
+			return fmt.Errorf("Error updating Account %s: %s", d.Id(), err)
+		}
 	}
 
-	_, err := cs.Account.UpdateAccount(p)
-	if err != nil {
-		return fmt.Errorf("Error updating Account %s: %s", d.Id(), err)
+	// Handle user-level changes via updateUser API
+	if d.HasChange("email") || d.HasChange("first_name") || d.HasChange("last_name") || d.HasChange("password") {
+		lp := cs.Account.NewListAccountsParams()
+		lp.SetId(d.Id())
+		accounts, err := cs.Account.ListAccounts(lp)
+		if err != nil {
+			return fmt.Errorf("Error retrieving Account %s for user update: %s", d.Id(), err)
+		}
+		if accounts.Count == 0 || len(accounts.Accounts[0].User) == 0 {
+			return fmt.Errorf("Account %s has no users to update", d.Id())
+		}
+
+		userID := accounts.Accounts[0].User[0].Id
+		up := cs.User.NewUpdateUserParams(userID)
+
+		if d.HasChange("email") {
+			up.SetEmail(d.Get("email").(string))
+		}
+		if d.HasChange("first_name") {
+			up.SetFirstname(d.Get("first_name").(string))
+		}
+		if d.HasChange("last_name") {
+			up.SetLastname(d.Get("last_name").(string))
+		}
+		if d.HasChange("password") {
+			up.SetPassword(d.Get("password").(string))
+		}
+
+		_, err = cs.User.UpdateUser(up)
+		if err != nil {
+			return fmt.Errorf("Error updating user for Account %s: %s", d.Id(), err)
+		}
 	}
 
 	log.Printf("[DEBUG] Account %s successfully updated", d.Id())

cloudstack/resource_cloudstack_disk_offering.go

@@ -45,6 +45,7 @@ func resourceCloudStackDiskOffering() *schema.Resource {
 			"disk_size": {
 				Type:     schema.TypeInt,
 				Required: true,
+				ForceNew: true,
 			},
 		},
 	}

cloudstack/resource_cloudstack_domain.go

@@ -41,6 +41,8 @@ func resourceCloudStackDomain() *schema.Resource {
 			"domain_id": {
 				Type:     schema.TypeString,
 				Optional: true,
+				Computed: true,
+				ForceNew: true,
 			},
 			"network_domain": {
 				Type:     schema.TypeString,
@@ -49,6 +51,8 @@ func resourceCloudStackDomain() *schema.Resource {
 			"parent_domain_id": {
 				Type:     schema.TypeString,
 				Optional: true,
+				Computed: true,
+				ForceNew: true,
 			},
 		},
 	}

cloudstack/resource_cloudstack_user.go

@@ -37,6 +37,7 @@ func resourceCloudStackUser() *schema.Resource {
 			"account": {
 				Type:     schema.TypeString,
 				Optional: true,
+				ForceNew: true,
 			},
 			"email": {
 				Type:     schema.TypeString,
@@ -51,12 +52,14 @@ func resourceCloudStackUser() *schema.Resource {
 				Required: true,
 			},
 			"password": {
-				Type:     schema.TypeString,
-				Required: true,
+				Type:      schema.TypeString,
+				Required:  true,
+				Sensitive: true,
 			},
 			"username": {
 				Type:     schema.TypeString,
 				Required: true,
+				ForceNew: true,
 			},
 		},
 	}
@@ -107,7 +110,7 @@ func resourceCloudStackUserUpdate(d *schema.ResourceData, meta interface{}) erro
 
 	_, err := cs.User.UpdateUser(p)
 	if err != nil {
-		return err
+		return fmt.Errorf("Error updating User %s: %s", d.Id(), err)
 	}
 
 	return resourceCloudStackUserRead(d, meta)