feat(fast/data-mongodb): add MongoDB Atlas database user resource

[suresharam]

Summary

Adds MongoDB Atlas database user support to the FAST data-mongodb project template.

The new database_user variable configures a mongodbatlas_database_user resource and exposes the configurable fields supported by the underlying provider resource, including authentication settings, roles, scopes, labels, and password handling.

Changes

• Add mongodbatlas_database_user to the data-mongodb template.
• Add a database_user input object with support for:
  • username
  • password
  • password_wo
  • password_wo_version
  • auth_database_name
  • aws_iam_type
  • ldap_auth_type
  • oidc_auth_type
  • x509_type
  • description
  • labels
  • roles
  • scopes
• Default database user role to readAnyDatabase on admin, preserving the template’s simple default behavior.
• Add validation to prevent setting both password and password_wo.
• Add validation requiring password_wo_version when password_wo is used.
• Update README examples and generated variable documentation.
• Bump the MongoDB Atlas provider constraint to ~> 2.17 so password_wo and password_wo_version are available.

Compatibility

Compared the MongoDB Atlas provider schema for the resources used by this template between 2.7.0 and 2.17.0. No arguments were removed and no new required arguments were added for the resources used here.

The relevant provider changes are additive. The main caveat is that password_wo requires Terraform 1.11+.

Validation

• terraform fmt -check fast/project-templates/data-mongodb
• python3 tools/check_documentation.py fast/project-templates/data-mongodb
• python3 tools/check_boilerplate.py --scan-files fast/project-templates/data-mongodb/main.tf fast/project-templates/data-mongodb/variables.tf fast/project-templates/data-mongodb/providers_override.tf fast/project-templates/data-mongodb/README.md
• terraform -chdir=fast/project-templates/data-mongodb validate

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

accidentally selected approve instead of request changes.

[github-actions]

Automated PR Review 🤖

(Reviewed commit: 8d32868)

Thank you for your contribution! This PR adds useful functionality to the MongoDB Atlas template.

I have reviewed the changes against the Cloud Foundation Fabric guidelines. Please address the following points:

1. PR Title

The current PR title uses Conventional Commits (feat(...)), which violates the repository guidelines.

"When naming your Pull Request, do not use Conventional Commits guidelines (e.g., do not use feat(net-vpc): add NCC support). Instead, use short, capitalized, imperative titles with no trailing dot..."

Please update the PR title to something like: Add MongoDB Atlas database user resource to fast/data-mongodb

2. Variable Design (Map vs Object)

Currently, database_user is defined as a single required object. This forces consumers of the template to create exactly one database user. To better support composition and real-world use cases where users might need zero, one, or multiple database users, please change this to a map of objects with a default of {}.

You can use the map key as the username to keep the variable space compact.

variables.tf

variable "database_users" {
  description = "MongoDB Atlas database users configuration."
  type = map(object({
    auth_database_name  = optional(string, "admin")
    aws_iam_type        = optional(string)
    description         = optional(string)
    labels              = optional(map(string), {})
    ldap_auth_type      = optional(string)
    oidc_auth_type      = optional(string)
    password            = optional(string)
    password_wo         = optional(string)
    password_wo_version = optional(number)
    roles = optional(
      map(object({
        collection_name = optional(string)
        database_name   = string
        role_name       = string
      })),
      {}
    )
    scopes = optional(map(object({
      type = string
    })), {})
    x509_type = optional(string)
  }))
  default = {}

  validation {
    condition = alltrue([
      for k, v in var.database_users : !(v.password != null && v.password_wo != null)
    ])
    error_message = "Only one of password or password_wo can be set."
  }

  validation {
    condition = alltrue([
      for k, v in var.database_users : v.password_wo == null || v.password_wo_version != null
    ])
    error_message = "password_wo_version must be set when password_wo is set."
  }
}

main.tf

resource "mongodbatlas_database_user" "database_user" {
  for_each            = var.database_users
  username            = each.key
  password            = each.value.password
  password_wo         = each.value.password_wo
  password_wo_version = each.value.password_wo_version
  project_id          = mongodbatlas_project.default.id
  auth_database_name  = each.value.auth_database_name
  aws_iam_type        = each.value.aws_iam_type
  description         = each.value.description
  ldap_auth_type      = each.value.ldap_auth_type
  oidc_auth_type      = each.value.oidc_auth_type
  x509_type           = each.value.x509_type

  dynamic "labels" {
    for_each = each.value.labels

    content {
      key   = labels.key
      value = labels.value
    }
  }

  dynamic "roles" {
    for_each = each.value.roles

    content {
      role_name       = roles.value.role_name
      database_name   = roles.value.database_name
      collection_name = roles.value.collection_name
    }
  }

  dynamic "scopes" {
    for_each = each.value.scopes

    content {
      name = scopes.key
      type = scopes.value.type
    }
  }
}

3. Documentation Updates

If you apply the changes above, please remember to:

• Update the example in README.md to use the new database_users map structure.
• Run uv run tools/tfdoc.py fast/project-templates/data-mongodb to regenerate the variables table.

Once these changes are applied, a maintainer will do the final review and approval.

Please address the comments in the automated review above