add new test for restricted permission

datadog/resource_datadog_role.go

@@ -145,7 +145,7 @@ func resourceDatadogRoleCustomizeDiff(ctx context.Context, diff *schema.Resource
 
 		if permAttributes.IsDefaultPermission && !defaultPermissionsOptOut.(bool) {
 			return fmt.Errorf(
-				"permission with ID %s is a restricted (default) permission and cannot be managed by terraform, set `default_permissions_opt_out` to `true` to manage default permissions, or remove it from your configuration",
+				"permission with ID %s is a restricted (default) permission and cannot be managed by terraform, remove it from your configuration",
 				permID,
 			)
 		}

datadog/tests/cassettes/TestAccDatadogRole_InvalidPerm.freeze

@@ -1 +1 @@
-2022-07-26T10:43:12.182854-04:00
+2025-01-02T11:18:48.106262-05:00

datadog/tests/resource_datadog_role_test.go

@@ -111,9 +111,13 @@ func TestAccDatadogRole_InvalidPerm(t *testing.T) {
 		ProviderFactories: accProviders,
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccCheckDatadogRoleConfigInvalidPerm(rolename),
+				Config:      testAccCheckDatadogRoleConfigInvalidNonexistentPerm(rolename),
 				ExpectError: regexp.MustCompile("permission with ID .* does not exist"),
 			},
+			{
+				Config:      testAccCheckDatadogRoleConfigInvalidRestrictedPerm(rolename),
+				ExpectError: regexp.MustCompile("permission with ID .* is a restricted"),
+			},
 		},
 	})
 }
@@ -241,7 +245,7 @@ resource "datadog_role" "foo" {
 }`, uniq)
 }
 
-func testAccCheckDatadogRoleConfigInvalidPerm(uniq string) string {
+func testAccCheckDatadogRoleConfigInvalidNonexistentPerm(uniq string) string {
 	return fmt.Sprintf(`
 resource "datadog_role" "foo" {
   name      = "%sinvalid"
@@ -250,3 +254,17 @@ resource "datadog_role" "foo" {
   }
 }`, uniq)
 }
+
+func testAccCheckDatadogRoleConfigInvalidRestrictedPerm(uniq string) string {
+	return fmt.Sprintf(`
+data "datadog_permissions" foo {
+  include_restricted = true
+}
+
+resource "datadog_role" "foo" {
+  name      = "%s invalid restricted"
+  permission {
+    id = "${data.datadog_permissions.foo.permissions.dashboards_read}"
+  }
+}`, uniq)
+}