gitlab_tag_protection resource is missing deploy_key_id property for the option allowed_to_create

Bug Report

When adding a protected tag, the Gitlab API allows you to give a Deploy Key create privileges for the protected tag. However the gitlab_tag_protection resource does not have this feature.

Relevant Terraform Configuration

resource "gitlab_tag_protection" "some_tag" {
  project = "<some-project-id>"
  tag     = "<some-tag-name>"
  allowed_to_create {
    deploy_key_id = 472192738 # Error: Unsupported argument
  }
}

Relevant Terraform Command

terraform plan

Additional Details

The gitlab_branch_protection resource correctly provides similar functionality using the allowed_to_push option. I guess the missing code for gitlab_tag_protection will be very similar to that in gitlab_branch_protection.

Implementation Guide

  • Read the CONTRIBUTING.md guide for setting up your local development environment and clone the community fork of this project.
  • In internal/provider/resource_gitlab_protected_tag.go, add a new attribute to the allowed_to_create block in the Schema. This will be called deploy_key_id and have the same settings as user_id other than the description.
  • Amend the validation rules for allowed_to_create.access_level so the ExactlyOneOf rule also includes an entry to deploy_key_id.
  • Add DeployKeyID to the gitlabTagProtectionAllowedToObjectModel struct in the same style as UserID.
  • In the Create function, add an if block to the AllowedToCreate loop for DeployKeyID to add the value to allowedToTagsPermissionOptionData if present.
  • In the populateTagAllowedToObjectList function, add an if block to set DeployKeyID in allowedToData if it has a value.
  • In internal/provider/resource_gitlab_protected_tag_test.go, add tests for creating and updating the resource with deploy_key_id, and checking the validation if it is set alongside one of the fields it conflicts with.
  • Run make reviewable before raising a merge request.
Edited Jan 24, 2026 by 🤖 GitLab Bot 🤖
Assignee Loading
Time tracking Loading