Skip to content

Commit

Permalink
Add lf_tag_policy resource
Browse files Browse the repository at this point in the history
  • Loading branch information
@danielcmessias
danielcmessias committed Aug 4, 2021
1 parent 924eb29 commit 75d7bc5
Show file tree
Hide file tree
Showing 7 changed files with 596 additions and 38 deletions.
71 changes: 63 additions & 8 deletions aws/data_source_aws_lakeformation_permissions.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,14 +90,6 @@ func dataSourceAwsLakeFormationPermissions() *schema.Resource {
Optional: true,
Computed: true,
MaxItems: 1,
ExactlyOneOf: []string{
"catalog_resource",
"data_location",
"database",
"table",
"table_with_columns",
"lf_tag",
},
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"key": {
Expand All @@ -124,6 +116,53 @@ func dataSourceAwsLakeFormationPermissions() *schema.Resource {
},
},
},
"lf_tag_policy": {
Type: schema.TypeList,
Optional: true,
Computed: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"catalog_id": {
Type: schema.TypeString,
Optional: true,
Computed: true,
ValidateFunc: validateAwsAccountId,
},
"expression": {
Type: schema.TypeList,
Required: true,
MinItems: 1,
MaxItems: 5,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"key": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringLenBetween(1, 128),
},
"values": {
Type: schema.TypeSet,
Required: true,
MinItems: 1,
MaxItems: 15,
Elem: &schema.Schema{
Type: schema.TypeString,
ValidateFunc: validateLFTagValues(),
},
Set: schema.HashString,
},
},
},
},
"resource_type": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice(lakeformation.ResourceType_Values(), false),
},
},
},
},
"principal": {
Type: schema.TypeString,
Required: true,
Expand Down Expand Up @@ -237,6 +276,10 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
input.Resource.LFTag = expandLakeFormationLFTagKeyResource(v.([]interface{})[0].(map[string]interface{}))
}

if v, ok := d.GetOk("lf_tag_policy"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
input.Resource.LFTagPolicy = expandLakeFormationLFTagPolicyResource(v.([]interface{})[0].(map[string]interface{}))
}

tableType := ""

if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
Expand Down Expand Up @@ -311,6 +354,10 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
cleanPermissions = filterLakeFormationLFTagPermissions(allPermissions)
}

if input.Resource.LFTagPolicy != nil {
cleanPermissions = filterLakeFormationLFTagPolicyPermissions(allPermissions)
}

if tableType == TableTypeTable {
cleanPermissions = filterLakeFormationTablePermissions(
aws.StringValue(input.Resource.Table.Name),
Expand Down Expand Up @@ -365,6 +412,14 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
d.Set("lf_tag", nil)
}

if cleanPermissions[0].Resource.LFTagPolicy != nil {
if err := d.Set("lf_tag_policy", []interface{}{flattenLakeFormationLFTagPolicyResource(cleanPermissions[0].Resource.LFTagPolicy)}); err != nil {
return fmt.Errorf("error setting LF-tag policy: %w", err)
}
} else {
d.Set("lf_tag_policy", nil)
}

tableSet := false

if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 {
Expand Down
106 changes: 106 additions & 0 deletions aws/data_source_aws_lakeformation_permissions_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,38 @@ func testAccAWSLakeFormationPermissionsDataSource_lf_tag(t *testing.T) {
})
}

func testAccAWSLakeFormationPermissionsDataSource_lf_tag_policy(t *testing.T) {
rName := acctest.RandomWithPrefix("tf-acc-test")
resourceName := "aws_lakeformation_permissions.test"
dataSourceName := "data.aws_lakeformation_permissions.test"

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t); testAccPartitionHasServicePreCheck(lakeformation.EndpointsID, t) },
ErrorCheck: testAccErrorCheck(t, lakeformation.EndpointsID),
Providers: testAccProviders,
CheckDestroy: testAccCheckAWSLakeFormationPermissionsDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSLakeFormationPermissionsDataSourceConfig_lf_tag_policy(rName),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttrPair(resourceName, "principal", dataSourceName, "principal"),
resource.TestCheckResourceAttrPair(resourceName, "lf_tag_policy.#", dataSourceName, "lf_tag_policy.#"),
resource.TestCheckResourceAttrPair(resourceName, "lf_tag_policy.0.resource_type", dataSourceName, "lf_tag_policy.0.resource_type"),
resource.TestCheckResourceAttrPair(resourceName, "lf_tag_policy.0.expression.#", dataSourceName, "lf_tag_policy.0.expression.#"),
resource.TestCheckResourceAttrPair(resourceName, "lf_tag_policy.0.expression.0.key", dataSourceName, "lf_tag_policy.0.expression.0.key"),
resource.TestCheckResourceAttrPair(resourceName, "lf_tag_policy.0.expression.0.values", dataSourceName, "lf_tag_policy.0.expression.0.values"),
resource.TestCheckResourceAttrPair(resourceName, "permissions.#", dataSourceName, "permissions.#"),
resource.TestCheckResourceAttrPair(resourceName, "permissions.0", dataSourceName, "permissions.0"),
resource.TestCheckResourceAttrPair(resourceName, "permissions.1", dataSourceName, "permissions.1"),
resource.TestCheckResourceAttrPair(resourceName, "permissions.2", dataSourceName, "permissions.2"),
resource.TestCheckResourceAttrPair(resourceName, "permissions_with_grant_option.#", dataSourceName, "permissions_with_grant_option.#"),
resource.TestCheckResourceAttrPair(resourceName, "permissions_with_grant_option.0", dataSourceName, "permissions_with_grant_option.0"),
),
},
},
})
}

func testAccAWSLakeFormationPermissionsDataSource_table(t *testing.T) {
rName := acctest.RandomWithPrefix("tf-acc-test")
resourceName := "aws_lakeformation_permissions.test"
Expand Down Expand Up @@ -407,6 +439,80 @@ data "aws_lakeformation_permissions" "test" {
`, rName)
}

func testAccAWSLakeFormationPermissionsDataSourceConfig_lf_tag_policy(rName string) string {
return fmt.Sprintf(`
data "aws_partition" "current" {}
resource "aws_iam_role" "test" {
name = %[1]q
path = "/"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "glue.${data.aws_partition.current.dns_suffix}"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}
data "aws_caller_identity" "current" {}
resource "aws_lakeformation_data_lake_settings" "test" {
admins = [data.aws_caller_identity.current.arn]
}
resource "aws_lakeformation_lf_tag" "test" {
key = %[1]q
values = ["value1", "value2"]
# for consistency, ensure that admins are setup before testing
depends_on = [aws_lakeformation_data_lake_settings.test]
}
resource "aws_lakeformation_permissions" "test" {
permissions = ["ALTER", "CREATE_TABLE", "DROP"]
permissions_with_grant_option = ["CREATE_TABLE"]
principal = aws_iam_role.test.arn
lf_tag_policy {
resource_type = "DATABASE"
expression {
key = aws_lakeformation_lf_tag.test.key
values = aws_lakeformation_lf_tag.test.values
}
}
# for consistency, ensure that admins are setup before testing
depends_on = [
aws_lakeformation_data_lake_settings.test,
aws_lakeformation_lf_tag.test,
]
}
data "aws_lakeformation_permissions" "test" {
principal = aws_lakeformation_permissions.test.principal
lf_tag_policy {
resource_type = "DATABASE"
expression {
key = aws_lakeformation_lf_tag.test.key
values = aws_lakeformation_lf_tag.test.values
}
}
}
`, rName)
}

func testAccAWSLakeFormationPermissionsDataSourceConfig_table(rName string) string {
return fmt.Sprintf(`
data "aws_partition" "current" {}
Expand Down
Loading

0 comments on commit 75d7bc5

Please sign in to comment.