-
Notifications
You must be signed in to change notification settings - Fork 9.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
r/aws_cloudsearch_domain_service_access_policy: New resource.
- Loading branch information
Showing
6 changed files
with
279 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,7 @@ | ||
| ```release-note:new-resource | ||
| aws_cloudsearch_domain | ||
| ``` | ||
|
|
||
| ```release-note:new-resource | ||
| aws_cloudsearch_domain_service_access_policy | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
217 changes: 217 additions & 0 deletions
217
internal/service/cloudsearch/domain_service_access_policy.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,217 @@ | ||
| package cloudsearch | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "log" | ||
| "time" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws" | ||
| "github.com/aws/aws-sdk-go/service/cloudsearch" | ||
| "github.com/hashicorp/aws-sdk-go-base/tfawserr" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" | ||
| "github.com/hashicorp/terraform-provider-aws/internal/conns" | ||
| "github.com/hashicorp/terraform-provider-aws/internal/tfresource" | ||
| "github.com/hashicorp/terraform-provider-aws/internal/verify" | ||
| ) | ||
|
|
||
| func ResourceDomainServiceAccessPolicy() *schema.Resource { | ||
| return &schema.Resource{ | ||
| Create: resourceDomainServiceAccessPolicyPut, | ||
| Read: resourceDomainServiceAccessPolicyRead, | ||
| Update: resourceDomainServiceAccessPolicyPut, | ||
| Delete: resourceDomainServiceAccessPolicyDelete, | ||
| Importer: &schema.ResourceImporter{ | ||
| State: schema.ImportStatePassthrough, | ||
| }, | ||
|
|
||
| Schema: map[string]*schema.Schema{ | ||
| "access_policy": { | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| DiffSuppressFunc: verify.SuppressEquivalentPolicyDiffs, | ||
| ValidateFunc: validation.StringIsJSON, | ||
| StateFunc: func(v interface{}) string { | ||
| json, _ := structure.NormalizeJsonString(v) | ||
| return json | ||
| }, | ||
| }, | ||
| "domain_name": { | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func resourceDomainServiceAccessPolicyPut(d *schema.ResourceData, meta interface{}) error { | ||
| conn := meta.(*conns.AWSClient).CloudSearchConn | ||
|
|
||
| domainName := d.Get("domain_name").(string) | ||
| input := &cloudsearch.UpdateServiceAccessPoliciesInput{ | ||
| DomainName: aws.String(domainName), | ||
| } | ||
|
|
||
| accessPolicy := d.Get("access_policy").(string) | ||
| policy, err := structure.NormalizeJsonString(accessPolicy) | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("policy (%s) is invalid JSON: %w", accessPolicy, err) | ||
| } | ||
|
|
||
| input.AccessPolicies = aws.String(policy) | ||
|
|
||
| log.Printf("[DEBUG] Updating CloudSearch Domain access policies: %s", input) | ||
| _, err = conn.UpdateServiceAccessPolicies(input) | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("error creating CloudSearch Domain Service Access Policy (%s): %w", domainName, err) | ||
| } | ||
|
|
||
| d.SetId(domainName) | ||
|
|
||
| _, err = waitAccessPolicyActive(conn, d.Id()) | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("error waiting for CloudSearch Domain Service Access Policy (%s) to become active: %w", d.Id(), err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func resourceDomainServiceAccessPolicyRead(d *schema.ResourceData, meta interface{}) error { | ||
| conn := meta.(*conns.AWSClient).CloudSearchConn | ||
|
|
||
| accessPolicy, err := FindAccessPolicyByName(conn, d.Id()) | ||
|
|
||
| if !d.IsNewResource() && tfresource.NotFound(err) { | ||
| log.Printf("[WARN] CloudSearch Domain Service Access Policy (%s) not found, removing from state", d.Id()) | ||
| d.SetId("") | ||
| return nil | ||
| } | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("error reading CloudSearch Domain Service Access Policy (%s): %w", d.Id(), err) | ||
| } | ||
|
|
||
| policyToSet, err := verify.PolicyToSet(d.Get("access_policy").(string), accessPolicy) | ||
|
|
||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| d.Set("access_policy", policyToSet) | ||
| d.Set("domain_name", d.Id()) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func resourceDomainServiceAccessPolicyDelete(d *schema.ResourceData, meta interface{}) error { | ||
| conn := meta.(*conns.AWSClient).CloudSearchConn | ||
|
|
||
| domainName := d.Get("domain_name").(string) | ||
| input := &cloudsearch.UpdateServiceAccessPoliciesInput{ | ||
| AccessPolicies: aws.String(""), | ||
| DomainName: aws.String(d.Id()), | ||
| } | ||
|
|
||
| log.Printf("[DEBUG] Deleting CloudSearch Domain Service Access Policy: %s", d.Id()) | ||
| _, err := conn.UpdateServiceAccessPolicies(input) | ||
|
|
||
| if tfawserr.ErrCodeEquals(err, cloudsearch.ErrCodeResourceNotFoundException) { | ||
| return nil | ||
| } | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("error deleting CloudSearch Domain Service Access Policy (%s): %w", d.Id(), err) | ||
| } | ||
|
|
||
| _, err = waitAccessPolicyActive(conn, d.Id()) | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("error waiting for CloudSearch Domain Service Access Policy (%s) to delete: %w", d.Id(), err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func FindAccessPolicyByName(conn *cloudsearch.CloudSearch, name string) (string, error) { | ||
| output, err := findAccessPoliciesStatusByName(conn, name) | ||
|
|
||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| accessPolicy := aws.StringValue(output.Options) | ||
|
|
||
| if accessPolicy == "" { | ||
| return "", tfresource.NewEmptyResultError(name) | ||
| } | ||
|
|
||
| return accessPolicy, nil | ||
| } | ||
|
|
||
| func findAccessPoliciesStatusByName(conn *cloudsearch.CloudSearch, name string) (*cloudsearch.AccessPoliciesStatus, error) { | ||
| input := &cloudsearch.DescribeServiceAccessPoliciesInput{ | ||
| Deployed: aws.Bool(true), | ||
| DomainName: aws.String(name), | ||
| } | ||
|
|
||
| output, err := conn.DescribeServiceAccessPolicies(input) | ||
|
|
||
| if tfawserr.ErrCodeEquals(err, cloudsearch.ErrCodeResourceNotFoundException) { | ||
| return nil, &resource.NotFoundError{ | ||
| LastError: err, | ||
| LastRequest: input, | ||
| } | ||
| } | ||
|
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if output == nil || output.AccessPolicies == nil || output.AccessPolicies.Status == nil { | ||
| return nil, tfresource.NewEmptyResultError(input) | ||
| } | ||
|
|
||
| return output.AccessPolicies, nil | ||
| } | ||
|
|
||
| func statusAccessPolicyState(conn *cloudsearch.CloudSearch, name string) resource.StateRefreshFunc { | ||
| return func() (interface{}, string, error) { | ||
| output, err := findAccessPoliciesStatusByName(conn, name) | ||
|
|
||
| if tfresource.NotFound(err) { | ||
| return nil, "", nil | ||
| } | ||
|
|
||
| if err != nil { | ||
| return nil, "", err | ||
| } | ||
|
|
||
| return output, aws.StringValue(output.Status.State), nil | ||
| } | ||
| } | ||
|
|
||
| const ( | ||
| accessPolicyTimeout = 2 * time.Minute | ||
| ) | ||
|
|
||
| func waitAccessPolicyActive(conn *cloudsearch.CloudSearch, name string) (*cloudsearch.AccessPoliciesStatus, error) { | ||
| stateConf := &resource.StateChangeConf{ | ||
| Pending: []string{cloudsearch.OptionStateProcessing}, | ||
| Target: []string{cloudsearch.OptionStateActive}, | ||
| Refresh: statusAccessPolicyState(conn, name), | ||
| Timeout: accessPolicyTimeout, | ||
| } | ||
|
|
||
| outputRaw, err := stateConf.WaitForState() | ||
|
|
||
| if output, ok := outputRaw.(*cloudsearch.AccessPoliciesStatus); ok { | ||
| return output, err | ||
| } | ||
|
|
||
| return nil, err | ||
| } |
1 change: 1 addition & 0 deletions
1
internal/service/cloudsearch/domain_service_access_policy_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| package cloudsearch_test |
55 changes: 55 additions & 0 deletions
55
website/docs/r/cloudsearch_domain_service_access_policy.html.markdown
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| --- | ||
| subcategory: "CloudSearch" | ||
| layout: "aws" | ||
| page_title: "AWS: aws_cloudsearch_domain_service_access_policy" | ||
| description: |- | ||
| Provides an CloudSearch domain service access policy resource. | ||
| --- | ||
|
|
||
| # Resource: aws_cloudsearch_domain_service_access_policy | ||
|
|
||
| Provides an CloudSearch domain service access policy resource. | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| resource "aws_cloudsearch_domain" "example" { | ||
| name = "example-domain" | ||
| } | ||
| resource "aws_cloudsearch_domain_service_access_policy" "example" { | ||
| domain_name = aws_cloudsearch_domain.example.id | ||
| policy = <<POLICY | ||
| { | ||
| "Version":"2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": ["cloudsearch:search"], | ||
| "Resource": "${aws_cloudsearch_domain.example.arn}/movies" | ||
| } | ||
| ] | ||
| } | ||
| POLICY | ||
| } | ||
| ``` | ||
|
|
||
| ## Argument Reference | ||
|
|
||
| The following arguments are supported: | ||
|
|
||
| * `access_policy` - (Required) The access rules you want to configure. These rules replace any existing rules. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html) for details. | ||
| * `domain_name` - (Required) The CloudSearch domain name the policy applies to. | ||
|
|
||
| ## Attributes Reference | ||
|
|
||
| No additional attributes are exported. | ||
|
|
||
| ## Import | ||
|
|
||
| CloudSearch domain service access policies can be imported using the domain name, e.g., | ||
|
|
||
| ``` | ||
| $ terraform import aws_cloudsearch_domain_service_access_policy.example example-domain | ||
| ``` |