Adds support for AMI sharing to Orgs and OUs

[joraff]

This PR adds two new arguments to the aws_ami_launch_permission resource to allow for Organization and OrganizationalUnit sharing.

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #21617.
Closes #11101.

Output from acceptance testing:

$ make testacc TESTARGS='-run TestAccEC2AMILaunchPermission_organization' PKG_NAME=internal/service/ec2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20  -run TestAccEC2AMILaunchPermission_organization -timeout 180m
=== RUN   TestAccEC2AMILaunchPermission_organization
=== PAUSE TestAccEC2AMILaunchPermission_organization
=== CONT  TestAccEC2AMILaunchPermission_organization
2022/04/06 23:24:53 Waiting for AMI ami-0dddfaa907ae8da63 to become available...
2022/04/06 23:30:23 Waiting for AMI ami-0dddfaa907ae8da63 to be deleted...
--- PASS: TestAccEC2AMILaunchPermission_organization (344.49s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        346.991s

[joraff]

You will need to use an AWS account that's linked to an AWS Organization to be able to use the Organization's ARN as a data source. What should the default behavior be if the testing account is not in an Organization?

[github-actions]

Welcome @joraff 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[joraff]

Regarding default behavior if the testing account is not in an org, I found the PreCheck to handle this behavior.

[mattrobinsonsre]

Could this be added to the imagebuilder as well? It's in the api.

[dmccaffery]

I'm not a fan of the "arn_type" property -- the underlying API is strongly-typed with UserId, Group, OrganizationalUnitArn, or OrganizationArn. I think it makes more sense to have:

organization_unit_arn string
organization_arn string

This makes the api more self-documenting and aligns with the other SDKs around this resource. It also reduces the need to lookup a case-sensitive string in the docs.

Here are the docs for the launch permission:
https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_LaunchPermission.html

[joraff]

I agree with the use of distinct, strongly-types arguments as suggested above, and have implemented the changes. Tests and website docs have been added.

$ make testacc TESTARGS='-run TestAccEC2AMILaunchPermission_organization' PKG_NAME=internal/service/ec2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20  -run TestAccEC2AMILaunchPermission_organization -timeout 180m
=== RUN   TestAccEC2AMILaunchPermission_organization
=== PAUSE TestAccEC2AMILaunchPermission_organization
=== CONT  TestAccEC2AMILaunchPermission_organization
2022/04/06 23:24:53 Waiting for AMI ami-0dddfaa907ae8da63 to become available...
2022/04/06 23:30:23 Waiting for AMI ami-0dddfaa907ae8da63 to be deleted...
--- PASS: TestAccEC2AMILaunchPermission_organization (344.49s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        346.991s

[ewbankkit]

LGTM 🚀.

% make testacc TESTS=TestAccEC2AMILaunchPermission_ PKG=ec2 ACCTEST_PARALLELISM=2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 2 -run='TestAccEC2AMILaunchPermission_'  -timeout 180m
=== RUN   TestAccEC2AMILaunchPermission_basic
=== PAUSE TestAccEC2AMILaunchPermission_basic
=== RUN   TestAccEC2AMILaunchPermission_disappears
=== PAUSE TestAccEC2AMILaunchPermission_disappears
=== RUN   TestAccEC2AMILaunchPermission_Disappears_ami
=== PAUSE TestAccEC2AMILaunchPermission_Disappears_ami
=== RUN   TestAccEC2AMILaunchPermission_group
=== PAUSE TestAccEC2AMILaunchPermission_group
=== RUN   TestAccEC2AMILaunchPermission_organizationARN
=== PAUSE TestAccEC2AMILaunchPermission_organizationARN
=== RUN   TestAccEC2AMILaunchPermission_organizationalUnitARN
=== PAUSE TestAccEC2AMILaunchPermission_organizationalUnitARN
=== CONT  TestAccEC2AMILaunchPermission_basic
=== CONT  TestAccEC2AMILaunchPermission_group
--- PASS: TestAccEC2AMILaunchPermission_group (361.35s)
=== CONT  TestAccEC2AMILaunchPermission_Disappears_ami
--- PASS: TestAccEC2AMILaunchPermission_basic (361.98s)
=== CONT  TestAccEC2AMILaunchPermission_organizationalUnitARN
    acctest.go:688: skipping tests; this AWS account must not be an existing member of an AWS Organization
--- SKIP: TestAccEC2AMILaunchPermission_organizationalUnitARN (0.23s)
=== CONT  TestAccEC2AMILaunchPermission_organizationARN
--- PASS: TestAccEC2AMILaunchPermission_Disappears_ami (350.94s)
=== CONT  TestAccEC2AMILaunchPermission_disappears
--- PASS: TestAccEC2AMILaunchPermission_organizationARN (355.95s)
--- PASS: TestAccEC2AMILaunchPermission_disappears (355.58s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	1071.663s

% make testacc TESTS=TestAccEC2AMILaunchPermission_organizationalUnitARN PKG=ec2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccEC2AMILaunchPermission_organizationalUnitARN'  -timeout 180m
=== RUN   TestAccEC2AMILaunchPermission_organizationalUnitARN
=== PAUSE TestAccEC2AMILaunchPermission_organizationalUnitARN
=== CONT  TestAccEC2AMILaunchPermission_organizationalUnitARN
--- PASS: TestAccEC2AMILaunchPermission_organizationalUnitARN (345.34s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	349.518s

[ewbankkit]

@joraff @grahamc Thanks for the contribution 🎉 👏.

[github-actions]

This functionality has been released in v4.10.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.