LF-Tag support for aws_lakeformation_permissions

.changelog/24314.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_lakeformation_lf_tag
+```

.changelog/24315.txt

@@ -0,0 +1,4 @@
+```release-note:note:enhancement
+resource/aws_lakeformation_permissions: Add LF-tag support
+datasource/aws_lakeformation_permissions: Add LF-tag support
+```

internal/provider/provider.go

@@ -1557,6 +1557,7 @@ func Provider() *schema.Provider {
 			"aws_kms_replica_key":          kms.ResourceReplicaKey(),
 
 			"aws_lakeformation_data_lake_settings": lakeformation.ResourceDataLakeSettings(),
+			"aws_lakeformation_lf_tag":             lakeformation.ResourceLFTag(),
 			"aws_lakeformation_permissions":        lakeformation.ResourcePermissions(),
 			"aws_lakeformation_resource":           lakeformation.ResourceResource(),
 

internal/service/lakeformation/filter.go

@@ -31,6 +31,14 @@ func FilterPermissions(input *lakeformation.ListPermissionsInput, tableType stri
 		return FilterDatabasePermissions(input.Principal.DataLakePrincipalIdentifier, allPermissions)
 	}
 
+	if input.Resource.LFTag != nil {
+		return FilterLFTagPermissions(input.Principal.DataLakePrincipalIdentifier, allPermissions)
+	}
+
+	if input.Resource.LFTagPolicy != nil {
+		return FilterLFTagPolicyPermissions(input.Principal.DataLakePrincipalIdentifier, allPermissions)
+	}
+
 	if tableType == TableTypeTableWithColumns {
 		return FilterTableWithColumnsPermissions(input.Principal.DataLakePrincipalIdentifier, input.Resource.Table, columnNames, excludedColumnNames, columnWildcard, allPermissions)
 	}
@@ -176,3 +184,35 @@ func FilterDatabasePermissions(principal *string, allPermissions []*lakeformatio
 
 	return cleanPermissions
 }
+
+func FilterLFTagPermissions(principal *string, allPermissions []*lakeformation.PrincipalResourcePermissions) []*lakeformation.PrincipalResourcePermissions {
+	var cleanPermissions []*lakeformation.PrincipalResourcePermissions
+
+	for _, perm := range allPermissions {
+		if aws.StringValue(principal) != aws.StringValue(perm.Principal.DataLakePrincipalIdentifier) {
+			continue
+		}
+
+		if perm.Resource.LFTag != nil {
+			cleanPermissions = append(cleanPermissions, perm)
+		}
+	}
+
+	return cleanPermissions
+}
+
+func FilterLFTagPolicyPermissions(principal *string, allPermissions []*lakeformation.PrincipalResourcePermissions) []*lakeformation.PrincipalResourcePermissions {
+	var cleanPermissions []*lakeformation.PrincipalResourcePermissions
+
+	for _, perm := range allPermissions {
+		if aws.StringValue(principal) != aws.StringValue(perm.Principal.DataLakePrincipalIdentifier) {
+			continue
+		}
+
+		if perm.Resource.LFTagPolicy != nil {
+			cleanPermissions = append(cleanPermissions, perm)
+		}
+	}
+
+	return cleanPermissions
+}

internal/service/lakeformation/lakeformation_test.go

@@ -19,11 +19,15 @@ func TestAccLakeFormation_serial(t *testing.T) {
 			"databaseMultiple":   testAccPermissions_databaseMultiple,
 			"dataLocation":       testAccPermissions_dataLocation,
 			"disappears":         testAccPermissions_disappears,
+			"lfTag":              testAccAWSLakeFormationPermissions_lf_tag,
+			"lfTagPolicy":        testAccAWSLakeFormationPermissions_lf_tag_policy,
 		},
 		"PermissionsDataSource": {
 			"basic":            testAccPermissionsDataSource_basic,
 			"database":         testAccPermissionsDataSource_database,
 			"dataLocation":     testAccPermissionsDataSource_dataLocation,
+			"lfTag":            testAccPermissionsDataSource_lf_tag,
+			"lfTagPolicy":      testAccPermissionsDataSource_lf_tag_policy,
 			"table":            testAccPermissionsDataSource_table,
 			"tableWithColumns": testAccPermissionsDataSource_tableWithColumns,
 		},
@@ -45,6 +49,11 @@ func TestAccLakeFormation_serial(t *testing.T) {
 			"wildcardSelectOnly":      testAccPermissions_twcWildcardSelectOnly,
 			"wildcardSelectPlus":      testAccPermissions_twcWildcardSelectPlus,
 		},
+		"LFTags": {
+			"basic":      testAccLFTag_basic,
+			"disappears": testAccLFTag_disappears,
+			"values":     testAccLFTag_values,
+		},
 	}
 
 	for group, m := range testCases {

internal/service/lakeformation/lf_tag.go

@@ -0,0 +1,184 @@
+package lakeformation
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/lakeformation"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"log"
+	"regexp"
+	"strings"
+)
+
+func ResourceLFTag() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceLFTagCreate,
+		Read:   resourceLFTagRead,
+		Update: resourceLFTagUpdate,
+		Delete: resourceLFTagDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"key": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 128),
+			},
+			"values": {
+				Type:     schema.TypeSet,
+				Required: true,
+				MinItems: 1,
+				MaxItems: 15,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validateLFTagValues(),
+				},
+				Set: schema.HashString,
+			},
+			"catalog_id": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceLFTagCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).LakeFormationConn
+
+	tagKey := d.Get("key").(string)
+	tagValues := d.Get("values").(*schema.Set)
+
+	var catalogID string
+	if v, ok := d.GetOk("catalog_id"); ok {
+		catalogID = v.(string)
+	} else {
+		catalogID = meta.(*conns.AWSClient).AccountID
+	}
+
+	input := &lakeformation.CreateLFTagInput{
+		CatalogId: aws.String(catalogID),
+		TagKey:    aws.String(tagKey),
+		TagValues: flex.ExpandStringSet(tagValues),
+	}
+
+	_, err := conn.CreateLFTag(input)
+	if err != nil {
+		return fmt.Errorf("Error creating Lake Formation LF-Tag: %w", err)
+	}
+
+	d.SetId(fmt.Sprintf("%s:%s", catalogID, tagKey))
+
+	return resourceLFTagRead(d, meta)
+}
+
+func resourceLFTagRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).LakeFormationConn
+
+	catalogID, tagKey, err := ReadLFTagID(d.Id())
+	if err != nil {
+		return err
+	}
+
+	input := &lakeformation.GetLFTagInput{
+		CatalogId: aws.String(catalogID),
+		TagKey:    aws.String(tagKey),
+	}
+
+	output, err := conn.GetLFTag(input)
+	if err != nil {
+		if tfawserr.ErrCodeEquals(err, lakeformation.ErrCodeEntityNotFoundException) {
+			log.Printf("[WARN] Lake Formation LF-Tag (%s) not found, removing from state", d.Id())
+			d.SetId("")
+			return nil
+		}
+
+		return fmt.Errorf("Error reading Lake Formation LF-Tag: %s", err.Error())
+	}
+
+	d.Set("key", output.TagKey)
+	d.Set("values", flex.FlattenStringSet(output.TagValues))
+	d.Set("catalog_id", output.CatalogId)
+
+	return nil
+}
+
+func resourceLFTagUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).LakeFormationConn
+
+	catalogID, tagKey, err := ReadLFTagID(d.Id())
+	if err != nil {
+		return err
+	}
+
+	o, n := d.GetChange("values")
+	os := o.(*schema.Set)
+	ns := n.(*schema.Set)
+	toAdd := flex.ExpandStringSet(ns.Difference(os))
+	toDelete := flex.ExpandStringSet(os.Difference(ns))
+
+	input := &lakeformation.UpdateLFTagInput{
+		CatalogId: aws.String(catalogID),
+		TagKey:    aws.String(tagKey),
+	}
+
+	if len(toAdd) > 0 {
+		input.TagValuesToAdd = toAdd
+	}
+
+	if len(toDelete) > 0 {
+		input.TagValuesToDelete = toDelete
+	}
+
+	_, err = conn.UpdateLFTag(input)
+	if err != nil {
+		return fmt.Errorf("Error updating Lake Formation LF-Tag (%s): %w", d.Id(), err)
+	}
+
+	return resourceLFTagRead(d, meta)
+}
+
+func resourceLFTagDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).LakeFormationConn
+
+	catalogID, tagKey, err := ReadLFTagID(d.Id())
+	if err != nil {
+		return err
+	}
+
+	input := &lakeformation.DeleteLFTagInput{
+		CatalogId: aws.String(catalogID),
+		TagKey:    aws.String(tagKey),
+	}
+
+	_, err = conn.DeleteLFTag(input)
+	if err != nil {
+		return fmt.Errorf("Error deleting Lake Formation LF-Tag (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}
+
+func ReadLFTagID(id string) (catalogID string, tagKey string, err error) {
+	idParts := strings.Split(id, ":")
+	if len(idParts) != 2 {
+		return "", "", fmt.Errorf("Unexpected format of ID (%q), expected CATALOG-ID:TAG-KEY", id)
+	}
+	return idParts[0], idParts[1], nil
+}
+
+func validateLFTagValues() schema.SchemaValidateFunc {
+	return validation.All(
+		validation.StringLenBetween(1, 255),
+		validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:\*\/=+\-@%]*)$`), ""),
+	)
+}