Skip to content

Commit 0d931f1

Browse files
ewbankkitewbankkit
committed
r/aws_apigatewayv2_domain_name: Create public ACM certificate for testing mutual TLS (relates: hashicorp#16139).
Acceptance test output: $ ACM_CERTIFICATE_ROOT_DOMAIN=<domain name> make testacc TEST=./aws TESTARGS='-run=TestAccAWSAPIGatewayV2DomainName_' ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSAPIGatewayV2DomainName_ -timeout 120m === RUN TestAccAWSAPIGatewayV2DomainName_basic === PAUSE TestAccAWSAPIGatewayV2DomainName_basic === RUN TestAccAWSAPIGatewayV2DomainName_disappears === PAUSE TestAccAWSAPIGatewayV2DomainName_disappears === RUN TestAccAWSAPIGatewayV2DomainName_Tags === PAUSE TestAccAWSAPIGatewayV2DomainName_Tags === RUN TestAccAWSAPIGatewayV2DomainName_UpdateCertificate === PAUSE TestAccAWSAPIGatewayV2DomainName_UpdateCertificate === RUN TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication === PAUSE TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication === CONT TestAccAWSAPIGatewayV2DomainName_basic === CONT TestAccAWSAPIGatewayV2DomainName_UpdateCertificate === CONT TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication === CONT TestAccAWSAPIGatewayV2DomainName_Tags === CONT TestAccAWSAPIGatewayV2DomainName_disappears --- PASS: TestAccAWSAPIGatewayV2DomainName_disappears (22.46s) --- PASS: TestAccAWSAPIGatewayV2DomainName_Tags (83.52s) --- PASS: TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication (207.72s) --- PASS: TestAccAWSAPIGatewayV2DomainName_basic (240.48s) --- PASS: TestAccAWSAPIGatewayV2DomainName_UpdateCertificate (758.06s) PASS ok github.com/terraform-providers/terraform-provider-aws/aws 758.484s
1 parent c6c8dbf commit 0d931f1

File tree

2 files changed

+87
-51
lines changed

2 files changed

+87
-51
lines changed

‎aws/resource_aws_apigatewayv2_domain_name_test.go

+87-50
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package aws
33
import (
44
"fmt"
55
"log"
6-
"os"
76
"regexp"
87
"testing"
98

@@ -262,14 +261,12 @@ func TestAccAWSAPIGatewayV2DomainName_UpdateCertificate(t *testing.T) {
262261
}
263262

264263
func TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication(t *testing.T) {
265-
key := "AWS_APIGATEWAYV2_CERTIFICATE_DOMAIN_NAME"
266-
domainName := os.Getenv(key)
267-
if domainName == "" {
268-
t.Skipf("Environment variable %s is not set", key)
269-
}
264+
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)
265+
domain := testAccAwsAcmCertificateRandomSubDomain(rootDomain)
270266

271267
var v apigatewayv2.GetDomainNameOutput
272268
resourceName := "aws_apigatewayv2_domain_name.test"
269+
acmCertificateResourceName := "aws_acm_certificate.test"
273270
s3BucketObjectResourceName := "aws_s3_bucket_object.test"
274271
rName := acctest.RandomWithPrefix("tf-acc-test")
275272

@@ -279,13 +276,13 @@ func TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication(t *testing.T) {
279276
CheckDestroy: testAccCheckAWSAPIGatewayV2DomainNameDestroy,
280277
Steps: []resource.TestStep{
281278
{
282-
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthentication(rName, domainName),
279+
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthentication(rootDomain, domain, rName),
283280
Check: resource.ComposeTestCheckFunc(
284281
testAccCheckAWSAPIGatewayV2DomainNameExists(resourceName, &v),
285282
testAccMatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
286-
resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
283+
resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
287284
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
288-
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.certificate_arn"),
285+
resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
289286
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.endpoint_type", "REGIONAL"),
290287
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.hosted_zone_id"),
291288
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.security_policy", "TLS_1_2"),
@@ -297,13 +294,13 @@ func TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication(t *testing.T) {
297294
),
298295
},
299296
{
300-
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationUpdated(rName, domainName),
297+
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationUpdated(rootDomain, domain, rName),
301298
Check: resource.ComposeTestCheckFunc(
302299
testAccCheckAWSAPIGatewayV2DomainNameExists(resourceName, &v),
303300
testAccMatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
304-
resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
301+
resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
305302
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
306-
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.certificate_arn"),
303+
resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
307304
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.endpoint_type", "REGIONAL"),
308305
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.hosted_zone_id"),
309306
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.security_policy", "TLS_1_2"),
@@ -321,13 +318,13 @@ func TestAccAWSAPIGatewayV2DomainName_MutualTlsAuthentication(t *testing.T) {
321318
},
322319
// Test disabling mutual TLS authentication.
323320
{
324-
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationMissing(domainName),
321+
Config: testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationMissing(rootDomain, domain),
325322
Check: resource.ComposeTestCheckFunc(
326323
testAccCheckAWSAPIGatewayV2DomainNameExists(resourceName, &v),
327324
testAccMatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
328-
resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
325+
resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
329326
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
330-
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.certificate_arn"),
327+
resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
331328
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.endpoint_type", "REGIONAL"),
332329
resource.TestCheckResourceAttrSet(resourceName, "domain_name_configuration.0.hosted_zone_id"),
333330
resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.0.security_policy", "TLS_1_2"),
@@ -405,8 +402,58 @@ resource "aws_acm_certificate" "test" {
405402
`, rName, certificate, key, count)
406403
}
407404

405+
func testAccAWSAPIGatewayV2DomainNameConfigPublicCert(rootDomain, domain string) string {
406+
return fmt.Sprintf(`
407+
data "aws_route53_zone" "test" {
408+
name = %[1]q
409+
private_zone = false
410+
}
411+
412+
resource "aws_acm_certificate" "test" {
413+
domain_name = %[2]q
414+
validation_method = "DNS"
415+
}
416+
417+
#
418+
# for_each acceptance testing requires:
419+
# https://github.com/hashicorp/terraform-plugin-sdk/issues/536
420+
#
421+
# resource "aws_route53_record" "test" {
422+
# for_each = {
423+
# for dvo in aws_acm_certificate.test.domain_validation_options: dvo.domain_name => {
424+
# name = dvo.resource_record_name
425+
# record = dvo.resource_record_value
426+
# type = dvo.resource_record_type
427+
# }
428+
# }
429+
# allow_overwrite = true
430+
# name = each.value.name
431+
# records = [each.value.record]
432+
# ttl = 60
433+
# type = each.value.type
434+
# zone_id = data.aws_route53_zone.test.zone_id
435+
# }
436+
437+
resource "aws_route53_record" "test" {
438+
allow_overwrite = true
439+
name = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_name
440+
records = [tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_value]
441+
ttl = 60
442+
type = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_type
443+
zone_id = data.aws_route53_zone.test.zone_id
444+
}
445+
446+
resource "aws_acm_certificate_validation" "test" {
447+
certificate_arn = aws_acm_certificate.test.arn
448+
validation_record_fqdns = [aws_route53_record.test.fqdn]
449+
}
450+
`, rootDomain, domain)
451+
}
452+
408453
func testAccAWSAPIGatewayV2DomainNameConfig_basic(rName, certificate, key string, count, index int) string {
409-
return composeConfig(testAccAWSAPIGatewayV2DomainNameConfigImportedCerts(rName, certificate, key, count), fmt.Sprintf(`
454+
return composeConfig(
455+
testAccAWSAPIGatewayV2DomainNameConfigImportedCerts(rName, certificate, key, count),
456+
fmt.Sprintf(`
410457
resource "aws_apigatewayv2_domain_name" "test" {
411458
domain_name = "%[1]s.example.com"
412459
@@ -420,7 +467,9 @@ resource "aws_apigatewayv2_domain_name" "test" {
420467
}
421468

422469
func testAccAWSAPIGatewayV2DomainNameConfig_tags(rName, certificate, key string, count, index int) string {
423-
return composeConfig(testAccAWSAPIGatewayV2DomainNameConfigImportedCerts(rName, certificate, key, count), fmt.Sprintf(`
470+
return composeConfig(
471+
testAccAWSAPIGatewayV2DomainNameConfigImportedCerts(rName, certificate, key, count),
472+
fmt.Sprintf(`
424473
resource "aws_apigatewayv2_domain_name" "test" {
425474
domain_name = "%[1]s.example.com"
426475
@@ -438,14 +487,10 @@ resource "aws_apigatewayv2_domain_name" "test" {
438487
`, rName, index))
439488
}
440489

441-
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthentication(rName, domainName string) string {
442-
return fmt.Sprintf(`
443-
data "aws_acm_certificate" "test" {
444-
domain = %[2]q
445-
types = ["AMAZON_ISSUED"]
446-
most_recent = true
447-
}
448-
490+
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthentication(rootDomain, domain, rName string) string {
491+
return composeConfig(
492+
testAccAWSAPIGatewayV2DomainNameConfigPublicCert(rootDomain, domain),
493+
fmt.Sprintf(`
449494
resource "aws_s3_bucket" "test" {
450495
bucket = %[1]q
451496
@@ -459,10 +504,10 @@ resource "aws_s3_bucket_object" "test" {
459504
}
460505
461506
resource "aws_apigatewayv2_domain_name" "test" {
462-
domain_name = %[2]q
507+
domain_name = aws_acm_certificate.test.domain_name
463508
464509
domain_name_configuration {
465-
certificate_arn = data.aws_acm_certificate.test.arn
510+
certificate_arn = aws_acm_certificate_validation.test.certificate_arn
466511
endpoint_type = "REGIONAL"
467512
security_policy = "TLS_1_2"
468513
}
@@ -471,17 +516,13 @@ resource "aws_apigatewayv2_domain_name" "test" {
471516
truststore_uri = "s3://${aws_s3_bucket_object.test.bucket}/${aws_s3_bucket_object.test.key}"
472517
}
473518
}
474-
`, rName, domainName)
475-
}
476-
477-
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationUpdated(rName, domainName string) string {
478-
return fmt.Sprintf(`
479-
data "aws_acm_certificate" "test" {
480-
domain = %[2]q
481-
types = ["AMAZON_ISSUED"]
482-
most_recent = true
519+
`, rName))
483520
}
484521

522+
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationUpdated(rootDomain, domain, rName string) string {
523+
return composeConfig(
524+
testAccAWSAPIGatewayV2DomainNameConfigPublicCert(rootDomain, domain),
525+
fmt.Sprintf(`
485526
resource "aws_s3_bucket" "test" {
486527
bucket = %[1]q
487528
@@ -499,10 +540,10 @@ resource "aws_s3_bucket_object" "test" {
499540
}
500541
501542
resource "aws_apigatewayv2_domain_name" "test" {
502-
domain_name = %[2]q
543+
domain_name = aws_acm_certificate.test.domain_name
503544
504545
domain_name_configuration {
505-
certificate_arn = data.aws_acm_certificate.test.arn
546+
certificate_arn = aws_acm_certificate_validation.test.certificate_arn
506547
endpoint_type = "REGIONAL"
507548
security_policy = "TLS_1_2"
508549
}
@@ -512,25 +553,21 @@ resource "aws_apigatewayv2_domain_name" "test" {
512553
truststore_version = aws_s3_bucket_object.test.version_id
513554
}
514555
}
515-
`, rName, domainName)
516-
}
517-
518-
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationMissing(domainName string) string {
519-
return fmt.Sprintf(`
520-
data "aws_acm_certificate" "test" {
521-
domain = %[1]q
522-
types = ["AMAZON_ISSUED"]
523-
most_recent = true
556+
`, rName))
524557
}
525558

559+
func testAccAWSAPIGatewayV2DomainNameConfigMututalTlsAuthenticationMissing(rootDomain, domain string) string {
560+
return composeConfig(
561+
testAccAWSAPIGatewayV2DomainNameConfigPublicCert(rootDomain, domain),
562+
`
526563
resource "aws_apigatewayv2_domain_name" "test" {
527-
domain_name = %[1]q
564+
domain_name = aws_acm_certificate.test.domain_name
528565
529566
domain_name_configuration {
530-
certificate_arn = data.aws_acm_certificate.test.arn
567+
certificate_arn = aws_acm_certificate_validation.test.certificate_arn
531568
endpoint_type = "REGIONAL"
532569
security_policy = "TLS_1_2"
533570
}
534571
}
535-
`, domainName)
572+
`)
536573
}

‎docs/MAINTAINING.md

-1
Original file line numberDiff line numberDiff line change
@@ -398,7 +398,6 @@ Environment variables (beyond standard AWS Go SDK ones) used by acceptance testi
398398
| `AWS_API_GATEWAY_DOMAIN_NAME_CERTIFICATE_CHAIN` | Certificate chain of publicly trusted certificate for API Gateway Domain Name testing. |
399399
| `AWS_API_GATEWAY_DOMAIN_NAME_CERTIFICATE_PRIVATE_KEY` | Private key of publicly trusted certificate for API Gateway Domain Name testing. |
400400
| `AWS_API_GATEWAY_DOMAIN_NAME_REGIONAL_CERTIFICATE_NAME_ENABLED` | Flag to enable API Gateway Domain Name regional certificate upload testing. |
401-
| `AWS_APIGATEWAYV2_CERTIFICATE_DOMAIN_NAME` | Domain Name of Amazon Issued ACM Certificate in the acceptance test region for API Gateway v2 testing. |
402401
| `AWS_CODEBUILD_BITBUCKET_SOURCE_LOCATION` | BitBucket source URL for CodeBuild testing. CodeBuild must have access to this repository via OAuth or Source Credentials. Defaults to `https://terraform@bitbucket.org/terraform/aws-test.git`. |
403402
| `AWS_CODEBUILD_GITHUB_SOURCE_LOCATION` | GitHub source URL for CodeBuild testing. CodeBuild must have access to this repository via OAuth or Source Credentials. Defaults to `https://github.com/hashibot-test/aws-test.git`. |
404403
| `AWS_COGNITO_USER_POOL_DOMAIN_CERTIFICATE_ARN` | Amazon Resource Name of ACM Certificate in `us-east-1` for Cognito User Pool Domain Name testing. |

0 commit comments

Comments
 (0)