Skip to content

Commit 0182db7

Browse files
ewbankkitewbankkit
authored
Merge pull request #33095 from hashicorp/b-aws_securityhub_account-4.64.0-regression
r/aws_securityhub_account: Remove default value for `control_finding_generator`
2 parents 24b921e + 4bd751e commit 0182db7

File tree

4 files changed

+84
-21
lines changed

4 files changed

+84
-21
lines changed

‎.changelog/33095.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
resource/aws_securityhub_account: Remove default value (`SECURITY_CONTROL`) for `control_finding_generator` argument and mark as Computed
3+
```

‎internal/service/securityhub/account.go

+19-5
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func ResourceAccount() *schema.Resource {
6161
"control_finding_generator": {
6262
Type: schema.TypeString,
6363
Optional: true,
64-
Default: securityhub.ControlFindingGeneratorSecurityControl,
64+
Computed: true,
6565
ValidateFunc: validation.StringInSlice(securityhub.ControlFindingGenerator_Values(), false),
6666
},
6767
"enable_default_standards": {
@@ -94,8 +94,19 @@ func resourceAccountCreate(ctx context.Context, d *schema.ResourceData, meta int
9494

9595
d.SetId(meta.(*conns.AWSClient).AccountID)
9696

97-
// auto_enable_controls has to be done from the update API
98-
return append(diags, resourceAccountUpdate(ctx, d, meta)...)
97+
if autoEnableControls := d.Get("auto_enable_controls").(bool); !autoEnableControls {
98+
input := &securityhub.UpdateSecurityHubConfigurationInput{
99+
AutoEnableControls: aws.Bool(autoEnableControls),
100+
}
101+
102+
_, err := conn.UpdateSecurityHubConfigurationWithContext(ctx, input)
103+
104+
if err != nil {
105+
return sdkdiag.AppendErrorf(diags, "updating Security Hub Account (%s): %s", d.Id(), err)
106+
}
107+
}
108+
109+
return append(diags, resourceAccountRead(ctx, d, meta)...)
99110
}
100111

101112
func resourceAccountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -136,8 +147,11 @@ func resourceAccountUpdate(ctx context.Context, d *schema.ResourceData, meta int
136147
conn := meta.(*conns.AWSClient).SecurityHubConn(ctx)
137148

138149
input := &securityhub.UpdateSecurityHubConfigurationInput{
139-
ControlFindingGenerator: aws.String(d.Get("control_finding_generator").(string)),
140-
AutoEnableControls: aws.Bool(d.Get("auto_enable_controls").(bool)),
150+
AutoEnableControls: aws.Bool(d.Get("auto_enable_controls").(bool)),
151+
}
152+
153+
if d.HasChange("control_finding_generator") {
154+
input.ControlFindingGenerator = aws.String(d.Get("control_finding_generator").(string))
141155
}
142156

143157
_, err := conn.UpdateSecurityHubConfigurationWithContext(ctx, input)

‎internal/service/securityhub/account_test.go

+60-15
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"fmt"
99
"testing"
1010

11+
"github.com/aws/aws-sdk-go/aws/endpoints"
1112
"github.com/aws/aws-sdk-go/service/securityhub"
1213
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
1314
"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -20,6 +21,10 @@ import (
2021
func testAccAccount_basic(t *testing.T) {
2122
ctx := acctest.Context(t)
2223
resourceName := "aws_securityhub_account.test"
24+
controlFindingGeneratorDefaultValueFromAWS := "SECURITY_CONTROL"
25+
if acctest.Partition() == endpoints.AwsUsGovPartitionID {
26+
controlFindingGeneratorDefaultValueFromAWS = ""
27+
}
2328

2429
resource.Test(t, resource.TestCase{
2530
PreCheck: func() { acctest.PreCheck(ctx, t) },
@@ -32,7 +37,7 @@ func testAccAccount_basic(t *testing.T) {
3237
Check: resource.ComposeTestCheckFunc(
3338
testAccCheckAccountExists(ctx, resourceName),
3439
resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
35-
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
40+
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", controlFindingGeneratorDefaultValueFromAWS),
3641
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
3742
),
3843
},
@@ -94,27 +99,26 @@ func testAccAccount_full(t *testing.T) {
9499
resourceName := "aws_securityhub_account.test"
95100

96101
resource.Test(t, resource.TestCase{
97-
PreCheck: func() { acctest.PreCheck(ctx, t) },
102+
// control_finding_generator not supported in AWS GovCloud.
103+
PreCheck: func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
98104
ErrorCheck: acctest.ErrorCheck(t, securityhub.EndpointsID),
99105
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
100106
CheckDestroy: testAccCheckAccountDestroy(ctx),
101107
Steps: []resource.TestStep{
102108
{
103-
Config: testAccAccountConfig_basic,
109+
Config: testAccAccountConfig_full(false, "STANDARD_CONTROL"),
104110
Check: resource.ComposeTestCheckFunc(
105111
testAccCheckAccountExists(ctx, resourceName),
106-
resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
107-
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
108-
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
112+
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "false"),
113+
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "STANDARD_CONTROL"),
109114
),
110115
},
111116
{
112-
Config: testAccAccountConfig_full,
117+
Config: testAccAccountConfig_full(true, "SECURITY_CONTROL"),
113118
Check: resource.ComposeTestCheckFunc(
114119
testAccCheckAccountExists(ctx, resourceName),
115-
resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "false"),
116-
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "STANDARD_CONTROL"),
117-
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "false"),
120+
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
121+
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
118122
),
119123
},
120124
},
@@ -152,6 +156,46 @@ func testAccAccount_migrateV0(t *testing.T) {
152156
})
153157
}
154158

159+
// https://github.com/hashicorp/terraform-provider-aws/issues/33039 et al.
160+
func testAccAccount_removeControlFindingGeneratorDefaultValue(t *testing.T) {
161+
ctx := acctest.Context(t)
162+
resourceName := "aws_securityhub_account.test"
163+
controlFindingGeneratorExpectedValue := "SECURITY_CONTROL"
164+
if acctest.Partition() == endpoints.AwsUsGovPartitionID {
165+
controlFindingGeneratorExpectedValue = ""
166+
}
167+
expectNonEmptyPlan := acctest.Partition() == endpoints.AwsUsGovPartitionID
168+
169+
resource.Test(t, resource.TestCase{
170+
PreCheck: func() { acctest.PreCheck(ctx, t) },
171+
ErrorCheck: acctest.ErrorCheck(t, securityhub.EndpointsID),
172+
CheckDestroy: testAccCheckAccountDestroy(ctx),
173+
Steps: []resource.TestStep{
174+
{
175+
ExternalProviders: map[string]resource.ExternalProvider{
176+
"aws": {
177+
Source: "hashicorp/aws",
178+
VersionConstraint: "5.13.0",
179+
},
180+
},
181+
Config: testAccAccountConfig_basic,
182+
Check: resource.ComposeTestCheckFunc(
183+
testAccCheckAccountExists(ctx, resourceName),
184+
resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
185+
resource.TestCheckResourceAttr(resourceName, "control_finding_generator", controlFindingGeneratorExpectedValue),
186+
resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
187+
),
188+
ExpectNonEmptyPlan: expectNonEmptyPlan,
189+
},
190+
{
191+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
192+
Config: testAccAccountConfig_basic,
193+
PlanOnly: true,
194+
},
195+
},
196+
})
197+
}
198+
155199
func testAccCheckAccountExists(ctx context.Context, n string) resource.TestCheckFunc {
156200
return func(s *terraform.State) error {
157201
rs, ok := s.RootModule().Resources[n]
@@ -207,10 +251,11 @@ resource "aws_securityhub_account" "test" {
207251
}
208252
`
209253

210-
const testAccAccountConfig_full = `
254+
func testAccAccountConfig_full(autoEnableControls bool, controlFindingGenerator string) string {
255+
return fmt.Sprintf(`
211256
resource "aws_securityhub_account" "test" {
212-
enable_default_standards = false
213-
control_finding_generator = "STANDARD_CONTROL"
214-
auto_enable_controls = false
257+
control_finding_generator = %[2]q
258+
auto_enable_controls = %[1]t
259+
}
260+
`, autoEnableControls, controlFindingGenerator)
215261
}
216-
`

‎internal/service/securityhub/securityhub_test.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ func TestAccSecurityHub_serial(t *testing.T) {
1818
"disappears": testAccAccount_disappears,
1919
"EnableDefaultStandardsFalse": testAccAccount_enableDefaultStandardsFalse,
2020
"MigrateV0": testAccAccount_migrateV0,
21-
"full": testAccAccount_full,
21+
"Full": testAccAccount_full,
22+
"RemoveControlFindingGeneratorDefaultValue": testAccAccount_removeControlFindingGeneratorDefaultValue,
2223
},
2324
"Member": {
2425
"basic": testAccMember_basic,

0 commit comments

Comments
 (0)