Skip to content

Commit 4c0c86b

Browse files
gdavisongdavison
authored
Merge pull request #27640 from robh007/f-aws_vpc_endpoint_service_allowed_principal
[Enhancement]: Changed id to use the ServicePermissionID - the ID of the actual resource.
2 parents 1b87ab5 + 9606b44 commit 4c0c86b

7 files changed

+150
-36
lines changed

‎.changelog/27640.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/aws_vpc_endpoint_service_allowed_principal: Changed id to use ServicePermissionId
3+
```

‎internal/service/cognitoidp/find.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,12 @@ func FindCognitoUserPoolClientByName(ctx context.Context, conn *cognitoidentityp
112112
return nil, err
113113
}
114114

115-
if err := tfresource.ExpectSingleResult(clientDescs); err != nil {
115+
client, err := tfresource.AssertSingleResult(clientDescs)
116+
if err != nil {
116117
return nil, err
117118
}
118119

119-
return FindCognitoUserPoolClientByID(ctx, conn, userPoolId, aws.StringValue(clientDescs[0].ClientId))
120+
return FindCognitoUserPoolClientByID(ctx, conn, userPoolId, aws.StringValue(client.ClientId))
120121
}
121122

122123
type cognitoUserPoolClientDescriptionNameFilter func(string) (bool, error)

‎internal/service/ec2/find.go

+5-14
Original file line numberDiff line numberDiff line change
@@ -3345,30 +3345,21 @@ func FindVPCEndpointServicePermissions(ctx context.Context, conn *ec2.EC2, input
33453345
return output, nil
33463346
}
33473347

3348-
func FindVPCEndpointServicePermissionsByID(ctx context.Context, conn *ec2.EC2, id string) ([]*ec2.AllowedPrincipal, error) {
3348+
func FindVPCEndpointServicePermissionsByServiceID(ctx context.Context, conn *ec2.EC2, id string) ([]*ec2.AllowedPrincipal, error) {
33493349
input := &ec2.DescribeVpcEndpointServicePermissionsInput{
33503350
ServiceId: aws.String(id),
33513351
}
33523352

33533353
return FindVPCEndpointServicePermissions(ctx, conn, input)
33543354
}
33553355

3356-
func FindVPCEndpointServicePermissionExists(ctx context.Context, conn *ec2.EC2, serviceID, principalARN string) error {
3357-
allowedPrincipals, err := FindVPCEndpointServicePermissionsByID(ctx, conn, serviceID)
3358-
3356+
func FindVPCEndpointServicePermission(ctx context.Context, conn *ec2.EC2, serviceID, principalARN string) (*ec2.AllowedPrincipal, error) {
3357+
allowedPrincipals, err := FindVPCEndpointServicePermissionsByServiceID(ctx, conn, serviceID)
33593358
if err != nil {
3360-
return err
3361-
}
3362-
3363-
for _, v := range allowedPrincipals {
3364-
if aws.StringValue(v.Principal) == principalARN {
3365-
return nil
3366-
}
3359+
return nil, err
33673360
}
33683361

3369-
return &retry.NotFoundError{
3370-
LastError: fmt.Errorf("VPC Endpoint Service (%s) Principal (%s) not found", serviceID, principalARN),
3371-
}
3362+
return tfresource.AssertSingleResult(allowedPrincipals)
33723363
}
33733364

33743365
// FindVPCEndpointRouteTableAssociationExists returns NotFoundError if no association for the specified VPC endpoint and route table IDs is found.

‎internal/service/ec2/vpc_endpoint_service.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,7 @@ func resourceVPCEndpointServiceRead(ctx context.Context, d *schema.ResourceData,
248248

249249
SetTagsOut(ctx, svcCfg.Tags)
250250

251-
allowedPrincipals, err := FindVPCEndpointServicePermissionsByID(ctx, conn, d.Id())
251+
allowedPrincipals, err := FindVPCEndpointServicePermissionsByServiceID(ctx, conn, d.Id())
252252

253253
if err != nil {
254254
return sdkdiag.AppendErrorf(diags, "reading EC2 VPC Endpoint Service (%s) permissions: %s", d.Id(), err)

‎internal/service/ec2/vpc_endpoint_service_allowed_principal.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package ec2
22

33
import (
44
"context"
5-
"fmt"
65
"log"
76

87
"github.com/aws/aws-sdk-go/aws"
@@ -11,7 +10,6 @@ import (
1110
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
1211
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
1312
"github.com/hashicorp/terraform-provider-aws/internal/conns"
14-
"github.com/hashicorp/terraform-provider-aws/internal/create"
1513
"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
1614
"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
1715
)
@@ -45,7 +43,7 @@ func resourceVPCEndpointServiceAllowedPrincipalCreate(ctx context.Context, d *sc
4543
serviceID := d.Get("vpc_endpoint_service_id").(string)
4644
principalARN := d.Get("principal_arn").(string)
4745

48-
_, err := conn.ModifyVpcEndpointServicePermissionsWithContext(ctx, &ec2.ModifyVpcEndpointServicePermissionsInput{
46+
output, err := conn.ModifyVpcEndpointServicePermissionsWithContext(ctx, &ec2.ModifyVpcEndpointServicePermissionsInput{
4947
AddAllowedPrincipals: aws.StringSlice([]string{principalARN}),
5048
ServiceId: aws.String(serviceID),
5149
})
@@ -54,7 +52,11 @@ func resourceVPCEndpointServiceAllowedPrincipalCreate(ctx context.Context, d *sc
5452
return sdkdiag.AppendErrorf(diags, "modifying EC2 VPC Endpoint Service (%s) permissions: %s", serviceID, err)
5553
}
5654

57-
d.SetId(fmt.Sprintf("a-%s%d", serviceID, create.StringHashcode(principalARN)))
55+
for _, v := range output.AddedPrincipals {
56+
if aws.StringValue(v.Principal) == principalARN {
57+
d.SetId(aws.StringValue(v.ServicePermissionId))
58+
}
59+
}
5860

5961
return append(diags, resourceVPCEndpointServiceAllowedPrincipalRead(ctx, d, meta)...)
6062
}
@@ -66,7 +68,7 @@ func resourceVPCEndpointServiceAllowedPrincipalRead(ctx context.Context, d *sche
6668
serviceID := d.Get("vpc_endpoint_service_id").(string)
6769
principalARN := d.Get("principal_arn").(string)
6870

69-
err := FindVPCEndpointServicePermissionExists(ctx, conn, serviceID, principalARN)
71+
output, err := FindVPCEndpointServicePermission(ctx, conn, serviceID, principalARN)
7072

7173
if !d.IsNewResource() && tfresource.NotFound(err) {
7274
log.Printf("[WARN] EC2 VPC Endpoint Service Allowed Principal %s not found, removing from state", d.Id())
@@ -78,6 +80,8 @@ func resourceVPCEndpointServiceAllowedPrincipalRead(ctx context.Context, d *sche
7880
return sdkdiag.AppendErrorf(diags, "reading EC2 VPC Endpoint Service (%s) Allowed Principal (%s): %s", serviceID, principalARN, err)
7981
}
8082

83+
d.SetId(aws.StringValue(output.ServicePermissionId))
84+
8185
return diags
8286
}
8387

‎internal/service/ec2/vpc_endpoint_service_allowed_principal_test.go

+124-9
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package ec2_test
33
import (
44
"context"
55
"fmt"
6+
"regexp"
67
"testing"
78

89
"github.com/aws/aws-sdk-go/service/ec2"
@@ -17,8 +18,9 @@ import (
1718

1819
func TestAccVPCEndpointServiceAllowedPrincipal_basic(t *testing.T) {
1920
ctx := acctest.Context(t)
21+
rName := sdkacctest.RandomWithPrefix("tfacctest")
22+
2023
resourceName := "aws_vpc_endpoint_service_allowed_principal.test"
21-
rName := sdkacctest.RandomWithPrefix("tfacctest") // 32 character limit
2224

2325
resource.ParallelTest(t, resource.TestCase{
2426
PreCheck: func() { acctest.PreCheck(ctx, t) },
@@ -28,8 +30,109 @@ func TestAccVPCEndpointServiceAllowedPrincipal_basic(t *testing.T) {
2830
Steps: []resource.TestStep{
2931
{
3032
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
31-
Check: resource.ComposeTestCheckFunc(
33+
Check: resource.ComposeAggregateTestCheckFunc(
3234
testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
35+
resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^vpce-svc-perm-\w{17}$`)),
36+
resource.TestCheckResourceAttrPair(resourceName, "vpc_endpoint_service_id", "aws_vpc_endpoint_service.test", "id"),
37+
resource.TestCheckResourceAttrPair(resourceName, "principal_arn", "data.aws_iam_session_context.current", "issuer_arn"),
38+
),
39+
},
40+
},
41+
})
42+
}
43+
44+
func TestAccVPCEndpointServiceAllowedPrincipal_tags(t *testing.T) {
45+
ctx := acctest.Context(t)
46+
rName := sdkacctest.RandomWithPrefix("tfacctest")
47+
48+
resourceName := "aws_vpc_endpoint_service_allowed_principal.test"
49+
tagResourceName := "aws_ec2_tag.test"
50+
51+
resource.ParallelTest(t, resource.TestCase{
52+
PreCheck: func() { acctest.PreCheck(ctx, t) },
53+
ErrorCheck: acctest.ErrorCheck(t, ec2.EndpointsID),
54+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
55+
CheckDestroy: testAccCheckVPCEndpointServiceAllowedPrincipalDestroy(ctx),
56+
Steps: []resource.TestStep{
57+
{
58+
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_tag(rName),
59+
Check: resource.ComposeAggregateTestCheckFunc(
60+
testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
61+
resource.TestCheckResourceAttrPair(tagResourceName, "resource_id", resourceName, "id"),
62+
resource.TestCheckResourceAttr(tagResourceName, "key", "Name"),
63+
resource.TestCheckResourceAttr(tagResourceName, "value", rName),
64+
),
65+
},
66+
},
67+
})
68+
}
69+
70+
func TestAccVPCEndpointServiceAllowedPrincipal_migrateID(t *testing.T) {
71+
ctx := acctest.Context(t)
72+
rName := sdkacctest.RandomWithPrefix("tfacctest")
73+
74+
resourceName := "aws_vpc_endpoint_service_allowed_principal.test"
75+
76+
resource.ParallelTest(t, resource.TestCase{
77+
PreCheck: func() { acctest.PreCheck(ctx, t) },
78+
ErrorCheck: acctest.ErrorCheck(t, ec2.EndpointsID),
79+
CheckDestroy: testAccCheckVPCEndpointServiceAllowedPrincipalDestroy(ctx),
80+
Steps: []resource.TestStep{
81+
{
82+
ExternalProviders: map[string]resource.ExternalProvider{
83+
"aws": {
84+
Source: "hashicorp/aws",
85+
VersionConstraint: "4.63.0",
86+
},
87+
},
88+
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
89+
Check: resource.ComposeAggregateTestCheckFunc(
90+
testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
91+
),
92+
},
93+
{
94+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
95+
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
96+
PlanOnly: true,
97+
},
98+
},
99+
})
100+
}
101+
102+
// Verify that the resource returns an ID usable for creating an `aws_ec2_tag`
103+
func TestAccVPCEndpointServiceAllowedPrincipal_migrateAndTag(t *testing.T) {
104+
ctx := acctest.Context(t)
105+
rName := sdkacctest.RandomWithPrefix("tfacctest")
106+
107+
resourceName := "aws_vpc_endpoint_service_allowed_principal.test"
108+
tagResourceName := "aws_ec2_tag.test"
109+
110+
resource.ParallelTest(t, resource.TestCase{
111+
PreCheck: func() { acctest.PreCheck(ctx, t) },
112+
ErrorCheck: acctest.ErrorCheck(t, ec2.EndpointsID),
113+
CheckDestroy: testAccCheckVPCEndpointServiceAllowedPrincipalDestroy(ctx),
114+
Steps: []resource.TestStep{
115+
{
116+
ExternalProviders: map[string]resource.ExternalProvider{
117+
"aws": {
118+
Source: "hashicorp/aws",
119+
VersionConstraint: "4.63.0",
120+
},
121+
},
122+
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
123+
Check: resource.ComposeAggregateTestCheckFunc(
124+
testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
125+
),
126+
},
127+
{
128+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
129+
Config: testAccVPCEndpointServiceAllowedPrincipalConfig_tag(rName),
130+
Check: resource.ComposeAggregateTestCheckFunc(
131+
testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
132+
resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^vpce-svc-perm-\w{17}$`)),
133+
resource.TestCheckResourceAttrPair(tagResourceName, "resource_id", resourceName, "id"),
134+
resource.TestCheckResourceAttr(tagResourceName, "key", "Name"),
135+
resource.TestCheckResourceAttr(tagResourceName, "value", rName),
33136
),
34137
},
35138
},
@@ -45,7 +148,7 @@ func testAccCheckVPCEndpointServiceAllowedPrincipalDestroy(ctx context.Context)
45148
continue
46149
}
47150

48-
err := tfec2.FindVPCEndpointServicePermissionExists(ctx, conn, rs.Primary.Attributes["vpc_endpoint_service_id"], rs.Primary.Attributes["principal_arn"])
151+
_, err := tfec2.FindVPCEndpointServicePermission(ctx, conn, rs.Primary.Attributes["vpc_endpoint_service_id"], rs.Primary.Attributes["principal_arn"])
49152

50153
if tfresource.NotFound(err) {
51154
continue
@@ -75,12 +178,15 @@ func testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx context.Context, n
75178

76179
conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn()
77180

78-
return tfec2.FindVPCEndpointServicePermissionExists(ctx, conn, rs.Primary.Attributes["vpc_endpoint_service_id"], rs.Primary.Attributes["principal_arn"])
181+
_, err := tfec2.FindVPCEndpointServicePermission(ctx, conn, rs.Primary.Attributes["vpc_endpoint_service_id"], rs.Primary.Attributes["principal_arn"])
182+
183+
return err
79184
}
80185
}
81186

82187
func testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName string) string {
83-
return acctest.ConfigCompose(testAccVPCEndpointServiceConfig_networkLoadBalancerBase(rName, 1), fmt.Sprintf(`
188+
return acctest.ConfigCompose(
189+
testAccVPCEndpointServiceConfig_networkLoadBalancerBase(rName, 1), `
84190
data "aws_caller_identity" "current" {}
85191
86192
data "aws_iam_session_context" "current" {
@@ -90,16 +196,25 @@ data "aws_iam_session_context" "current" {
90196
resource "aws_vpc_endpoint_service" "test" {
91197
acceptance_required = false
92198
network_load_balancer_arns = aws_lb.test[*].arn
93-
94-
tags = {
95-
Name = %[1]q
96-
}
97199
}
98200
99201
resource "aws_vpc_endpoint_service_allowed_principal" "test" {
100202
vpc_endpoint_service_id = aws_vpc_endpoint_service.test.id
101203
102204
principal_arn = data.aws_iam_session_context.current.issuer_arn
103205
}
206+
`)
207+
}
208+
209+
func testAccVPCEndpointServiceAllowedPrincipalConfig_tag(rName string) string {
210+
return acctest.ConfigCompose(
211+
testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
212+
fmt.Sprintf(`
213+
resource "aws_ec2_tag" "test" {
214+
resource_id = aws_vpc_endpoint_service_allowed_principal.test.id
215+
216+
key = "Name"
217+
value = %[1]q
218+
}
104219
`, rName))
105220
}

‎internal/tfresource/not_found_error.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -92,13 +92,13 @@ func SingularDataSourceFindError(resourceType string, err error) error {
9292
return fmt.Errorf("reading %s: %w", resourceType, err)
9393
}
9494

95-
func ExpectSingleResult[T any](a []*T) error {
95+
func AssertSingleResult[T any](a []*T) (*T, error) {
9696
if l := len(a); l == 0 {
97-
return NewEmptyResultError(nil)
97+
return nil, NewEmptyResultError(nil)
9898
} else if l > 1 {
99-
return NewTooManyResultsError(l, nil)
99+
return nil, NewTooManyResultsError(l, nil)
100100
} else if a[0] == nil {
101-
return NewEmptyResultError(nil)
101+
return nil, NewEmptyResultError(nil)
102102
}
103-
return nil
103+
return a[0], nil
104104
}

0 commit comments

Comments
 (0)