Skip to content

Commit 8e30f45

Browse files
bfladbflad
committed
tests/resource/aws_cognito_user_pool_domain: Remove hardcoded region handling and create public ACM Certificate
Reference: #8316 Reference: #15737 Output from acceptance testing in AWS Commercial: ``` --- PASS: TestAccAWSCognitoUserPoolDomain_custom (816.97s) ``` Output from acceptance testing in AWS GovCloud (US): ``` --- SKIP: TestAccAWSCognitoUserPoolDomain_custom (1.64s) ```
1 parent ae8365c commit 8e30f45

4 files changed

+170
-48
lines changed

‎aws/cognito_user_pool_domain_test.go

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package aws
2+
3+
import (
4+
"context"
5+
"sync"
6+
"testing"
7+
8+
"github.com/aws/aws-sdk-go/aws/endpoints"
9+
"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
11+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
12+
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
13+
)
14+
15+
// Cognito User Pool Custom Domains can only be created with ACM Certificates in specific regions.
16+
17+
// testAccCognitoUserPoolCustomDomainRegion is the chosen Cognito User Pool Custom Domains testing region
18+
//
19+
// Cached to prevent issues should multiple regions become available.
20+
var testAccCognitoUserPoolCustomDomainRegion string
21+
22+
// testAccProviderCognitoUserPoolCustomDomain is the Cognito User Pool Custom Domains provider instance
23+
//
24+
// This Provider can be used in testing code for API calls without requiring
25+
// the use of saving and referencing specific ProviderFactories instances.
26+
//
27+
// testAccPreCheckCognitoUserPoolCustomDomain(t) must be called before using this provider instance.
28+
var testAccProviderCognitoUserPoolCustomDomain *schema.Provider
29+
30+
// testAccProviderCognitoUserPoolCustomDomainConfigure ensures the provider is only configured once
31+
var testAccProviderCognitoUserPoolCustomDomainConfigure sync.Once
32+
33+
// testAccPreCheckCognitoUserPoolCustomDomain verifies AWS credentials and that Cognito User Pool Custom Domains is supported
34+
func testAccPreCheckCognitoUserPoolCustomDomain(t *testing.T) {
35+
testAccPartitionHasServicePreCheck(cognitoidentityprovider.EndpointsID, t)
36+
37+
// Since we are outside the scope of the Terraform configuration we must
38+
// call Configure() to properly initialize the provider configuration.
39+
testAccProviderCognitoUserPoolCustomDomainConfigure.Do(func() {
40+
testAccProviderCognitoUserPoolCustomDomain = Provider()
41+
42+
region := testAccGetCognitoUserPoolCustomDomainRegion()
43+
44+
if region == "" {
45+
t.Skip("Cognito User Pool Custom Domains not available in this AWS Partition")
46+
}
47+
48+
config := map[string]interface{}{
49+
"region": region,
50+
}
51+
52+
diags := testAccProviderCognitoUserPoolCustomDomain.Configure(context.Background(), terraform.NewResourceConfigRaw(config))
53+
54+
if diags != nil && diags.HasError() {
55+
for _, d := range diags {
56+
if d.Severity == diag.Error {
57+
t.Fatalf("error configuring Cognito User Pool Custom Domains provider: %s", d.Summary)
58+
}
59+
}
60+
}
61+
})
62+
}
63+
64+
// testAccCognitoUserPoolCustomDomainRegionProviderConfig is the Terraform provider configuration for Cognito User Pool Custom Domains region testing
65+
//
66+
// Testing Cognito User Pool Custom Domains assumes no other provider configurations
67+
// are necessary and overwrites the "aws" provider configuration.
68+
func testAccCognitoUserPoolCustomDomainRegionProviderConfig() string {
69+
return testAccRegionalProviderConfig(testAccGetCognitoUserPoolCustomDomainRegion())
70+
}
71+
72+
// testAccGetCognitoUserPoolCustomDomainRegion returns the Cognito User Pool Custom Domains region for testing
73+
func testAccGetCognitoUserPoolCustomDomainRegion() string {
74+
if testAccCognitoUserPoolCustomDomainRegion != "" {
75+
return testAccCognitoUserPoolCustomDomainRegion
76+
}
77+
78+
// AWS Commercial: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html
79+
// AWS GovCloud (US) - not supported: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-cog.html
80+
// AWS China - not supported: https://docs.amazonaws.cn/en_us/aws/latest/userguide/cognito.html
81+
switch testAccGetPartition() {
82+
case endpoints.AwsPartitionID:
83+
testAccCognitoUserPoolCustomDomainRegion = endpoints.UsEast1RegionID
84+
}
85+
86+
return testAccCognitoUserPoolCustomDomainRegion
87+
}

‎aws/resource_aws_acm_certificate_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,13 @@ func testAccAwsAcmCertificateDomainFromEnv(t *testing.T) string {
107107
}
108108

109109
// ACM domain names cannot be longer than 64 characters
110+
// Other resources, e.g. Cognito User Pool Domains, limit this to 63
110111
func testAccAwsAcmCertificateRandomSubDomain(rootDomain string) string {
111-
// Max length (64)
112+
// Max length (63)
112113
// Subtract "tf-acc-" prefix (7)
113114
// Subtract "." between prefix and root domain (1)
114115
// Subtract length of root domain
115-
return fmt.Sprintf("tf-acc-%s.%s", acctest.RandString(56-len(rootDomain)), rootDomain)
116+
return fmt.Sprintf("tf-acc-%s.%s", acctest.RandString(55-len(rootDomain)), rootDomain)
116117
}
117118

118119
func TestAccAWSAcmCertificate_emailValidation(t *testing.T) {

‎aws/resource_aws_cognito_user_pool_domain_test.go

+80-44
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
"errors"
55
"fmt"
66
"log"
7-
"os"
7+
"regexp"
88
"testing"
99

1010
"github.com/aws/aws-sdk-go/aws"
@@ -104,49 +104,38 @@ func TestAccAWSCognitoUserPoolDomain_basic(t *testing.T) {
104104
}
105105

106106
func TestAccAWSCognitoUserPoolDomain_custom(t *testing.T) {
107+
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)
108+
domain := testAccAwsAcmCertificateRandomSubDomain(rootDomain)
107109
poolName := fmt.Sprintf("tf-acc-test-pool-%s", acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum))
108-
// This test must always run in us-east-1
109-
// BadRequestException: Invalid certificate ARN: arn:aws:acm:us-west-2:123456789012:certificate/xxxxx. Certificate must be in 'us-east-1'.
110-
oldvar := os.Getenv("AWS_DEFAULT_REGION")
111-
os.Setenv("AWS_DEFAULT_REGION", "us-east-1")
112-
defer os.Setenv("AWS_DEFAULT_REGION", oldvar)
113-
114-
customDomainName := os.Getenv("AWS_COGNITO_USER_POOL_DOMAIN_ROOT_DOMAIN")
115-
if customDomainName == "" {
116-
t.Skip(
117-
"Environment variable AWS_COGNITO_USER_POOL_DOMAIN_ROOT_DOMAIN is not set. " +
118-
"This environment variable must be set to the fqdn of " +
119-
"an ISSUED ACM certificate in us-east-1 to enable this test.")
120-
}
121110

122-
customSubDomainName := fmt.Sprintf("%s.%s", fmt.Sprintf("tf-acc-test-domain-%d", acctest.RandInt()), customDomainName)
123-
// For now, use an environment variable to limit running this test
124-
certificateArn := os.Getenv("AWS_COGNITO_USER_POOL_DOMAIN_CERTIFICATE_ARN")
125-
if certificateArn == "" {
126-
t.Skip(
127-
"Environment variable AWS_COGNITO_USER_POOL_DOMAIN_CERTIFICATE_ARN is not set. " +
128-
"This environment variable must be set to the ARN of " +
129-
"an ISSUED ACM certificate in us-east-1 to enable this test.")
130-
}
111+
acmCertificateResourceName := "aws_acm_certificate.test"
112+
cognitoUserPoolResourceName := "aws_cognito_user_pool.test"
113+
resourceName := "aws_cognito_user_pool_domain.test"
131114

132115
resource.ParallelTest(t, resource.TestCase{
133-
PreCheck: func() { testAccPreCheck(t); testAccPreCheckAWSCognitoIdentityProvider(t) },
134-
Providers: testAccProviders,
135-
CheckDestroy: testAccCheckAWSCognitoUserPoolDomainDestroy,
116+
PreCheck: func() { testAccPreCheck(t); testAccPreCheckCognitoUserPoolCustomDomain(t) },
117+
ProviderFactories: testAccProviderFactories,
118+
CheckDestroy: testAccCheckAWSCognitoUserPoolDomainDestroy,
136119
Steps: []resource.TestStep{
137120
{
138-
Config: testAccAWSCognitoUserPoolDomainConfig_custom(customSubDomainName, poolName, certificateArn),
121+
Config: testAccAWSCognitoUserPoolDomainConfig_custom(rootDomain, domain, poolName),
139122
Check: resource.ComposeAggregateTestCheckFunc(
140-
testAccCheckAWSCognitoUserPoolDomainExists("aws_cognito_user_pool_domain.main"),
141-
resource.TestCheckResourceAttr("aws_cognito_user_pool_domain.main", "domain", customSubDomainName),
142-
resource.TestCheckResourceAttr("aws_cognito_user_pool_domain.main", "certificate_arn", certificateArn),
143-
resource.TestCheckResourceAttr("aws_cognito_user_pool.main", "name", poolName),
144-
resource.TestCheckResourceAttrSet("aws_cognito_user_pool_domain.main", "aws_account_id"),
145-
resource.TestCheckResourceAttrSet("aws_cognito_user_pool_domain.main", "cloudfront_distribution_arn"),
146-
resource.TestCheckResourceAttrSet("aws_cognito_user_pool_domain.main", "s3_bucket"),
147-
resource.TestCheckResourceAttrSet("aws_cognito_user_pool_domain.main", "version"),
123+
testAccCheckAWSCognitoUserPoolDomainExists(resourceName),
124+
testAccCheckResourceAttrAccountID(resourceName, "aws_account_id"),
125+
resource.TestCheckResourceAttrPair(resourceName, "certificate_arn", acmCertificateResourceName, "arn"),
126+
//lintignore:AWSAT001 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/11666
127+
resource.TestMatchResourceAttr(resourceName, "cloudfront_distribution_arn", regexp.MustCompile(`[a-z0-9]+.cloudfront.net$`)),
128+
resource.TestCheckResourceAttrPair(resourceName, "domain", acmCertificateResourceName, "domain_name"),
129+
resource.TestMatchResourceAttr(resourceName, "s3_bucket", regexp.MustCompile(`^.+$`)),
130+
resource.TestCheckResourceAttrPair(resourceName, "user_pool_id", cognitoUserPoolResourceName, "id"),
131+
resource.TestMatchResourceAttr(resourceName, "version", regexp.MustCompile(`^.+$`)),
148132
),
149133
},
134+
{
135+
ResourceName: resourceName,
136+
ImportState: true,
137+
ImportStateVerify: true,
138+
},
150139
},
151140
})
152141
}
@@ -230,16 +219,63 @@ resource "aws_cognito_user_pool" "main" {
230219
`, domainName, poolName)
231220
}
232221

233-
func testAccAWSCognitoUserPoolDomainConfig_custom(customSubDomainName, poolName, certificateArn string) string {
234-
return fmt.Sprintf(`
235-
resource "aws_cognito_user_pool_domain" "main" {
236-
domain = "%s"
237-
user_pool_id = aws_cognito_user_pool.main.id
238-
certificate_arn = "%s"
222+
func testAccAWSCognitoUserPoolDomainConfig_custom(rootDomain string, domain string, poolName string) string {
223+
return composeConfig(
224+
testAccCognitoUserPoolCustomDomainRegionProviderConfig(),
225+
fmt.Sprintf(`
226+
data "aws_route53_zone" "test" {
227+
name = %[1]q
228+
private_zone = false
239229
}
240230
241-
resource "aws_cognito_user_pool" "main" {
242-
name = "%s"
231+
resource "aws_acm_certificate" "test" {
232+
domain_name = %[2]q
233+
validation_method = "DNS"
234+
}
235+
236+
#
237+
# for_each acceptance testing requires:
238+
# https://github.com/hashicorp/terraform-plugin-sdk/issues/536
239+
#
240+
# resource "aws_route53_record" "test" {
241+
# for_each = {
242+
# for dvo in aws_acm_certificate.test.domain_validation_options: dvo.domain_name => {
243+
# name = dvo.resource_record_name
244+
# record = dvo.resource_record_value
245+
# type = dvo.resource_record_type
246+
# }
247+
# }
248+
249+
# allow_overwrite = true
250+
# name = each.value.name
251+
# records = [each.value.record]
252+
# ttl = 60
253+
# type = each.value.type
254+
# zone_id = data.aws_route53_zone.test.zone_id
255+
# }
256+
257+
resource "aws_route53_record" "test" {
258+
allow_overwrite = true
259+
name = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_name
260+
records = [tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_value]
261+
ttl = 60
262+
type = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_type
263+
zone_id = data.aws_route53_zone.test.zone_id
264+
}
265+
266+
resource "aws_acm_certificate_validation" "test" {
267+
certificate_arn = aws_acm_certificate.test.arn
268+
validation_record_fqdns = [aws_route53_record.test.fqdn]
269+
}
270+
271+
resource "aws_cognito_user_pool" "test" {
272+
name = %[3]q
273+
}
274+
275+
resource "aws_cognito_user_pool_domain" "test" {
276+
certificate_arn = aws_acm_certificate_validation.test.certificate_arn
277+
domain = aws_acm_certificate.test.domain_name
278+
user_pool_id = aws_cognito_user_pool.test.id
243279
}
244-
`, customSubDomainName, certificateArn, poolName)
280+
`, rootDomain, domain, poolName))
245281
}

‎docs/MAINTAINING.md

-2
Original file line numberDiff line numberDiff line change
@@ -400,8 +400,6 @@ Environment variables (beyond standard AWS Go SDK ones) used by acceptance testi
400400
| `AWS_API_GATEWAY_DOMAIN_NAME_REGIONAL_CERTIFICATE_NAME_ENABLED` | Flag to enable API Gateway Domain Name regional certificate upload testing. |
401401
| `AWS_CODEBUILD_BITBUCKET_SOURCE_LOCATION` | BitBucket source URL for CodeBuild testing. CodeBuild must have access to this repository via OAuth or Source Credentials. Defaults to `https://terraform@bitbucket.org/terraform/aws-test.git`. |
402402
| `AWS_CODEBUILD_GITHUB_SOURCE_LOCATION` | GitHub source URL for CodeBuild testing. CodeBuild must have access to this repository via OAuth or Source Credentials. Defaults to `https://github.com/hashibot-test/aws-test.git`. |
403-
| `AWS_COGNITO_USER_POOL_DOMAIN_CERTIFICATE_ARN` | Amazon Resource Name of ACM Certificate in `us-east-1` for Cognito User Pool Domain Name testing. |
404-
| `AWS_COGNITO_USER_POOL_DOMAIN_ROOT_DOMAIN` | Root domain name to use with Cognito User Pool Domain testing. |
405403
| `AWS_DEFAULT_REGION` | Primary AWS region for tests. Defaults to `us-west-2`. |
406404
| `AWS_EC2_CLASSIC_REGION` | AWS region for EC2-Classic testing. Defaults to `us-east-1` in AWS Commercial and `AWS_DEFAULT_REGION` otherwise. |
407405
| `AWS_EC2_CLIENT_VPN_LIMIT` | Concurrency limit for Client VPN acceptance tests. [Default is 5](https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/limits.html) if not specified. |

0 commit comments

Comments
 (0)