Skip to content

Commit 90e140f

Browse files
ewbankkitewbankkit
authored
Merge pull request #27693 from juhala-aws/b-vpn-connection-schema
Change parameter to optional and add test
2 parents de8b20f + 49ac68c commit 90e140f

File tree

4 files changed

+122
-13
lines changed

4 files changed

+122
-13
lines changed

‎.changelog/27693.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
resource/aws_vpn_connection: Configuring exactly one of `transit_gateway_id` or `vpn_gateway_id` is not required
3+
```

‎internal/service/ec2/vpnsite_connection.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,9 @@ func ResourceVPNConnection() *schema.Resource {
128128
Computed: true,
129129
},
130130
"transit_gateway_id": {
131-
Type: schema.TypeString,
132-
Optional: true,
133-
ExactlyOneOf: []string{"transit_gateway_id", "vpn_gateway_id"},
131+
Type: schema.TypeString,
132+
Optional: true,
133+
ConflictsWith: []string{"vpn_gateway_id"},
134134
},
135135
"transport_transit_gateway_attachment_id": {
136136
Type: schema.TypeString,
@@ -608,9 +608,9 @@ func ResourceVPNConnection() *schema.Resource {
608608
},
609609
},
610610
"vpn_gateway_id": {
611-
Type: schema.TypeString,
612-
Optional: true,
613-
ExactlyOneOf: []string{"transit_gateway_id", "vpn_gateway_id"},
611+
Type: schema.TypeString,
612+
Optional: true,
613+
ConflictsWith: []string{"transit_gateway_id"},
614614
},
615615
},
616616

‎internal/service/ec2/vpnsite_connection_test.go

+112
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,99 @@ func TestAccSiteVPNConnection_basic(t *testing.T) {
241241
})
242242
}
243243

244+
func TestAccSiteVPNConnection_withoutTGWorVGW(t *testing.T) {
245+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
246+
rBgpAsn := sdkacctest.RandIntRange(64512, 65534)
247+
resourceName := "aws_vpn_connection.test"
248+
var vpn ec2.VpnConnection
249+
250+
resource.ParallelTest(t, resource.TestCase{
251+
PreCheck: func() { acctest.PreCheck(t) },
252+
ErrorCheck: acctest.ErrorCheck(t, ec2.EndpointsID),
253+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
254+
CheckDestroy: testAccVPNConnectionDestroy,
255+
Steps: []resource.TestStep{
256+
{
257+
Config: testAccSiteVPNConnectionConfig_withoutTGWorVGW(rName, rBgpAsn),
258+
Check: resource.ComposeAggregateTestCheckFunc(
259+
testAccVPNConnectionExists(resourceName, &vpn),
260+
acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpn-connection/vpn-.+`)),
261+
resource.TestCheckResourceAttr(resourceName, "core_network_arn", ""),
262+
resource.TestCheckResourceAttr(resourceName, "core_network_attachment_arn", ""),
263+
resource.TestCheckResourceAttrSet(resourceName, "customer_gateway_configuration"),
264+
resource.TestCheckResourceAttr(resourceName, "enable_acceleration", "false"),
265+
resource.TestCheckResourceAttr(resourceName, "local_ipv4_network_cidr", "0.0.0.0/0"),
266+
resource.TestCheckResourceAttr(resourceName, "local_ipv6_network_cidr", ""),
267+
resource.TestCheckResourceAttr(resourceName, "outside_ip_address_type", "PublicIpv4"),
268+
resource.TestCheckResourceAttr(resourceName, "remote_ipv4_network_cidr", "0.0.0.0/0"),
269+
resource.TestCheckResourceAttr(resourceName, "remote_ipv6_network_cidr", ""),
270+
resource.TestCheckResourceAttr(resourceName, "routes.#", "0"),
271+
resource.TestCheckResourceAttr(resourceName, "static_routes_only", "false"),
272+
resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
273+
resource.TestCheckResourceAttr(resourceName, "transit_gateway_attachment_id", ""),
274+
resource.TestCheckResourceAttrSet(resourceName, "tunnel1_address"),
275+
resource.TestCheckResourceAttr(resourceName, "tunnel1_bgp_holdtime", "30"),
276+
resource.TestCheckResourceAttrSet(resourceName, "tunnel1_cgw_inside_address"),
277+
resource.TestCheckResourceAttr(resourceName, "tunnel1_dpd_timeout_action", ""),
278+
resource.TestCheckResourceAttr(resourceName, "tunnel1_dpd_timeout_seconds", "0"),
279+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_ike_versions"),
280+
resource.TestCheckResourceAttrSet(resourceName, "tunnel1_inside_cidr"),
281+
resource.TestCheckResourceAttr(resourceName, "tunnel1_inside_ipv6_cidr", ""),
282+
resource.TestCheckResourceAttr(resourceName, "tunnel1_log_options.#", "1"),
283+
resource.TestCheckResourceAttr(resourceName, "tunnel1_log_options.0.cloudwatch_log_options.#", "1"),
284+
resource.TestCheckResourceAttr(resourceName, "tunnel1_log_options.0.cloudwatch_log_options.0.log_enabled", "false"),
285+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase1_dh_group_numbers"),
286+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase1_encryption_algorithms"),
287+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase1_integrity_algorithms"),
288+
resource.TestCheckResourceAttr(resourceName, "tunnel1_phase1_lifetime_seconds", "0"),
289+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase2_dh_group_numbers"),
290+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase2_encryption_algorithms"),
291+
resource.TestCheckNoResourceAttr(resourceName, "tunnel1_phase2_integrity_algorithms"),
292+
resource.TestCheckResourceAttr(resourceName, "tunnel1_phase2_lifetime_seconds", "0"),
293+
resource.TestCheckResourceAttrSet(resourceName, "tunnel1_preshared_key"),
294+
resource.TestCheckResourceAttr(resourceName, "tunnel1_rekey_fuzz_percentage", "0"),
295+
resource.TestCheckResourceAttr(resourceName, "tunnel1_rekey_margin_time_seconds", "0"),
296+
resource.TestCheckResourceAttr(resourceName, "tunnel1_replay_window_size", "0"),
297+
resource.TestCheckResourceAttr(resourceName, "tunnel1_startup_action", ""),
298+
resource.TestCheckResourceAttrSet(resourceName, "tunnel1_vgw_inside_address"),
299+
resource.TestCheckResourceAttrSet(resourceName, "tunnel2_address"),
300+
resource.TestCheckResourceAttr(resourceName, "tunnel2_bgp_holdtime", "30"),
301+
resource.TestCheckResourceAttrSet(resourceName, "tunnel2_cgw_inside_address"),
302+
resource.TestCheckResourceAttr(resourceName, "tunnel2_dpd_timeout_action", ""),
303+
resource.TestCheckResourceAttr(resourceName, "tunnel2_dpd_timeout_seconds", "0"),
304+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_ike_versions"),
305+
resource.TestCheckResourceAttrSet(resourceName, "tunnel2_inside_cidr"),
306+
resource.TestCheckResourceAttr(resourceName, "tunnel2_inside_ipv6_cidr", ""),
307+
resource.TestCheckResourceAttr(resourceName, "tunnel2_log_options.#", "1"),
308+
resource.TestCheckResourceAttr(resourceName, "tunnel2_log_options.0.cloudwatch_log_options.#", "1"),
309+
resource.TestCheckResourceAttr(resourceName, "tunnel2_log_options.0.cloudwatch_log_options.0.log_enabled", "false"),
310+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase1_dh_group_numbers"),
311+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase1_encryption_algorithms"),
312+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase1_integrity_algorithms"),
313+
resource.TestCheckResourceAttr(resourceName, "tunnel2_phase1_lifetime_seconds", "0"),
314+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase2_dh_group_numbers"),
315+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase2_encryption_algorithms"),
316+
resource.TestCheckNoResourceAttr(resourceName, "tunnel2_phase2_integrity_algorithms"),
317+
resource.TestCheckResourceAttr(resourceName, "tunnel2_phase2_lifetime_seconds", "0"),
318+
resource.TestCheckResourceAttrSet(resourceName, "tunnel2_preshared_key"),
319+
resource.TestCheckResourceAttr(resourceName, "tunnel2_rekey_fuzz_percentage", "0"),
320+
resource.TestCheckResourceAttr(resourceName, "tunnel2_rekey_margin_time_seconds", "0"),
321+
resource.TestCheckResourceAttr(resourceName, "tunnel2_replay_window_size", "0"),
322+
resource.TestCheckResourceAttr(resourceName, "tunnel2_startup_action", ""),
323+
resource.TestCheckResourceAttrSet(resourceName, "tunnel2_vgw_inside_address"),
324+
resource.TestCheckResourceAttr(resourceName, "tunnel_inside_ip_version", "ipv4"),
325+
resource.TestCheckResourceAttr(resourceName, "vgw_telemetry.#", "2"),
326+
),
327+
},
328+
{
329+
ResourceName: resourceName,
330+
ImportState: true,
331+
ImportStateVerify: true,
332+
},
333+
},
334+
})
335+
}
336+
244337
func TestAccSiteVPNConnection_cloudWatchLogOptions(t *testing.T) {
245338
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
246339
rBgpAsn := sdkacctest.RandIntRange(64512, 65534)
@@ -1626,6 +1719,25 @@ resource "aws_vpn_connection" "test" {
16261719
`, rName, rBgpAsn)
16271720
}
16281721

1722+
func testAccSiteVPNConnectionConfig_withoutTGWorVGW(rName string, rBgpAsn int) string {
1723+
return fmt.Sprintf(`
1724+
resource "aws_customer_gateway" "test" {
1725+
bgp_asn = %[2]d
1726+
ip_address = "178.0.0.1"
1727+
type = "ipsec.1"
1728+
1729+
tags = {
1730+
Name = %[1]q
1731+
}
1732+
}
1733+
1734+
resource "aws_vpn_connection" "test" {
1735+
customer_gateway_id = aws_customer_gateway.test.id
1736+
type = "ipsec.1"
1737+
}
1738+
`, rName, rBgpAsn)
1739+
}
1740+
16291741
func testAccSiteVPNConnectionConfig_cloudWatchLogOptions(rName string, rBgpAsn int) string {
16301742
return fmt.Sprintf(`
16311743
resource "aws_vpn_gateway" "test" {

‎website/docs/r/vpn_connection.html.markdown

+1-7
Original file line numberDiff line numberDiff line change
@@ -121,18 +121,12 @@ resource "aws_vpn_connection" "example" {
121121

122122
## Argument Reference
123123

124-
The following arguments are required:
124+
The following arguments are supported:
125125

126126
* `customer_gateway_id` - (Required) The ID of the customer gateway.
127127
* `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
128-
129-
One of the following arguments is required:
130-
131128
* `transit_gateway_id` - (Optional) The ID of the EC2 Transit Gateway.
132129
* `vpn_gateway_id` - (Optional) The ID of the Virtual Private Gateway.
133-
134-
Other arguments:
135-
136130
* `static_routes_only` - (Optional, Default `false`) Whether the VPN connection uses static routes exclusively. Static routes must be used for devices that don't support BGP.
137131
* `enable_acceleration` - (Optional, Default `false`) Indicate whether to enable acceleration for the VPN connection. Supports only EC2 Transit Gateway.
138132
* `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.

0 commit comments

Comments
 (0)