forked from hashicorp/terraform
-
Notifications
You must be signed in to change notification settings - Fork 2
/
resource_aws_opsworks_permission.go
156 lines (135 loc) · 3.97 KB
/
resource_aws_opsworks_permission.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
package aws
import (
"fmt"
"log"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/service/opsworks"
"github.com/hashicorp/terraform/helper/resource"
"github.com/hashicorp/terraform/helper/schema"
)
func resourceAwsOpsworksPermission() *schema.Resource {
return &schema.Resource{
Create: resourceAwsOpsworksSetPermission,
Update: resourceAwsOpsworksSetPermission,
Delete: resourceAwsOpsworksPermissionDelete,
Read: resourceAwsOpsworksPermissionRead,
Schema: map[string]*schema.Schema{
"id": &schema.Schema{
Type: schema.TypeString,
Computed: true,
},
"allow_ssh": &schema.Schema{
Type: schema.TypeBool,
Computed: true,
Optional: true,
},
"allow_sudo": &schema.Schema{
Type: schema.TypeBool,
Computed: true,
Optional: true,
},
"user_arn": &schema.Schema{
Type: schema.TypeString,
Required: true,
},
// one of deny, show, deploy, manage, iam_only
"level": &schema.Schema{
Type: schema.TypeString,
Computed: true,
Optional: true,
ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
value := v.(string)
expected := [5]string{"deny", "show", "deploy", "manage", "iam_only"}
found := false
for _, b := range expected {
if b == value {
found = true
}
}
if !found {
errors = append(errors, fmt.Errorf(
"%q has to be one of [deny, show, deploy, manage, iam_only]", k))
}
return
},
},
"stack_id": &schema.Schema{
Type: schema.TypeString,
Computed: true,
Optional: true,
},
},
}
}
func resourceAwsOpsworksPermissionDelete(d *schema.ResourceData, meta interface{}) error {
return nil
}
func resourceAwsOpsworksPermissionRead(d *schema.ResourceData, meta interface{}) error {
client := meta.(*AWSClient).opsworksconn
req := &opsworks.DescribePermissionsInput{
IamUserArn: aws.String(d.Get("user_arn").(string)),
StackId: aws.String(d.Get("stack_id").(string)),
}
log.Printf("[DEBUG] Reading OpsWorks prermissions for: %s on stack: %s", d.Get("user_arn"), d.Get("stack_id"))
resp, err := client.DescribePermissions(req)
if err != nil {
if awserr, ok := err.(awserr.Error); ok {
if awserr.Code() == "ResourceNotFoundException" {
log.Printf("[INFO] Permission not found")
d.SetId("")
return nil
}
}
return err
}
found := false
id := ""
for _, permission := range resp.Permissions {
id = *permission.IamUserArn + *permission.StackId
if d.Get("user_arn").(string)+d.Get("stack_id").(string) == id {
found = true
d.SetId(id)
d.Set("id", id)
d.Set("allow_ssh", permission.AllowSsh)
d.Set("allow_sudo", permission.AllowSudo)
d.Set("user_arn", permission.IamUserArn)
d.Set("stack_id", permission.StackId)
d.Set("level", permission.Level)
}
}
if false == found {
d.SetId("")
log.Printf("[INFO] The correct permission could not be found for: %s on stack: %s", d.Get("user_arn"), d.Get("stack_id"))
}
return nil
}
func resourceAwsOpsworksSetPermission(d *schema.ResourceData, meta interface{}) error {
client := meta.(*AWSClient).opsworksconn
req := &opsworks.SetPermissionInput{
AllowSudo: aws.Bool(d.Get("allow_sudo").(bool)),
AllowSsh: aws.Bool(d.Get("allow_ssh").(bool)),
Level: aws.String(d.Get("level").(string)),
IamUserArn: aws.String(d.Get("user_arn").(string)),
StackId: aws.String(d.Get("stack_id").(string)),
}
err := resource.Retry(2*time.Minute, func() *resource.RetryError {
var cerr error
_, cerr = client.SetPermission(req)
if cerr != nil {
log.Printf("[INFO] client error")
if opserr, ok := cerr.(awserr.Error); ok {
// XXX: handle errors
log.Printf("[ERROR] OpsWorks error: %s message: %s", opserr.Code(), opserr.Message())
return resource.RetryableError(cerr)
}
return resource.NonRetryableError(cerr)
}
return nil
})
if err != nil {
return err
}
return resourceAwsOpsworksPermissionRead(d, meta)
}