-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix: env0_aws_credentials - apply after import will delete+create #371
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
package client | ||
|
||
type NotFoundError struct{} | ||
|
||
func (e *NotFoundError) Error() string { | ||
return "not found" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
package env0 | ||
|
||
import ( | ||
"fmt" | ||
"log" | ||
"strings" | ||
|
||
"github.com/env0/terraform-provider-env0/client" | ||
"github.com/google/uuid" | ||
) | ||
|
||
func getCredentialsByName(name string, prefix string, meta interface{}) (client.Credentials, error) { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Common helper functions for credentials (can be used by GCP and Azure in the future). (In case import is added to them as well). |
||
apiClient := meta.(client.ApiClientInterface) | ||
|
||
credentialsList, err := apiClient.CloudCredentialsList() | ||
if err != nil { | ||
return client.Credentials{}, err | ||
} | ||
|
||
var foundCredentials []client.Credentials | ||
for _, credentials := range credentialsList { | ||
if credentials.Name == name && strings.HasPrefix(credentials.Type, prefix) { | ||
foundCredentials = append(foundCredentials, credentials) | ||
} | ||
} | ||
|
||
if len(foundCredentials) == 0 { | ||
return client.Credentials{}, fmt.Errorf("credentials with name %v not found", name) | ||
} | ||
|
||
if len(foundCredentials) > 1 { | ||
return client.Credentials{}, fmt.Errorf("found multiple credentials with name: %s. Use id instead or make sure credential names are unique %v", name, foundCredentials) | ||
} | ||
|
||
return foundCredentials[0], nil | ||
} | ||
|
||
func getCredentials(id string, prefix string, meta interface{}) (client.Credentials, error) { | ||
_, err := uuid.Parse(id) | ||
if err == nil { | ||
log.Println("[INFO] Resolving credentials by id: ", id) | ||
return meta.(client.ApiClientInterface).CloudCredentials(id) | ||
} else { | ||
log.Println("[INFO] Resolving credentials by name: ", id) | ||
return getCredentialsByName(id, prefix, meta) | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -61,7 +61,7 @@ func dataNotificationRead(ctx context.Context, d *schema.ResourceData, meta inte | |
} | ||
|
||
if err := writeResourceData(notification, d); err != nil { | ||
diag.Errorf("schema resource data serialization failed: %v", err) | ||
return diag.Errorf("schema resource data serialization failed: %v", err) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. bug. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. there are a few places with the same bug... |
||
} | ||
|
||
return nil | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,6 +2,7 @@ package env0 | |
|
||
import ( | ||
"context" | ||
"fmt" | ||
|
||
"github.com/env0/terraform-provider-env0/client" | ||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag" | ||
|
@@ -14,6 +15,8 @@ func resourceAwsCredentials() *schema.Resource { | |
ReadContext: resourceAwsCredentialsRead, | ||
DeleteContext: resourceAwsCredentialsDelete, | ||
|
||
Importer: &schema.ResourceImporter{StateContext: resourceAwsCredentialsImport}, | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @TomerHeber if we're already at it, can we perhaps also support import for all other credentials type? I'd do it in a separate PR tho There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. keeping the issue open. |
||
|
||
Schema: map[string]*schema.Schema{ | ||
"name": { | ||
Type: schema.TypeString, | ||
|
@@ -27,7 +30,6 @@ func resourceAwsCredentials() *schema.Resource { | |
Optional: true, | ||
ForceNew: true, | ||
ConflictsWith: []string{"access_key_id"}, | ||
ExactlyOneOf: []string{"access_key_id"}, | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The "ExactlyOneOf" cannot be enforced in the schema level. (Will fail on import). |
||
}, | ||
"external_id": { | ||
Type: schema.TypeString, | ||
|
@@ -46,7 +48,6 @@ func resourceAwsCredentials() *schema.Resource { | |
ForceNew: true, | ||
ConflictsWith: []string{"arn", "external_id"}, | ||
RequiredWith: []string{"secret_access_key"}, | ||
ExactlyOneOf: []string{"arn"}, | ||
}, | ||
"secret_access_key": { | ||
Type: schema.TypeString, | ||
|
@@ -62,29 +63,32 @@ func resourceAwsCredentials() *schema.Resource { | |
} | ||
|
||
func resourceAwsCredentialsCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
_, accessKeyExist := d.GetOk("access_key_id") | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Enforcing the exactlyOnce in the code level only for creation (not for read/import). |
||
_, arnExist := d.GetOk("arn") | ||
if !accessKeyExist && !arnExist { | ||
// Due to "import" must be inforced here and not in the schema level. | ||
// This fields are only available during creation (will not be returned in read or import). | ||
return diag.Errorf("one of `access_key_id,arn` must be specified") | ||
} | ||
|
||
apiClient := meta.(client.ApiClientInterface) | ||
|
||
value := client.AwsCredentialsValuePayload{} | ||
requestType := client.AwsAssumedRoleCredentialsType | ||
if arn, ok := d.GetOk("arn"); ok { | ||
value.RoleArn = arn.(string) | ||
requestType = client.AwsAssumedRoleCredentialsType | ||
} | ||
if externalId, ok := d.GetOk("external_id"); ok { | ||
value.ExternalId = externalId.(string) | ||
if err := readResourceData(&value, d); err != nil { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. some small refactoring (less lines of code). |
||
return diag.Errorf("schema resource data deserialization failed: %v", err) | ||
} | ||
if accessKeyId, ok := d.GetOk("access_key_id"); ok { | ||
value.AccessKeyId = accessKeyId.(string) | ||
|
||
requestType := client.AwsAssumedRoleCredentialsType | ||
if _, ok := d.GetOk("access_key_id"); ok { | ||
requestType = client.AwsAccessKeysCredentialsType | ||
} | ||
if secretAccessKey, ok := d.GetOk("secret_access_key"); ok { | ||
value.SecretAccessKey = secretAccessKey.(string) | ||
} | ||
|
||
request := client.AwsCredentialsCreatePayload{ | ||
Name: d.Get("name").(string), | ||
Value: value, | ||
Type: requestType, | ||
} | ||
|
||
credentials, err := apiClient.AwsCredentialsCreate(request) | ||
if err != nil { | ||
return diag.Errorf("could not create credentials key: %v", err) | ||
|
@@ -98,11 +102,15 @@ func resourceAwsCredentialsCreate(ctx context.Context, d *schema.ResourceData, m | |
func resourceAwsCredentialsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
apiClient := meta.(client.ApiClientInterface) | ||
|
||
id := d.Id() | ||
_, err := apiClient.CloudCredentials(id) | ||
credentials, err := apiClient.CloudCredentials(d.Id()) | ||
if err != nil { | ||
return ResourceGetFailure("aws credentials", d, err) | ||
} | ||
|
||
if err := writeResourceData(&credentials, d); err != nil { | ||
return diag.Errorf("schema resource data serialization failed: %v", err) | ||
} | ||
|
||
return nil | ||
} | ||
|
||
|
@@ -116,3 +124,19 @@ func resourceAwsCredentialsDelete(ctx context.Context, d *schema.ResourceData, m | |
} | ||
return nil | ||
} | ||
|
||
func resourceAwsCredentialsImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) { | ||
credentials, err := getCredentials(d.Id(), "AWS_", meta) | ||
if err != nil { | ||
if _, ok := err.(*client.NotFoundError); ok { | ||
return nil, fmt.Errorf("aws credentials resource with id %v not found", d.Id()) | ||
} | ||
return nil, err | ||
} | ||
|
||
if err := writeResourceData(&credentials, d); err != nil { | ||
return nil, fmt.Errorf("schema resource data serialization failed: %v", err) | ||
} | ||
|
||
return []*schema.ResourceData{d}, nil | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Used to handle drift later.