resource_fastly_tls_subscription.go

package fastly

import (
	"context"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"time"

	"github.com/fastly/go-fastly/v3/fastly"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
)

func resourceFastlyTLSSubscription() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceFastlyTLSSubscriptionCreate,
		ReadContext:   resourceFastlyTLSSubscriptionRead,
		UpdateContext: resourceFastlyTLSSubscriptionUpdate,
		DeleteContext: resourceFastlyTLSSubscriptionDelete,
		Importer: &schema.ResourceImporter{
			StateContext: schema.ImportStatePassthroughContext,
		},
		// Subscription can only be updated when in "issued" state, otherwise needs to delete/recreate
		CustomizeDiff: customdiff.All(
			customdiff.ForceNewIf("configuration_id", resourceFastlyTLSSubscriptionStateNotIssued),
			customdiff.ForceNewIf("domains", resourceFastlyTLSSubscriptionStateNotIssued),
			customdiff.ForceNewIf("common_name", resourceFastlyTLSSubscriptionStateNotIssued),
		),
		Schema: map[string]*schema.Schema{
			"domains": {
				Type:        schema.TypeSet,
				Description: "List of domains on which to enable TLS.",
				Required:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
				MinItems:    1,
			},
			"common_name": {
				Type:        schema.TypeString,
				Description: "The common name associated with the subscription generated by Fastly TLS. If you do not pass a common name on create, we will default to the first TLS domain included. If provided, the domain chosen as the common name must be included in TLS domains.",
				Optional:    true,
				Computed:    true,
			},
			"certificate_authority": {
				Type:         schema.TypeString,
				Description:  "The entity that issues and certifies the TLS certificates for your subscription. Valid values are `lets-encrypt` or `globalsign`.",
				Required:     true,
				ForceNew:     true,
				ValidateFunc: validation.StringInSlice([]string{"lets-encrypt", "globalsign"}, false),
			},
			"configuration_id": {
				Type:        schema.TypeString,
				Description: "The ID of the set of TLS configuration options that apply to the enabled domains on this subscription.",
				Optional:    true,
				Computed:    true,
			},
			"created_at": {
				Type:        schema.TypeString,
				Description: "Timestamp (GMT) when the subscription was created.",
				Computed:    true,
			},
			"updated_at": {
				Type:        schema.TypeString,
				Description: "Timestamp (GMT) when the subscription was updated.",
				Computed:    true,
			},
			"state": {
				Type:        schema.TypeString,
				Description: "The current state of the subscription. The list of possible states are: `pending`, `processing`, `issued`, and `renewing`.",
				Computed:    true,
			},
			"managed_dns_challenge": {
				Type:        schema.TypeMap,
				Description: "The details required to configure DNS to respond to ACME DNS challenge in order to verify domain ownership.",
				Computed:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
			},
			"managed_http_challenges": {
				Type:        schema.TypeSet,
				Description: "A list of options for configuring DNS to respond to ACME HTTP challenge in order to verify domain ownership. Best accessed through a `for` expression to filter the relevant record.",
				Computed:    true,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"record_type": {
							Type:        schema.TypeString,
							Description: "The type of DNS record to add, e.g. `A`, or `CNAME`.",
							Computed:    true,
						},
						"record_name": {
							Type:        schema.TypeString,
							Description: "The name of the DNS record to add. For example `example.com`. Best accessed through a `for` expression to filter the relevant record.",
							Computed:    true,
						},
						"record_values": {
							Type:        schema.TypeSet,
							Description: "A list with the value(s) to which the DNS record should point.",
							Computed:    true,
							Elem:        &schema.Schema{Type: schema.TypeString},
						},
					},
				},
			},
			"force_destroy": {
				Type:        schema.TypeBool,
				Description: "Force delete the subscription even if it has active domains. Warning: this can disable production traffic if used incorrectly. Defaults to false.",
				Optional:    true,
				Default:     false,
			},
			"force_update": {
				Type:        schema.TypeBool,
				Description: "Force update the subscription even if it has active domains. Warning: this can disable production traffic if used incorrectly.",
				Optional:    true,
				Default:     false,
			},
		},
	}
}

func resourceFastlyTLSSubscriptionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	var configuration *fastly.TLSConfiguration
	if v, ok := d.GetOk("configuration_id"); ok {
		configuration = &fastly.TLSConfiguration{ID: v.(string)}
	}

	var domains []*fastly.TLSDomain
	var domainStrings []string
	for _, domain := range d.Get("domains").(*schema.Set).List() {
		domains = append(domains, &fastly.TLSDomain{ID: domain.(string)})
		domainStrings = append(domainStrings, domain.(string))
	}

	var commonName *fastly.TLSDomain
	if v, ok := d.GetOk("common_name"); ok {
		if !contains(domainStrings, v.(string)) {
			return diag.Errorf("Domain specified as common_name (%s) must also be in domains (%v)", v, domainStrings)
		}

		commonName = &fastly.TLSDomain{ID: v.(string)}
	}

	subscription, err := conn.CreateTLSSubscription(&fastly.CreateTLSSubscriptionInput{
		CertificateAuthority: d.Get("certificate_authority").(string),
		Configuration:        configuration,
		Domains:              domains,
		CommonName:           commonName,
	})
	if err != nil {
		return diag.FromErr(err)
	}

	d.SetId(subscription.ID)

	return resourceFastlyTLSSubscriptionRead(ctx, d, meta)
}

func resourceFastlyTLSSubscriptionRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	include := "tls_authorizations"
	subscription, err := conn.GetTLSSubscription(&fastly.GetTLSSubscriptionInput{
		ID:      d.Id(),
		Include: &include,
	})
	if err != nil {
		return diag.FromErr(err)
	}

	var domains []string
	for _, domain := range subscription.Domains {
		domains = append(domains, domain.ID)
	}

	var managedHTTPChallenges []map[string]interface{}
	var managedDNSChallenge map[string]string
	for _, challenge := range subscription.Authorizations[0].Challenges {
		if challenge.Type == "managed-dns" {
			if len(challenge.Values) < 1 {
				return diag.Errorf("Fastly API returned no record values for Managed DNS Challenge")
			}

			managedDNSChallenge = map[string]string{
				"record_type":  challenge.RecordType,
				"record_name":  challenge.RecordName,
				"record_value": challenge.Values[0],
			}
		} else {
			managedHTTPChallenges = append(managedHTTPChallenges, map[string]interface{}{
				"record_type":   challenge.RecordType,
				"record_name":   challenge.RecordName,
				"record_values": challenge.Values,
			})
		}
	}

	err = d.Set("domains", domains)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("common_name", subscription.CommonName.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("certificate_authority", subscription.CertificateAuthority)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("configuration_id", subscription.Configuration.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("created_at", subscription.CreatedAt.Format(time.RFC3339))
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("updated_at", subscription.UpdatedAt.Format(time.RFC3339))
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("state", subscription.State)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("managed_dns_challenge", managedDNSChallenge)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("managed_http_challenges", managedHTTPChallenges)
	if err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceFastlyTLSSubscriptionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	updates := &fastly.UpdateTLSSubscriptionInput{
		ID:    d.Id(),
		Force: d.Get("force_update").(bool),
	}

	if d.HasChange("domains") {
		var domains []*fastly.TLSDomain
		for _, domain := range d.Get("domains").(*schema.Set).List() {
			domains = append(domains, &fastly.TLSDomain{ID: domain.(string)})
		}
		updates.Domains = domains
	}
	if d.HasChange("common_name") {
		updates.CommonName = &fastly.TLSDomain{ID: d.Get("common_name").(string)}
	}
	if d.HasChange("configuration_id") {
		updates.Configuration = &fastly.TLSConfiguration{ID: d.Get("configuration_id").(string)}
	}

	_, err := conn.UpdateTLSSubscription(updates)
	if err != nil {
		return diag.FromErr(err)
	}

	return resourceFastlyTLSSubscriptionRead(ctx, d, meta)
}

func resourceFastlyTLSSubscriptionDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	err := conn.DeleteTLSSubscription(&fastly.DeleteTLSSubscriptionInput{
		ID:    d.Id(),
		Force: d.Get("force_destroy").(bool),
	})
	return diag.FromErr(err)
}

func resourceFastlyTLSSubscriptionStateNotIssued(_ context.Context, d *schema.ResourceDiff, _ interface{}) bool {
	return d.Get("state").(string) != "issued"
}