diff --git a/aws/data_source_aws_s3_bucket_policy.go b/aws/data_source_aws_s3_bucket_policy.go new file mode 100644 index 000000000000..5c42fd9af809 --- /dev/null +++ b/aws/data_source_aws_s3_bucket_policy.go @@ -0,0 +1,65 @@ +package aws + +import ( + "fmt" + "log" + + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awserr" + "github.com/aws/aws-sdk-go/service/s3" + "github.com/hashicorp/terraform/helper/schema" +) + +func dataSourceAwsS3BucketPolicy() *schema.Resource { + return &schema.Resource{ + Read: dataSourceAwsS3BucketPolicyRead, + + Schema: map[string]*schema.Schema{ + "bucket": { + Type: schema.TypeString, + Required: true, + }, + "policy": { + Type: schema.TypeString, + Computed: true, + }, + }, + } +} + +func dataSourceAwsS3BucketPolicyRead(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).s3conn + + bucket := d.Get("bucket").(string) + + input := &s3.GetBucketPolicyInput{ + Bucket: aws.String(bucket), + } + + log.Printf("[DEBUG] Reading S3 bucket policy: %s", input) + result, err := conn.GetBucketPolicy(input) + + policy := "" + + if err != nil { + log.Printf("[DEBUG] Error reading S3 bucket policy: %q", err) + + if reqerr, ok := err.(awserr.RequestFailure); ok { + log.Printf("[DEBUG] Request failure reading S3 bucket policy: %q", reqerr) + + // ignore error if bucket policy doesn't exist + if reqerr.StatusCode() != 404 { + return fmt.Errorf("Failed getting S3 bucket policy: %s Bucket: %q", err, bucket) + } + } else { + return fmt.Errorf("Failed getting S3 bucket policy: %s Bucket: %q", err, bucket) + } + } else { + policy = *result.Policy + } + + d.SetId(bucket) + d.Set("policy", policy) + + return nil +} diff --git a/aws/data_source_aws_s3_bucket_policy_test.go b/aws/data_source_aws_s3_bucket_policy_test.go new file mode 100644 index 000000000000..d43e4d203c02 --- /dev/null +++ b/aws/data_source_aws_s3_bucket_policy_test.go @@ -0,0 +1,93 @@ +package aws + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform/helper/acctest" + "github.com/hashicorp/terraform/helper/resource" +) + +func TestAccDataSourceS3BucketPolicy_basic(t *testing.T) { + name := fmt.Sprintf("tf-test-bucket-%d", acctest.RandInt()) + partition := testAccGetPartition() + + policy := fmt.Sprintf(`{ + "Version": "2012-10-17", + "Statement": [{ + "Sid": "", + "Effect": "Allow", + "Principal": {"AWS":"*"}, + "Action": "s3:*", + "Resource": ["arn:%s:s3:::%s/*","arn:%s:s3:::%s"] + }] +}`, partition, name, partition, name) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccAWSDataSourceS3BucketPolicyConfig_basic(name, policy), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSS3BucketExists("data.aws_s3_bucket_policy.bucket"), + testAccCheckAWSS3BucketHasPolicy("data.aws_s3_bucket_policy.bucket", policy), + ), + }, + }, + }) +} + +func TestAccDataSourceS3BucketPolicy_empty(t *testing.T) { + name := fmt.Sprintf("tf-test-bucket-%d", acctest.RandInt()) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccAWSDataSourceS3BucketPolicyConfig_empty(name), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSS3BucketExists("data.aws_s3_bucket_policy.bucket"), + ), + }, + }, + }) +} + +func testAccAWSDataSourceS3BucketPolicyConfig_basic(bucketName string, bucketPolicy string) string { + return fmt.Sprintf(` +resource "aws_s3_bucket" "bucket" { + bucket = "%s" + tags = { + TestName = "TestAccAWSDataSourceS3BucketPolicy" + } +} + +resource "aws_s3_bucket_policy" "bucket" { + bucket = "${aws_s3_bucket.bucket.id}" + policy = <