New resource: aws_network_interface_sg_attachment

aws/provider.go

@@ -423,6 +423,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_s3_bucket_object":                         resourceAwsS3BucketObject(),
 			"aws_s3_bucket_notification":                   resourceAwsS3BucketNotification(),
 			"aws_security_group":                           resourceAwsSecurityGroup(),
+			"aws_security_group_attachment":                resourceAwsSecurityGroupAttachment(),
 			"aws_default_security_group":                   resourceAwsDefaultSecurityGroup(),
 			"aws_security_group_rule":                      resourceAwsSecurityGroupRule(),
 			"aws_simpledb_domain":                          resourceAwsSimpleDBDomain(),

aws/resource_aws_security_group_attachment.go

@@ -0,0 +1,173 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"reflect"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsSecurityGroupAttachment() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSecurityGroupAttachmentCreate,
+		Read:   resourceAwsSecurityGroupAttachmentRead,
+		Delete: resourceAwsSecurityGroupAttachmentDelete,
+		Schema: map[string]*schema.Schema{
+			"security_group_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"network_interface_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceAwsSecurityGroupAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
+	if err := attachSecurityGroupToInterface(d, meta); err != nil {
+		return err
+	}
+
+	return resourceAwsSecurityGroupAttachmentRead(d, meta)
+}
+
+func attachSecurityGroupToInterface(d *schema.ResourceData, meta interface{}) error {
+	sgID := d.Get("security_group_id").(string)
+	interfaceID := d.Get("network_interface_id").(string)
+
+	log.Printf("[INFO] Attaching security group %s to network interface ID %s", sgID, interfaceID)
+
+	conn := meta.(*AWSClient).ec2conn
+
+	dniParams := &ec2.DescribeNetworkInterfacesInput{
+		NetworkInterfaceIds: aws.StringSlice([]string{interfaceID}),
+	}
+
+	dniResp, err := conn.DescribeNetworkInterfaces(dniParams)
+	if err != nil {
+		return err
+	}
+
+	return addSGToENI(conn, sgID, dniResp.NetworkInterfaces[0])
+}
+
+func fetchNetworkInterface(conn *ec2.EC2, ifaceID string) (*ec2.NetworkInterface, error) {
+	dniParams := &ec2.DescribeNetworkInterfacesInput{
+		NetworkInterfaceIds: aws.StringSlice([]string{ifaceID}),
+	}
+
+	dniResp, err := conn.DescribeNetworkInterfaces(dniParams)
+	if err != nil {
+		return nil, err
+	}
+	return dniResp.NetworkInterfaces[0], nil
+}
+
+func addSGToENI(conn *ec2.EC2, sgID string, iface *ec2.NetworkInterface) error {
+	if sgExistsInENI(sgID, iface) {
+		return fmt.Errorf("security group %s already attached to interface ID %s", sgID, *iface.NetworkInterfaceId)
+	}
+	var groupIDs []string
+	for _, v := range iface.Groups {
+		groupIDs = append(groupIDs, *v.GroupId)
+	}
+	groupIDs = append(groupIDs, sgID)
+	params := &ec2.ModifyNetworkInterfaceAttributeInput{
+		NetworkInterfaceId: iface.NetworkInterfaceId,
+		Groups:             aws.StringSlice(groupIDs),
+	}
+
+	_, err := conn.ModifyNetworkInterfaceAttribute(params)
+	return err
+}
+
+func sgExistsInENI(sgID string, iface *ec2.NetworkInterface) bool {
+	for _, v := range iface.Groups {
+		if *v.GroupId == sgID {
+			return true
+		}
+	}
+	return false
+}
+
+func resourceAwsSecurityGroupAttachmentRead(d *schema.ResourceData, meta interface{}) error {
+	return refreshSecurityGroupWithInterface(d, meta)
+}
+
+func refreshSecurityGroupWithInterface(d *schema.ResourceData, meta interface{}) error {
+	sgID := d.Get("security_group_id").(string)
+	interfaceID := d.Get("network_interface_id").(string)
+
+	log.Printf("[INFO] Checking association of security group %s to network interface ID %s", sgID, interfaceID)
+
+	conn := meta.(*AWSClient).ec2conn
+
+	iface, err := fetchNetworkInterface(conn, interfaceID)
+	if err != nil {
+		return err
+	}
+
+	if sgExistsInENI(sgID, iface) {
+		d.SetId(fmt.Sprintf("%s_%s", sgID, interfaceID))
+	} else {
+		// The assocation does not exist when it should, taint this resource.
+		log.Printf("[WARN] Security group %s not associated with network interface ID %s, tainting", sgID, interfaceID)
+		d.SetId("")
+	}
+	return nil
+}
+
+func resourceAwsSecurityGroupAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
+	if err := detachSecurityGroupFromInterface(d, meta); err != nil {
+		return err
+	}
+
+	d.SetId("")
+	return nil
+}
+
+func detachSecurityGroupFromInterface(d *schema.ResourceData, meta interface{}) error {
+	sgID := d.Get("security_group_id").(string)
+	interfaceID := d.Get("network_interface_id").(string)
+
+	log.Printf("[INFO] Removing security group %s from instance ID %s", sgID, interfaceID)
+
+	conn := meta.(*AWSClient).ec2conn
+
+	iface, err := fetchNetworkInterface(conn, interfaceID)
+	if err != nil {
+		return err
+	}
+
+	return delSGFromENI(conn, sgID, iface)
+}
+
+func delSGFromENI(conn *ec2.EC2, sgID string, iface *ec2.NetworkInterface) error {
+	old := iface.Groups
+	var new []*string
+	for _, v := range iface.Groups {
+		if *v.GroupId == sgID {
+			continue
+		}
+		new = append(new, v.GroupId)
+	}
+	if reflect.DeepEqual(old, new) {
+		// The interface already didn't have the security group, nothing to do
+		return nil
+	}
+
+	params := &ec2.ModifyNetworkInterfaceAttributeInput{
+		NetworkInterfaceId: iface.NetworkInterfaceId,
+		Groups:             new,
+	}
+
+	_, err := conn.ModifyNetworkInterfaceAttribute(params)
+	return err
+}

aws/resource_aws_security_group_attachment_test.go

@@ -0,0 +1,120 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAwsSecurityGroupAttachment(t *testing.T) {
+	cases := []struct {
+		Name     string
+		External bool
+	}{
+		{
+			Name:     "instance primary interface",
+			External: false,
+		},
+		{
+			Name:     "externally supplied instance through data source",
+			External: true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			resource.Test(t, resource.TestCase{
+				PreCheck:  func() { testAccPreCheck(t) },
+				Providers: testAccProviders,
+				Steps: []resource.TestStep{
+					resource.TestStep{
+						Config: testAccAwsSecurityGroupAttachmentConfig(tc.External, true),
+						Check:  checkSecurityGroupAttachment(tc.External, true),
+					},
+					resource.TestStep{
+						Config: testAccAwsSecurityGroupAttachmentConfig(tc.External, false),
+						Check:  checkSecurityGroupAttachment(tc.External, false),
+					},
+				},
+			})
+		})
+	}
+}
+
+func testAccAwsSecurityGroupAttachmentConfig(external bool, attach bool) string {
+	baseConfig := `
+data "aws_ami" "ami" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["amzn-ami-hvm-*"]
+  }
+
+  owners = ["amazon"]
+}
+
+resource "aws_instance" "instance" {
+  instance_type = "t2.micro"
+  ami           = "${data.aws_ami.ami.id}"
+
+  tags = {
+    "type" = "terraform-test-instance"
+  }
+}
+
+data "aws_instance" "external_instance" {
+	instance_id = "${aws_instance.instance.id}"
+}
+
+resource "aws_security_group" "sg" {
+  tags = {
+    "type" = "terraform-test-security-group"
+  }
+}
+
+`
+	optionalConfig := `
+resource "aws_security_group_attachment" "sg_attachment" {
+  security_group_id    = "${aws_security_group.sg.id}"
+  network_interface_id = "${%saws_instance.%sinstance.%snetwork_interface_id}"
+}
+`
+
+	if attach {
+		externalResPre := ""
+		externalDataPre := ""
+		externalAttrPre := "primary_"
+		if external {
+			externalResPre = "data."
+			externalDataPre = "external_"
+			externalAttrPre = ""
+		}
+		return baseConfig + fmt.Sprintf(optionalConfig, externalResPre, externalDataPre, externalAttrPre)
+	}
+	return baseConfig
+}
+
+func checkSecurityGroupAttachment(external bool, expected bool) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).ec2conn
+
+		ifAttr := "primary_network_interface_id"
+		if external {
+			ifAttr = "network_interface_id"
+		}
+		interfaceID := s.Modules[0].Resources["aws_instance.instance"].Primary.Attributes[ifAttr]
+		sgID := s.Modules[0].Resources["aws_security_group.sg"].Primary.ID
+
+		iface, err := fetchNetworkInterface(conn, interfaceID)
+		if err != nil {
+			return err
+		}
+		actual := sgExistsInENI(sgID, iface)
+		if expected != actual {
+			return fmt.Errorf("expected existence of security group in ENI to be %t, got %t", expected, actual)
+		}
+		return nil
+	}
+}

website/aws.erb

@@ -1349,7 +1349,7 @@
                 </li>
 
 
-                <li<%= sidebar_current("docs-aws-resource-(default|customer|egress-only-internet-gateway|flow|internet-gateway|main-route|network|route-|security-group|subnet|vpc|vpn)") %>>
+                <li<%= sidebar_current("docs-aws-resource-(default|customer|egress-only-internet-gateway|flow|internet-gateway|main-route|network|route-|security-group|security-group-attachment|subnet|vpc|vpn)") %>>
                     <a href="#">VPC Resources</a>
                     <ul class="nav nav-visible">
 
@@ -1431,6 +1431,10 @@
                             <a href="/docs/providers/aws/r/security_group.html">aws_security_group</a>
                         </li>
 
+                        <li<%= sidebar_current("docs-aws-resource-security-group-attachment") %>>
+                            <a href="/docs/providers/aws/r/security_group_attachment.html">aws_security_group_attachment</a>
+                        </li>
+
                         <li<%= sidebar_current("docs-aws-resource-security-group-rule") %>>
                             <a href="/docs/providers/aws/r/security_group_rule.html">aws_security_group_rule</a>
                         </li>