feature(config): manage AWS Config Remediation Configuration #9348

andy-b-84 · 2019-07-16T09:38:11Z

Answering #7972
This is my 1st go development ever, so please feel free to tell me if I
did something in a bad way, which is most probable :)

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Fixes #7972

Release note for CHANGELOG:

Add support for AWS Config Remediation Configuration objects

Output from acceptance testing: (ran on a docker container with image golang:1.12.9-buster )

root@b12d15607224:/src# make testacc TESTARGS='-run=TestAccXXX'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -parallel 20 -run=TestAccXXX -timeout 120m
?       github.com/terraform-providers/terraform-provider-aws   [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       0.046s [no tests to run]
...

andy-b-84 · 2019-07-16T09:48:24Z

I'm starting to write acceptance tests ATM (and just saw Travis' failure, which I will fix ASAP)

andy-b-84 · 2019-07-22T08:48:19Z

I've read through https://github.com/terraform-providers/terraform-provider-aws/blob/master/.github/CONTRIBUTING.md#common-review-items , and aside from points Uses AWS Go SDK Constants & Uses TypeList and MaxItems: 1 , I think I got all of them right.
Thus I delete the [WIP] flag and go on for validation.

andy-b-84 · 2019-07-22T08:51:09Z

Note for the maintainers :
I messed up something in my go environment, I cannot run the tests on my machine anymore, neither with the make test command nor the go test command. If you could launch the make testacc TESTARGS='-run=TestAccXXX' you're talking about in the PR template, please, that would be great.

Answering hashicorp#7972 This is my 1st go development ever, so please feel free to tell me if I did something in a bad way, which is most probable :) feat(go): learn pointers usage feat(config): parse all simple fields chore(naming): replace ConfigRule by RemediationConfiguration feat(config): add read flatten function feat(config): add delete function feat(config): use TypeSet instead of TypeList, & parse ResourceValue feat(config): parse StaticValue feat(config) flatten remediation config parameters to nil, just to get the function signature right feat(config): flatten remediation config parameters

chore(tidy): remove unused import comments test(config): copy-paste config rule test to start from something feat(test): add shredder feat(config): add a remediation configuration exemple feat(test): add getter check feat(config): add 1st finished acc test feat(test): remove unadapted commented tests & add a second true test feat(test): add static values tests chore(fmt): format the file with make fmt fixup! chore(fmt): format the file with make fmt fix(test): add required on fields chore(lint): proceed with linter results chore(lint): use correct configuration

andy-b-84 · 2019-08-16T09:54:30Z

(force pushed because of a rebase on upstream)

andy-b-84 · 2019-08-16T13:19:38Z

I see you just added the code to support Organizations in AWS Config, @bflad .
Do you have any advice on my PR, or could you please paste the "Output from acceptance testing", as I cannot run this command on my computer?

bflad · 2019-08-16T14:59:04Z

Hey @andy-b-84 👋 Thank you for contributing this! We will certainly want to get support for this new resource added at some point.

I can provide you a quick review (a few minutes behind this comment) and potentially try and help troubleshoot your local Go environment here, but unfortunately at this time the maintainers are pretty backlogged. We would prefer that contributors can appropriately run their own acceptance testing if possible as it saves a lot of small back-and-forth GitHub interactions for troubleshooting and reviews. 😅 We can certainly try to answer specific questions when time permits though.

It would be super helpful to know what operating system you are using, how Go was installed, which version of Go, and what errors you are seeing when running make test (these need to be fixed first) and make testacc.

For general assistance just beyond folks who may be able to help you on GitHub here, there are also other potentially helpful resources for Terraform Provider/Go development including the community forums or Slack workspaces such as the Gophers Slack.

bflad

Hi @andy-b-84 👋 As promised, here is an initial review of the submitted code. Please reach out with any questions or if you do not have time to implement the feedback items.

Please also let us know about your testing issues or if you would prefer to discuss them in another forum. Thanks.

aws/resource_aws_config_remediation_configuration.go

aws/resource_aws_config_remediation_configuration_test.go

aws/structure.go

aws/provider.go

andy-b-84 · 2019-08-26T15:21:28Z

Thanks for the extensive review and proposed help for my dev environment @bflad , and sorry to answer only now : as you may have guessed I was on vacation :)
I'm going to go through all of this ASAP.

andy-b-84 · 2019-08-27T09:00:42Z

I started a thread on gophers#newbies : https://gophers.slack.com/archives/C02A8LZKT/p1566895456146900 in order to get help getting my environment working.

andy-b-84 · 2019-11-08T09:53:50Z

I'd like to add terraform-providers/aws-provider as a reviewer, but I don't have the Add reviewer button on top of the reviewers list

shannonrdunn · 2020-01-10T18:52:45Z

What happened with this? Would love to see this implemented.

sleerssen · 2020-02-10T18:00:01Z

Would love to see this in a release.

giuliocalzolari · 2020-02-27T09:50:23Z

Would awesome to have this feature

gdavison

Hi @andy-b-84, thanks for the contribution! And thanks for your patience with our delay in getting back to you.

In the time since you made the PR, we've changed a number of things internally in our code. One major change is that the schema and resource definitions have move to their own SDK. The best approach would be to rebase your code onto the current provider and use the updated plugin SDK.

I've made a number of other suggestions if you want to continue working on this or if you'd like us to complete it. If not, we understand. Let us know in a reply here. I'll check back by 24 June

gdavison · 2020-06-16T23:40:29Z

aws/resource_aws_config_remediation_configuration.go

+func expandConfigRemediationConfigurationParameters(configured *schema.Set) map[string]*configservice.RemediationParameterValue {
+	var staticValues []*string
+	results := make(map[string]*configservice.RemediationParameterValue)
+
+	emptyString := ""
+
+	for _, item := range configured.List() {
+		detail := item.(map[string]interface{})
+		rpv := configservice.RemediationParameterValue{}
+
+		if resourceValue, ok := detail["resource_value"].(string); ok {
+			rv := configservice.ResourceValue{
+				Value: &emptyString,
+			}
+			rpv.ResourceValue = &rv
+			results[resourceValue] = &rpv
+		}
+		if staticValue, ok := detail["static_value"].(map[string]string); ok {
+			value := staticValue["value"]
+			staticValues = make([]*string, 0)
+			staticValues = append(staticValues, &value)
+			sv := configservice.StaticValue{
+				Values: staticValues,
+			}
+			rpv.StaticValue = &sv
+			results[staticValue["key"]] = &rpv
+		}
+	}
+
+	return results
+}
+
+func flattenRemediationConfigurations(c []*configservice.RemediationConfiguration) []map[string]interface{} {
+	configurations := make([]map[string]interface{}, 0)
+
+	for _, bd := range c {
+		if bd.ConfigRuleName != nil && bd.Parameters != nil {
+			configuration := make(map[string]interface{})
+			configuration["config_rule_name"] = *bd.ConfigRuleName
+			configuration["parameters"] = flattenRemediationConfigurationParameters(bd.Parameters)
+			configuration["resource_type"] = *bd.ResourceType
+			configuration["target_id"] = *bd.TargetId
+			configuration["target_type"] = *bd.TargetType
+			configuration["target_version"] = *bd.TargetVersion
+
+			configurations = append(configurations, configuration)
+		}
+	}
+
+	if len(configurations) > 0 {
+		return configurations
+	}
+
+	return nil
+}


We prefer that the resource schema function (i.e. resourceAwsConfigRemediationConfiguration()) is at the top of the file

gdavison · 2020-06-16T23:50:10Z

aws/resource_aws_config_remediation_configuration.go

+		RemediationConfigurations: []*configservice.RemediationConfiguration{&remediationConfigurationInput},
+	}
+	log.Printf("[DEBUG] Creating AWSConfig remediation configuration: %s", input)
+	err := resource.Retry(2*time.Minute, func() *resource.RetryError {


We prefer named constants for timeout values

gdavison · 2020-06-16T23:53:44Z

aws/resource_aws_config_remediation_configuration.go

+
+		return nil
+	})
+	if err != nil {


We've started adding one last try after resource.Retry() in case of a timeout.

if isResourceTimeoutError(err) { _, err = conn.PutRemediationConfigurations(&input) }

gdavison · 2020-06-17T16:46:33Z

aws/resource_aws_config_remediation_configuration.go

+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/helper/validation"


We've separated the resource and schema functions into their own package, github.com/hashicorp/terraform-plugin-sdk/helper/*. Please update to use those packages.

gdavison · 2020-06-17T17:09:39Z

aws/resource_aws_config_remediation_configuration.go

+			value := staticValue["value"]
+			staticValues = make([]*string, 0)
+			staticValues = append(staticValues, &value)
+			sv := configservice.StaticValue{
+				Values: staticValues,
+			}
+			rpv.StaticValue = &sv
+			results[staticValue["key"]] = &rpv


This could be inlined, something like

results[staticValue["key"]] = &configservice.RemediationParameterValue{ StaticValue: &configservice.StaticValue{ Values: []*string{aws.String(staticValue["value"])}, }, }

gdavison · 2020-06-17T21:09:47Z

website/docs/r/config_remediation_configuration.html.markdown

+* `config_rule_name` - (Required) The name of the AWS Config rule
+* `resource_type` - (Optional) The type of a resource
+* `target_id` - (Required) Target ID is the name of the public document
+* `target_type` - (Required) The type of the target. Target executes remediation. For example, SSM document


Since this field only accepts a specific list of values, we should list the valid values. In this case, there's only one valid value, so it could read "The only current valid value is SSM_DOCUMENT"

gdavison · 2020-06-17T21:13:47Z

website/docs/r/config_remediation_configuration.html.markdown

+* `target_id` - (Required) Target ID is the name of the public document
+* `target_type` - (Required) The type of the target. Target executes remediation. For example, SSM document
+* `target_version` - (Required) Version of the target. For example, version of the SSM document
+


We should add an entry for parameters here at the top level, and have a description like "Up to 25 parameter blocks. Parameters are documented below."

gdavison · 2020-06-17T21:14:29Z

website/docs/r/config_remediation_configuration.html.markdown

+* `target_type` - (Required) The type of the target. Target executes remediation. For example, SSM document
+* `target_version` - (Required) Version of the target. For example, version of the SSM document
+
+### `parameters`


This heading should read "A parameters block supports the following arguments:"

gdavison · 2020-06-17T21:23:01Z

website/docs/r/config_remediation_configuration.html.markdown

+
+AWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
+
+```hcl


For examples in the documentation, it's better for them to be short so that the essential parts are more obvious. In this case, we'd be ok to remove the IAM resources, or possibly leave the definition but remove the attributes. It does have the trade-off that these long examples aren't executable as-is.

gdavison · 2020-06-17T21:25:53Z

website/docs/r/config_remediation_configuration.html.markdown

+
+Provides an AWS Config Remediation Configuration.
+
+~> **Note:** Config Remediation Configuration requires an existing [Config Rule](/docs/providers/aws/r/config_config_rule.html) to be present. Use of `depends_on` is recommended (as shown below) to avoid race conditions.


If we set the config_rule_name of the remediation to the name valueof the rule, then we can get the built-in Terraform dependency management without usingdepends_on`

mikeokner · 2020-06-19T19:24:00Z

I'm open to picking up the torch if necessary here.

cgetzen · 2020-06-22T23:58:35Z

Hello. I had to get this rolling quick for my org. This is rebased and added too. This is everything squashed (I figured there may be an issue with signing Andy's rebased commits with my key).

Feel free to merge either, or cherry-pick changes over to this PR, or just use my changes as refs. Thank you and looking forward to easily creating remediation configs :)

gdavison · 2020-09-16T21:08:56Z

This work was completed in #13884. Thanks, @andy-b-84 and @cgetzen!

ghost · 2020-09-17T23:32:50Z

This has been released in version 3.7.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

ghost · 2020-10-17T17:10:31Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

andy-b-84 requested a review from a team July 16, 2019 09:38

ghost added size/L Managed by automation to categorize the size of a PR. service/configservice Issues and PRs that pertain to the configservice service. labels Jul 16, 2019

ghost added size/XL Managed by automation to categorize the size of a PR. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. and removed size/L Managed by automation to categorize the size of a PR. labels Jul 16, 2019

andy-b-84 force-pushed the f-aws_config_remediation branch 2 times, most recently from f6d4338 to be57a6c Compare July 16, 2019 13:34

ghost added the provider Pertains to the provider itself, rather than any interaction with AWS. label Jul 16, 2019

andy-b-84 force-pushed the f-aws_config_remediation branch from 9f9bd41 to 1e4269b Compare July 19, 2019 08:04

andy-b-84 changed the title ~~WIP feature(config): manage AWS Config Remediation Configuration~~ [WIP] feature(config): manage AWS Config Remediation Configuration Jul 19, 2019

andy-b-84 force-pushed the f-aws_config_remediation branch from 6f9a501 to 1e4269b Compare July 19, 2019 13:21

andy-b-84 changed the title ~~[WIP] feature(config): manage AWS Config Remediation Configuration~~ feature(config): manage AWS Config Remediation Configuration Jul 22, 2019

Patrick Laxton added 2 commits August 16, 2019 11:50

andy-b-84 force-pushed the f-aws_config_remediation branch from 1e4269b to 9ce9044 Compare August 16, 2019 09:53

bflad added help wanted new-resource Introduces a new resource. labels Aug 16, 2019

bflad suggested changes Aug 16, 2019

View reviewed changes

bflad added the waiting-response Maintainers are waiting on response from community or contributor. label Aug 16, 2019

ghost removed the waiting-response Maintainers are waiting on response from community or contributor. label Aug 26, 2019

feedback(pr): 1st lot

bad9ae8

andy-b-84 force-pushed the f-aws_config_remediation branch from d523162 to 519662f Compare August 27, 2019 14:34

feedback(pr): 2nd lot

70be653

andy-b-84 force-pushed the f-aws_config_remediation branch from 519662f to 70be653 Compare August 27, 2019 14:36

ghost added the documentation Introduces or discusses updates to documentation. label Aug 27, 2019

feedback(pr): 3rd lot

d55268f

andy-b-84 force-pushed the f-aws_config_remediation branch from 4165150 to d55268f Compare August 28, 2019 07:10

bflad mentioned this pull request Sep 6, 2019

AWS Config remediation exceptions #10028

Closed

andy-b-84 requested a review from bflad September 17, 2019 09:10

aeschright requested a review from a team January 10, 2020 20:04

giuliocalzolari mentioned this pull request Feb 26, 2020

Support ConfigService Remediation Configuration #7972

Closed

gdavison self-assigned this Jun 16, 2020

gdavison requested changes Jun 17, 2020

View reviewed changes

cgetzen mentioned this pull request Jun 26, 2020

AWS Config Remediation Configuration (squashed) #13885

Closed

anGie44 force-pushed the master branch from 6c6566f to 081bf57 Compare June 29, 2020 16:15

cgetzen mentioned this pull request Jul 14, 2020

Aws Config Remediation #13884

Merged

gdavison added this to the v3.7.0 milestone Sep 16, 2020

gdavison closed this Sep 16, 2020

ghost locked as resolved and limited conversation to collaborators Oct 17, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature(config): manage AWS Config Remediation Configuration #9348

feature(config): manage AWS Config Remediation Configuration #9348

andy-b-84 commented Jul 16, 2019 •

edited

andy-b-84 commented Jul 16, 2019

andy-b-84 commented Jul 22, 2019

andy-b-84 commented Jul 22, 2019 •

edited

andy-b-84 commented Aug 16, 2019

andy-b-84 commented Aug 16, 2019

bflad commented Aug 16, 2019

bflad left a comment

andy-b-84 commented Aug 26, 2019

andy-b-84 commented Aug 27, 2019

andy-b-84 commented Nov 8, 2019

shannonrdunn commented Jan 10, 2020

sleerssen commented Feb 10, 2020

giuliocalzolari commented Feb 27, 2020 •

edited

gdavison left a comment

gdavison Jun 16, 2020

gdavison Jun 16, 2020

gdavison Jun 16, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

gdavison Jun 17, 2020

mikeokner commented Jun 19, 2020

cgetzen commented Jun 22, 2020

gdavison commented Sep 16, 2020

ghost commented Sep 17, 2020

ghost commented Oct 17, 2020


		AWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).

		```hcl


		Provides an AWS Config Remediation Configuration.

		~> Note: Config Remediation Configuration requires an existing [Config Rule](/docs/providers/aws/r/config_config_rule.html) to be present. Use of `depends_on` is recommended (as shown below) to avoid race conditions.

feature(config): manage AWS Config Remediation Configuration #9348

feature(config): manage AWS Config Remediation Configuration #9348

Conversation

andy-b-84 commented Jul 16, 2019 • edited

Community Note

andy-b-84 commented Jul 16, 2019

andy-b-84 commented Jul 22, 2019

andy-b-84 commented Jul 22, 2019 • edited

andy-b-84 commented Aug 16, 2019

andy-b-84 commented Aug 16, 2019

bflad commented Aug 16, 2019

bflad left a comment

Choose a reason for hiding this comment

andy-b-84 commented Aug 26, 2019

andy-b-84 commented Aug 27, 2019

andy-b-84 commented Nov 8, 2019

shannonrdunn commented Jan 10, 2020

sleerssen commented Feb 10, 2020

giuliocalzolari commented Feb 27, 2020 • edited

gdavison left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikeokner commented Jun 19, 2020

cgetzen commented Jun 22, 2020

gdavison commented Sep 16, 2020

ghost commented Sep 17, 2020

ghost commented Oct 17, 2020

andy-b-84 commented Jul 16, 2019 •

edited

andy-b-84 commented Jul 22, 2019 •

edited

giuliocalzolari commented Feb 27, 2020 •

edited