New Resource: aws_iam_service_linked_role #2985

robinjoseph08 · 2018-01-14T09:33:55Z

Fixes #921

TF_ACC=1 go test ./aws -v -run=TestAccAwsIamServiceLinkedRole -timeout 120m
=== RUN   TestAccAwsIamServiceLinkedRole
--- PASS: TestAccAwsIamServiceLinkedRole (22.98s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       23.015s

erikbor · 2018-02-05T04:44:54Z

We've encountered the same issue with AWS swapping to service roles -- could this get merged soon? Thanks @robinjoseph08 @apparentlymart !

roman-cnd · 2018-02-14T19:45:40Z

This is required to setup spot instances fleet for batch...

zabawaba99 · 2018-03-01T19:18:37Z

aws/resource_aws_iam_service_linked_role.go

+
+	_, err := conn.CreateServiceLinkedRole(params)
+
+	if err != nil {


I would suggest checking to see if the role already exists before creating it or handling the conflict error with something like

d.SetId(serviceName) if _, err := conn.CreateServiceLinkedRole(params); err != nil { aerr, ok := err.(awserr.Error) if ok && strings.Contains(aerr.Message(), "already taken") { if rerr := resourceAwsIamServiceLinkedRoleRead(d, meta); err != nil { return rerr } } if d.Id() == "" || !ok { return fmt.Errorf("Error creating service-linked role with name %s", serviceName) } } return nil

Otherwise, this will not apply cleanly on an account where the role already exist and is being used to scale production resources.

Could we instead just import that role since you can only have one global IAM service linked role?

bflad

Hi @robinjoseph08 thanks for this contribution and sorry for the delays in getting it reviewed. 😅 Can you please see the feedback below and let us know if you have any questions or do not have time to complete them? Thank you!

bflad · 2018-03-23T19:26:32Z

aws/resource_aws_iam_service_linked_role.go

+	}
+
+	if resp == nil || len(resp.Roles) == 0 {
+		d.SetId("")


Can you please add logging before this? log.Printf("[WARN] IAM service linked role %s not found, removing from state", d.Id())

bflad · 2018-03-23T19:39:18Z

aws/resource_aws_iam_service_linked_role.go

+		return fmt.Errorf("Error creating service-linked role with name %s", serviceName)
+	}
+
+	d.SetId(serviceName)


We should set this to the role ARN so we can utilize GetRole instead of the unsafe ListRoles (you can have multiple service linked roles for the same service when created with CustomSuffix)

@bflad Not sure if I'm just missing something, but it doesn't look like you can use the ARN with GetRole, just the role name. Should I use the role name as the Id? That doesn't seem right either, but that is what aws_iam_role does. Should I do what you mention for the DeleteServiceLinkedRole call and just parse the role name out of the ARN?

bflad · 2018-03-23T19:40:48Z

aws/resource_aws_iam_service_linked_role.go

+		return nil
+	}
+
+	role := resp.Roles[0]


Services can have multiple linked roles with custom suffixes, we should switch the read logic to GetRole 👍

bflad · 2018-03-23T19:41:55Z

aws/resource_aws_iam_service_linked_role.go

+	name := d.Get("name").(string)
+
+	params := &iam.DeleteServiceLinkedRoleInput{
+		RoleName: aws.String(name),


When d.SetId() is updated, d.Id() should contain the ARN we can parse for the name. 👍

bflad · 2018-03-23T19:43:28Z

aws/resource_aws_iam_service_linked_role.go

+	deletionTaskId := *resp.DeletionTaskId
+
+	stateConf := &resource.StateChangeConf{
+		Pending: []string{"IN_PROGRESS", "NOT_STARTED"},


Minor nitpick: can you please switch these to the SDK constants? e.g. iam. DeletionTaskStatusTypeInProgress

bflad · 2018-03-23T19:51:26Z

aws/resource_aws_iam_service_linked_role_test.go

+
+		resp, err := conn.ListRoles(params)
+
+		if err != nil || resp == nil {


This logic will currently ignore errors like PermissionDenied. It should return all errors except on isAWSErr(err, iam.ErrCodeNoSuchEntityException, "")

bflad · 2018-03-23T19:51:54Z

aws/resource_aws_iam_service_linked_role_test.go

+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
+		service_name := rs.Primary.ID


Same deal here with the ARN as above 👍

bflad · 2018-03-23T19:53:07Z

website/docs/r/iam_service_linked_role.html.markdown

+
+The following arguments are supported:
+
+* `aws_service_name` - (Required, Forces new resource) The AWS service to which this role is attached. You use a string similar to a URL but without the `http://` in front. For example: `elasticbeanstalk.amazonaws.com`


We should probably link to documentation about where to find these names here. 😄

I couldn't seem to find a list of all of the service domains, but the closest thing I found was this. Do you think it's sufficient?

bflad · 2018-03-23T19:54:15Z

aws/resource_aws_iam_service_linked_role_test.go

+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAwsIamServiceLinkedRole(t *testing.T) {


Please rename this to TestAccAWSIAMServiceLinkedRole_basic. It should also have a test step for testing import (I'll note below)

bflad · 2018-03-23T19:55:07Z

aws/resource_aws_iam_service_linked_role_test.go

+				Config: fmt.Sprintf(testAccAwsIamServiceLinkedRoleConfig, "elasticbeanstalk.amazonaws.com"),
+				Check:  testAccCheckAwsIamServiceLinkedRoleExists("aws_iam_service_linked_role.test"),
+			},
+		},


Missing import TestStep:

{ ResourceName: "aws_iam_service_linked_role.test", ImportState: true, ImportStateVerify: true, },

bflad · 2018-04-06T18:48:10Z

@robinjoseph08 can you take a look at the feedback above please or let us know if you cannot work on this?

robinjoseph08 · 2018-04-07T16:29:57Z

Thanks for the feedback all! I'll make the changes this weekend.

robinjoseph08 · 2018-04-07T18:47:34Z

@bflad updated with your requested changes, but I had a few questions to make sure I'm doing it as you expected. Let me know if there's anything else!

bflad · 2018-04-11T21:39:25Z

aws/resource_aws_iam_service_linked_role.go

+	resp, err := conn.CreateServiceLinkedRole(params)
+
+	if err != nil {
+		return fmt.Errorf("Error creating service-linked role with name %s", serviceName)


We should return the error messages here and on deletion 😄 I will fix post-merge.

bflad · 2018-04-18T18:18:48Z

This has been released in version 1.15.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

ghost · 2020-04-06T17:43:28Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

Ninir added enhancement Requests to existing resources that expand the functionality or scope. new-resource Introduces a new resource. service/iam Issues and PRs that pertain to the iam service. labels Jan 15, 2018

bflad added this to the v1.12.0 milestone Feb 21, 2018

bflad self-requested a review February 21, 2018 04:53

zabawaba99 reviewed Mar 1, 2018

View reviewed changes

bflad reviewed Mar 23, 2018

View reviewed changes

bflad modified the milestones: v1.12.0, v1.13.0 Mar 23, 2018

bflad added the waiting-response Maintainers are waiting on response from community or contributor. label Mar 23, 2018

bflad modified the milestones: v1.13.0, v1.14.0 Mar 29, 2018

bflad modified the milestones: v1.14.0, v1.15.0 Apr 6, 2018

New Resource: aws_iam_service_linked_role

35e7f93

ghost added the size/L Managed by automation to categorize the size of a PR. label Apr 7, 2018

bflad reviewed Apr 11, 2018

View reviewed changes

bflad removed the waiting-response Maintainers are waiting on response from community or contributor. label Apr 11, 2018

bflad merged commit 35e7f93 into hashicorp:master Apr 11, 2018

bflad added a commit that referenced this pull request Apr 11, 2018

Update CHANGELOG for #2985

c77020f

hashicorp locked and limited conversation to collaborators Apr 6, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Resource: aws_iam_service_linked_role #2985

New Resource: aws_iam_service_linked_role #2985

robinjoseph08 commented Jan 14, 2018 •

edited

erikbor commented Feb 5, 2018

roman-cnd commented Feb 14, 2018

zabawaba99 Mar 1, 2018

dthagard Mar 1, 2018

bflad left a comment

bflad Mar 23, 2018

bflad Mar 23, 2018

robinjoseph08 Apr 7, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

robinjoseph08 Apr 7, 2018

bflad Mar 23, 2018

bflad Mar 23, 2018

bflad commented Apr 6, 2018

robinjoseph08 commented Apr 7, 2018

robinjoseph08 commented Apr 7, 2018

bflad Apr 11, 2018

bflad commented Apr 18, 2018

ghost commented Apr 6, 2020


		_, err := conn.CreateServiceLinkedRole(params)

		if err != nil {


		resp, err := conn.ListRoles(params)

		if err != nil \|\| resp == nil {


		The following arguments are supported:

		* `aws_service_name` - (Required, Forces new resource) The AWS service to which this role is attached. You use a string similar to a URL but without the `http://` in front. For example: `elasticbeanstalk.amazonaws.com`

New Resource: aws_iam_service_linked_role #2985

New Resource: aws_iam_service_linked_role #2985

Conversation

robinjoseph08 commented Jan 14, 2018 • edited

erikbor commented Feb 5, 2018

roman-cnd commented Feb 14, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bflad left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bflad commented Apr 6, 2018

robinjoseph08 commented Apr 7, 2018

robinjoseph08 commented Apr 7, 2018

Choose a reason for hiding this comment

bflad commented Apr 18, 2018

ghost commented Apr 6, 2020

robinjoseph08 commented Jan 14, 2018 •

edited