New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Resource: r/aws_fms_admin_account #4310

Merged

bflad merged 1 commit into hashicorp:master from gazoakley:f-firewall-admin-account

Aug 1, 2019

Contributor

gazoakley commented Apr 22, 2018 •

edited

Closes #4057

New Resources:

aws_fms_admin_account

$ make testacc TESTARGS='-run=TestAccFmsAdminAccount_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -run=TestAccFmsAdminAccount_basic -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccFmsAdminAccount_basic
--- PASS: TestAccFmsAdminAccount_basic (43.60s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	43.643s

ghost added the size/L label

Contributor Author

gazoakley commented Apr 22, 2018

Seems like the call to AssociateAdminAccount returns success without actually doing anything if an organization has only recently been created - running the tests with a pre-existing organization passes. Might need to retry creating the association and waiting until GetAdminAccount returns the expected details.

gazoakley force-pushed the f-firewall-admin-account branch from 9a07724 to cb74563 Compare

April 23, 2018 09:27

ghost added the size/L label

gazoakley changed the title ~~[WIP] New resource: r/aws_fms_admin_account~~ New resource: r/aws_fms_admin_account

gazoakley changed the title ~~New resource: r/aws_fms_admin_account~~ New Resource: r/aws_fms_admin_account

bflad reviewed

View reviewed changes

Member

bflad left a comment

Thanks for this @gazoakley! Left some initial comments below. Please take a look and let us know if you have any questions.

aws/resource_aws_fms_admin_account.go Outdated

    
              		Schema: map[string]*schema.Schema{

              			"account_id": {

              				Type:         schema.TypeString,

              				Required:     true,

Member

bflad Apr 23, 2018

Can we instead make this Optional: true and use meta.(*AWSClient).accountid if its not provided? e.g.

if v, ok := d.GetOk("account_id"); ok && v != "" {
  accountID := v.(string)
} else {
  accountID := meta.(*AWSClient).accountid
}

aws/resource_aws_fms_admin_account.go Outdated

    
              		return fmt.Errorf("Error waiting for firewall manager admin account association (%s): %s", accountId, sterr)

              	}

              	d.SetId("fms-admin-account")

Member

bflad Apr 23, 2018

While we don't necessarily need to reference it during read/delete at the moment, can you set this to accountId still? It'll make the ID available if we need it in the future and the import a little more obvious:

# Currently:
terraform import aws_fms_admin_account.example fms-admin-account
# Proposed:
terraform import aws_fms_admin_account.example 123456789012

Contributor Author

gazoakley Apr 23, 2018

@bflad I adopted this approach from aws_iam_account_password_policy (aws_spot_datafeed_subscription does this too) since only one FMS admin account can be associated to an account. My concern is that the user can disassociate/associate a different admin account outside Terraform - it might be confusing/misleading to have the resource ID as an account ID different to associated admin account ID. I'm guessing it wouldn't be safe to call SetId during a read operation if the associated admin account has changed? Any suggestions?

Member

bflad Apr 23, 2018 •

edited

We can check d.Id() != aws.StringValue(res.AdminAccount) to trigger recreation:

if d.Id() != aws.StringValue(res.AdminAccount) {
  log.Printf("[WARN] FMS Admin Account does not match, removing from state", d.Id())
  d.SetId("")
  return nil
}

aws/resource_aws_fms_admin_account.go

    
              		Read:   resourceAwsFmsAdminAccountRead,

              		Delete: resourceAwsFmsAdminAccountDelete,

              		Importer: &schema.ResourceImporter{

Member

bflad Apr 23, 2018

Missing ## Import documentation section

aws/resource_aws_fms_admin_account.go

    
              		// but does not define this in its error codes

              		if isAWSErr(err, "AccessDeniedException", "is not currently delegated by AWS FM") {

              			log.Printf("[WARN] No associated firewall manager admin account found, removing from state: %s", d.Id())

              			d.SetId("")

Member

bflad Apr 23, 2018

We no longer need d.SetId("") during deletion functions. See also #4191

aws/resource_aws_fms_admin_account.go Outdated

    
              		return fmt.Errorf("Error disassociating firewall manager admin account: %s", err)

              	}

              	d.SetId("")

Member

bflad Apr 23, 2018

We no longer need d.SetId("") during deletion functions. See also #4191

aws/resource_aws_fms_admin_account_test.go Outdated

    
              	conn := testAccProvider.Meta().(*AWSClient).fmsconn

              	for _, rs := range s.RootModule().Resources {

              		if rs.Type != "aws_config_authorization" {

Member

bflad Apr 23, 2018

Copy paste typo 😉

Contributor Author

gazoakley Apr 23, 2018

Ooops! 🤣

bflad added new-resource service/fms labels


          r/aws_fms_admin_account: New resource

68d9d7d

gazoakley force-pushed the f-firewall-admin-account branch from cb74563 to 68d9d7d Compare

April 23, 2018 20:37

ghost added the size/L label

jonrau1 commented Apr 16, 2019

Any update for resolving conflicts and getting Firewall Manager merged?

Contributor

robh007 commented Jun 24, 2019

Hi @gazoakley is there any appetite to finish this PR? Cheers.

aeschright requested a review from a team

June 25, 2019 21:35

bflad added this to the v2.22.0 milestone

bflad merged commit 68d9d7d into hashicorp:master

Member

bflad commented Aug 1, 2019

Hi folks 👋 Apologies for the delays here. We went ahead and rebased this pull request, tidied it up, and merged it in. Thanks @gazoakley for the contribution. 🚀

bflad added a commit that referenced this pull request


          Update CHANGELOG for #4310

421098b

ghost commented Aug 1, 2019

This has been released in version 2.22.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

ghost commented Nov 2, 2019

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

ghost locked and limited conversation to collaborators

gazoakley deleted the f-firewall-admin-account branch

April 7, 2020 16:24

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.