diff --git a/aws/resource_aws_storagegateway_smb_file_share.go b/aws/resource_aws_storagegateway_smb_file_share.go index 1d67e108eb2..99a4214f40e 100644 --- a/aws/resource_aws_storagegateway_smb_file_share.go +++ b/aws/resource_aws_storagegateway_smb_file_share.go @@ -145,6 +145,11 @@ func resourceAwsStorageGatewaySmbFileShare() *schema.Resource { Optional: true, Elem: &schema.Schema{Type: schema.TypeString}, }, + "admin_user_list": { + Type: schema.TypeSet, + Optional: true, + Elem: &schema.Schema{Type: schema.TypeString}, + }, "case_sensitivity": { Type: schema.TypeString, Optional: true, @@ -174,6 +179,7 @@ func resourceAwsStorageGatewaySmbFileShareCreate(d *schema.ResourceData, meta in Role: aws.String(d.Get("role_arn").(string)), CaseSensitivity: aws.String(d.Get("case_sensitivity").(string)), ValidUserList: expandStringSet(d.Get("valid_user_list").(*schema.Set)), + AdminUserList: expandStringSet(d.Get("admin_user_list").(*schema.Set)), Tags: keyvaluetags.New(d.Get("tags").(map[string]interface{})).IgnoreAws().StoragegatewayTags(), } @@ -276,6 +282,10 @@ func resourceAwsStorageGatewaySmbFileShareRead(d *schema.ResourceData, meta inte return fmt.Errorf("error setting valid_user_list: %w", err) } + if err := d.Set("admin_user_list", schema.NewSet(schema.HashString, flattenStringList(fileshare.AdminUserList))); err != nil { + return fmt.Errorf("error setting admin_user_list: %s", err) + } + if err := d.Set("tags", keyvaluetags.StoragegatewayKeyValueTags(fileshare.Tags).IgnoreAws().IgnoreConfig(ignoreTagsConfig).Map()); err != nil { return fmt.Errorf("error setting tags: %w", err) } @@ -307,6 +317,7 @@ func resourceAwsStorageGatewaySmbFileShareUpdate(d *schema.ResourceData, meta in ReadOnly: aws.Bool(d.Get("read_only").(bool)), RequesterPays: aws.Bool(d.Get("requester_pays").(bool)), ValidUserList: expandStringSet(d.Get("valid_user_list").(*schema.Set)), + AdminUserList: expandStringSet(d.Get("admin_user_list").(*schema.Set)), SMBACLEnabled: aws.Bool(d.Get("smb_acl_enabled").(bool)), CaseSensitivity: aws.String(d.Get("case_sensitivity").(string)), } diff --git a/aws/resource_aws_storagegateway_smb_file_share_test.go b/aws/resource_aws_storagegateway_smb_file_share_test.go index da04190d184..02dacb77ae3 100644 --- a/aws/resource_aws_storagegateway_smb_file_share_test.go +++ b/aws/resource_aws_storagegateway_smb_file_share_test.go @@ -45,6 +45,7 @@ func TestAccAWSStorageGatewaySmbFileShare_Authentication_ActiveDirectory(t *test resource.TestCheckResourceAttr(resourceName, "requester_pays", "false"), resource.TestCheckResourceAttrPair(resourceName, "role_arn", iamResourceName, "arn"), resource.TestCheckResourceAttr(resourceName, "valid_user_list.#", "0"), + resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "0"), ), }, { @@ -73,8 +74,11 @@ func TestAccAWSStorageGatewaySmbFileShare_Authentication_GuestAccess(t *testing. Config: testAccAWSStorageGatewaySmbFileShareConfig_Authentication_GuestAccess(rName), Check: resource.ComposeTestCheckFunc( testAccCheckAWSStorageGatewaySmbFileShareExists(resourceName, &smbFileShare), + resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "0"), testAccMatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)), resource.TestCheckResourceAttr(resourceName, "authentication", "GuestAccess"), + resource.TestCheckResourceAttr(resourceName, "cache_attributes.#", "0"), + resource.TestCheckResourceAttr(resourceName, "case_sensitivity", "ClientSpecified"), resource.TestCheckResourceAttr(resourceName, "default_storage_class", "S3_STANDARD"), resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexp.MustCompile(`^share-`)), resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"), @@ -88,8 +92,6 @@ func TestAccAWSStorageGatewaySmbFileShare_Authentication_GuestAccess(t *testing. resource.TestCheckResourceAttr(resourceName, "requester_pays", "false"), resource.TestCheckResourceAttrPair(resourceName, "role_arn", iamResourceName, "arn"), resource.TestCheckResourceAttr(resourceName, "valid_user_list.#", "0"), - resource.TestCheckResourceAttr(resourceName, "cache_attributes.#", "0"), - resource.TestCheckResourceAttr(resourceName, "case_sensitivity", "ClientSpecified"), ), }, { @@ -644,6 +646,48 @@ func TestAccAWSStorageGatewaySmbFileShare_disappears(t *testing.T) { }) } +func TestAccAWSStorageGatewaySmbFileShare_AdminUserList(t *testing.T) { + var smbFileShare storagegateway.SMBFileShareInfo + rName := acctest.RandomWithPrefix("tf-acc-test") + resourceName := "aws_storagegateway_smb_file_share.test" + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckAWSStorageGatewaySmbFileShareDestroy, + Steps: []resource.TestStep{ + { + { + Config: testAccAWSStorageGatewaySmbFileShareConfig_AdminUserList_Single(rName, "adminuser1"), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSStorageGatewaySmbFileShareExists(resourceName, &smbFileShare), + resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "1"), + ), + }, + { + Config: testAccAWSStorageGatewaySmbFileShareConfig_AdminUserList_Multiple(rName, "adminuser2", "adminuser3"), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSStorageGatewaySmbFileShareExists(resourceName, &smbFileShare), + resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "2"), + ), + }, + { + Config: testAccAWSStorageGatewaySmbFileShareConfig_AdminUserList_Single(rName, "adminuser4"), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSStorageGatewaySmbFileShareExists(resourceName, &smbFileShare), + resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "1"), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + }, + }, + }) +} + func testAccCheckAWSStorageGatewaySmbFileShareDestroy(s *terraform.State) error { conn := testAccProvider.Meta().(*AWSClient).storagegatewayconn @@ -1002,6 +1046,32 @@ resource "aws_storagegateway_smb_file_share" "test" { `, validUser1, validUser2) } +func testAccAWSStorageGatewaySmbFileShareConfig_AdminUserList_Single(rName, adminUser1 string) string { + return testAccAWSStorageGateway_SmbFileShare_ActiveDirectoryBase(rName) + fmt.Sprintf(` +resource "aws_storagegateway_smb_file_share" "test" { + # Must be ActiveDirectory + authentication = "ActiveDirectory" + gateway_arn = aws_storagegateway_gateway.test.arn + location_arn = aws_s3_bucket.test.arn + role_arn = aws_iam_role.test.arn + admin_user_list = [%q] +} +`, adminUser1) +} + +func testAccAWSStorageGatewaySmbFileShareConfig_AdminUserList_Multiple(rName, adminUser1, adminUser2 string) string { + return testAccAWSStorageGateway_SmbFileShare_ActiveDirectoryBase(rName) + fmt.Sprintf(` +resource "aws_storagegateway_smb_file_share" "test" { + # Must be ActiveDirectory + authentication = "ActiveDirectory" + gateway_arn = aws_storagegateway_gateway.test.arn + location_arn = aws_s3_bucket.test.arn + role_arn = aws_iam_role.test.arn + admin_user_list = [%q, %q] +} +`, adminUser1, adminUser2) +} + func testAccAWSStorageGatewaySmbFileShareConfigTags1(rName, tagKey1, tagValue1 string) string { return testAccAWSStorageGateway_SmbFileShare_GuestAccessBase(rName) + fmt.Sprintf(` resource "aws_storagegateway_smb_file_share" "test" { diff --git a/website/docs/r/storagegateway_smb_file_share.html.markdown b/website/docs/r/storagegateway_smb_file_share.html.markdown index 27f9fd3a6b9..4929895f001 100644 --- a/website/docs/r/storagegateway_smb_file_share.html.markdown +++ b/website/docs/r/storagegateway_smb_file_share.html.markdown @@ -45,6 +45,7 @@ The following arguments are supported: * `gateway_arn` - (Required) Amazon Resource Name (ARN) of the file gateway. * `location_arn` - (Required) The ARN of the backed storage used for storing file data. * `role_arn` - (Required) The ARN of the AWS Identity and Access Management (IAM) role that a file gateway assumes when it accesses the underlying storage. +* `admin_user_list` - (Optional) A list of users in the Active Directory that have admin access to the file share. Only valid if `authentication` is set to `ActiveDirectory`. * `authentication` - (Optional) The authentication method that users use to access the file share. Defaults to `ActiveDirectory`. Valid values: `ActiveDirectory`, `GuestAccess`. * `audit_destination_arn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch Log Group used for the audit logs. * `default_storage_class` - (Optional) The default storage class for objects put into an Amazon S3 bucket by the file gateway. Defaults to `S3_STANDARD`. Valid values: `S3_STANDARD`, `S3_STANDARD_IA`, `S3_ONEZONE_IA`.