-
Notifications
You must be signed in to change notification settings - Fork 9.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
resource/aws_acm_certificate: Correctly handle SAN entries that match domain_name
#20073
Conversation
b8858c9
to
c120b63
Compare
Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding. Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author. For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000. For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide. |
9257fa3
to
17f0695
Compare
… domain_name AWS automatically adds a SAN entry that matches the `domain_name` value. This entry was being deleted in order to avoid spurious diffs where user's config didn't include the `domain_name` value in `subject_alternative_names`. This change reverses the logic so as to better reflect the actual state of a certificate in ACM; all SANs are now tracked in Terraform state, including the default SAN that AWS adds. If a user hasn't specified the `domain_name` entry in `subject_alternative_names` we add it for them to avoid spurious diffs.
domain_name
…ain'. Acceptance test output: % ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_matches_domain PKG=acm ACCTEST_PARALLELISM=2 ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 2 -run='TestAccACMCertificate_San_matches_domain' -timeout 180m === RUN TestAccACMCertificate_San_matches_domain === PAUSE TestAccACMCertificate_San_matches_domain === CONT TestAccACMCertificate_San_matches_domain --- PASS: TestAccACMCertificate_San_matches_domain (31.30s) PASS ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 36.890s
Acceptance test output: % make testacc TESTS=TestAccACMCertificate_PrivateKey_tags PKG=acm ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_PrivateKey_tags' -timeout 180m === RUN TestAccACMCertificate_PrivateKey_tags === PAUSE TestAccACMCertificate_PrivateKey_tags === CONT TestAccACMCertificate_PrivateKey_tags --- PASS: TestAccACMCertificate_PrivateKey_tags (49.51s) PASS ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 53.487s
Acceptance test output: % make testacc TESTS=TestAccACMCertificate_PrivateKey_tags PKG=acm ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_PrivateKey_tags' -timeout 180m === RUN TestAccACMCertificate_PrivateKey_tags === PAUSE TestAccACMCertificate_PrivateKey_tags === CONT TestAccACMCertificate_PrivateKey_tags --- PASS: TestAccACMCertificate_PrivateKey_tags (54.97s) PASS ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 58.642s % ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_matches_domain PKG=acm ACCTEST_PARALLELISM=2 ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 2 -run='TestAccACMCertificate_San_matches_domain' -timeout 180m === RUN TestAccACMCertificate_San_matches_domain === PAUSE TestAccACMCertificate_San_matches_domain === CONT TestAccACMCertificate_San_matches_domain --- PASS: TestAccACMCertificate_San_matches_domain (60.08s) PASS ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 67.823s
…ainValidationsAvailable'.
Acceptance test output: % make testacc TESTS=TestAccACMCertificateDataSource_keyTypes PKG=acm ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificateDataSource_keyTypes' -timeout 180m === RUN TestAccACMCertificateDataSource_keyTypes === PAUSE TestAccACMCertificateDataSource_keyTypes === CONT TestAccACMCertificateDataSource_keyTypes --- PASS: TestAccACMCertificateDataSource_keyTypes (18.07s) PASS ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 21.792s
…certificate issuance) timeout to 75 minutes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀.
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_emailValidation PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_emailValidation' -timeout 180m
=== RUN TestAccACMCertificate_emailValidation
=== PAUSE TestAccACMCertificate_emailValidation
=== CONT TestAccACMCertificate_emailValidation
--- PASS: TestAccACMCertificate_emailValidation (27.60s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 31.510s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_dnsValidation PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_dnsValidation' -timeout 180m
=== RUN TestAccACMCertificate_dnsValidation
=== PAUSE TestAccACMCertificate_dnsValidation
=== CONT TestAccACMCertificate_dnsValidation
--- PASS: TestAccACMCertificate_dnsValidation (23.43s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 27.536s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_root PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_root' -timeout 180m
=== RUN TestAccACMCertificate_root
=== PAUSE TestAccACMCertificate_root
=== RUN TestAccACMCertificate_rootAndWildcardSan
=== PAUSE TestAccACMCertificate_rootAndWildcardSan
=== CONT TestAccACMCertificate_root
=== CONT TestAccACMCertificate_rootAndWildcardSan
--- PASS: TestAccACMCertificate_root (23.25s)
--- PASS: TestAccACMCertificate_rootAndWildcardSan (23.33s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 27.230s
% make testacc TESTS=TestAccACMCertificate_privateCert PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_privateCert' -timeout 180m
=== RUN TestAccACMCertificate_privateCert
=== PAUSE TestAccACMCertificate_privateCert
=== CONT TestAccACMCertificate_privateCert
--- PASS: TestAccACMCertificate_privateCert (23.97s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 28.163s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_Root_trailingPeriod PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_Root_trailingPeriod' -timeout 180m
=== RUN TestAccACMCertificate_Root_trailingPeriod
=== PAUSE TestAccACMCertificate_Root_trailingPeriod
=== CONT TestAccACMCertificate_Root_trailingPeriod
--- PASS: TestAccACMCertificate_Root_trailingPeriod (2.26s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 6.037s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_SubjectAlternativeNames_emptyString PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_SubjectAlternativeNames_emptyString' -timeout 180m
=== RUN TestAccACMCertificate_SubjectAlternativeNames_emptyString
=== PAUSE TestAccACMCertificate_SubjectAlternativeNames_emptyString
=== CONT TestAccACMCertificate_SubjectAlternativeNames_emptyString
--- PASS: TestAccACMCertificate_SubjectAlternativeNames_emptyString (2.23s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 6.017s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_single PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_San_single' -timeout 180m
=== RUN TestAccACMCertificate_San_single
=== PAUSE TestAccACMCertificate_San_single
=== CONT TestAccACMCertificate_San_single
--- PASS: TestAccACMCertificate_San_single (28.04s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 31.838s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_multiple PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_San_multiple' -timeout 180m
=== RUN TestAccACMCertificate_San_multiple
=== PAUSE TestAccACMCertificate_San_multiple
=== CONT TestAccACMCertificate_San_multiple
--- PASS: TestAccACMCertificate_San_multiple (29.31s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 33.116s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_trailingPeriod PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_San_trailingPeriod' -timeout 180m
=== RUN TestAccACMCertificate_San_trailingPeriod
=== PAUSE TestAccACMCertificate_San_trailingPeriod
=== CONT TestAccACMCertificate_San_trailingPeriod
--- PASS: TestAccACMCertificate_San_trailingPeriod (26.47s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 29.980s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_San_matches_domain PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_San_matches_domain' -timeout 180m
=== RUN TestAccACMCertificate_San_matches_domain
=== PAUSE TestAccACMCertificate_San_matches_domain
=== CONT TestAccACMCertificate_San_matches_domain
--- PASS: TestAccACMCertificate_San_matches_domain (22.58s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 26.163s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_wildcard PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_wildcard' -timeout 180m
=== RUN TestAccACMCertificate_wildcard
=== PAUSE TestAccACMCertificate_wildcard
=== RUN TestAccACMCertificate_wildcardAndRootSan
=== PAUSE TestAccACMCertificate_wildcardAndRootSan
=== CONT TestAccACMCertificate_wildcard
=== CONT TestAccACMCertificate_wildcardAndRootSan
--- PASS: TestAccACMCertificate_wildcard (22.67s)
--- PASS: TestAccACMCertificate_wildcardAndRootSan (23.36s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 26.954s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificate_disableCTLogging PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_disableCTLogging' -timeout 180m
=== RUN TestAccACMCertificate_disableCTLogging
=== PAUSE TestAccACMCertificate_disableCTLogging
=== CONT TestAccACMCertificate_disableCTLogging
--- PASS: TestAccACMCertificate_disableCTLogging (22.77s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 26.379s
% make testacc TESTS=TestAccACMCertificate_Imported_ PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_Imported_' -timeout 180m
=== RUN TestAccACMCertificate_Imported_domainName
=== PAUSE TestAccACMCertificate_Imported_domainName
=== RUN TestAccACMCertificate_Imported_ipAddress
=== PAUSE TestAccACMCertificate_Imported_ipAddress
=== CONT TestAccACMCertificate_Imported_domainName
=== CONT TestAccACMCertificate_Imported_ipAddress
--- PASS: TestAccACMCertificate_Imported_ipAddress (17.77s)
--- PASS: TestAccACMCertificate_Imported_domainName (41.56s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 45.295s
% make testacc TESTS=TestAccACMCertificate_PrivateKey_tags PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificate_PrivateKey_tags' -timeout 180m
=== RUN TestAccACMCertificate_PrivateKey_tags
=== PAUSE TestAccACMCertificate_PrivateKey_tags
=== CONT TestAccACMCertificate_PrivateKey_tags
--- PASS: TestAccACMCertificate_PrivateKey_tags (51.04s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 54.563s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificateValidation_basic PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificateValidation_basic' -timeout 180m
=== RUN TestAccACMCertificateValidation_basic
=== PAUSE TestAccACMCertificateValidation_basic
=== CONT TestAccACMCertificateValidation_basic
--- PASS: TestAccACMCertificateValidation_basic (79.49s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 83.020s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificateValidation_timeout PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificateValidation_timeout' -timeout 180m
=== RUN TestAccACMCertificateValidation_timeout
=== PAUSE TestAccACMCertificateValidation_timeout
=== CONT TestAccACMCertificateValidation_timeout
--- PASS: TestAccACMCertificateValidation_timeout (20.03s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 23.672s
% ACM_CERTIFICATE_ROOT_DOMAIN=xxxxxxxx make testacc TESTS=TestAccACMCertificateValidation_validationRecordFQDNS PKG=acm
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/acm/... -v -count 1 -parallel 20 -run='TestAccACMCertificateValidation_validationRecordFQDNS' -timeout 180m
=== RUN TestAccACMCertificateValidation_validationRecordFQDNS
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNS
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSEmail
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSEmail
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSRoot
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSRoot
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSRootAndWildcard
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSRootAndWildcard
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSSan
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSSan
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSWildcard
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSWildcard
=== RUN TestAccACMCertificateValidation_validationRecordFQDNSWildcardAndRoot
=== PAUSE TestAccACMCertificateValidation_validationRecordFQDNSWildcardAndRoot
=== CONT TestAccACMCertificateValidation_validationRecordFQDNS
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSSan
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSRootAndWildcard
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSRoot
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSWildcardAndRoot
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSEmail
=== CONT TestAccACMCertificateValidation_validationRecordFQDNSWildcard
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSEmail (20.01s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSSan (103.16s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNS (109.37s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSWildcard (367.54s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSRoot (367.55s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSWildcardAndRoot (367.67s)
--- PASS: TestAccACMCertificateValidation_validationRecordFQDNSRootAndWildcard (402.21s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/acm 405.757s
@mattburgess Thanks for the contribution 🎉 👏. |
This functionality has been released in v4.12.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
This is a major breaking change to how ACM Certificate Validations are managed in state as it breaks the use of This now sets the id based on the ARN of the certificate, not the timestamp of the creation. d.SetId(aws.TimeValue(resp.Certificate.IssuedAt).String()) versus d.SetId(arn) |
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Community Note
AWS automatically adds a SAN entry that matches the
domain_name
value. This entrywas being deleted in order to avoid spurious diffs where user's config didn't include
the
domain_name
value insubject_alternative_names
.This change reverses the logic so as to better reflect the actual state of a certificate
in ACM; all SANs are now tracked in Terraform state, including the default SAN that AWS
adds. If a user hasn't specified the
domain_name
entry insubject_alternative_names
we add it for them to avoid spurious diffs.
Closes #19790.
Closes #9338.
Output from acceptance testing: