f-aws_directconnect_connection_macsec #26274

ddericco · 2022-08-12T15:56:05Z

Adds support for MACsec on Direct Connect connections:

Add new resource aws_dx_macsec_key
Add argument macsec_requested to resource aws_dx_connection to support requesting MACsec on new connections
Add arguments encryption_mode, macsec_capable, and port_encryption_status to resource aws_dx_connection

Notes

The acceptance tests require an existing DX connection in an available state. You will need to set an environmental variable DX_CONNECTION_ID with a valid DX connection ID before running the tests.
The acceptance tests for resource aws_dx_macsec_key will change the DX connection to a pending state as part of the add/remove operation. If the DX connection is in any state other than available when starting the tests, the acceptance test will fail with error: DirectConnectClientException: The port is not in available state to associate the key for account <accountID>.

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #21082

Output from acceptance testing:

$ make testacc TESTS=TestAccDirectConnectMacSecKey_withCkn PKG=directconnect   
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectMacSecKey_withCkn'  -timeout 180m
=== RUN   TestAccDirectConnectMacSecKey_withCkn
=== PAUSE TestAccDirectConnectMacSecKey_withCkn
=== CONT  TestAccDirectConnectMacSecKey_withCkn
--- PASS: TestAccDirectConnectMacSecKey_withCkn (11.17s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      13.493s
$ make testacc TESTS=TestAccDirectConnectMacSecKey_withSecret PKG=directconnect
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectMacSecKey_withSecret'  -timeout 180m
=== RUN   TestAccDirectConnectMacSecKey_withSecret
=== PAUSE TestAccDirectConnectMacSecKey_withSecret
=== CONT  TestAccDirectConnectMacSecKey_withSecret
--- PASS: TestAccDirectConnectMacSecKey_withSecret (13.35s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      15.696s
$ make testacc TESTS=TestAccDirectConnectConnection_macsecRequested PKG=directconnect
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectConnection_macsecRequested'  -timeout 180m
=== RUN   TestAccDirectConnectConnection_macsecRequested
=== PAUSE TestAccDirectConnectConnection_macsecRequested
=== CONT  TestAccDirectConnectConnection_macsecRequested
--- PASS: TestAccDirectConnectConnection_macsecRequested (22.88s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      25.215s

- Create docs for resource `aws_dx_macsec_key` - [WIP] Update existing docs for resource `aws_dx_connection`

- Remove default "secret delete" behavior to align with API behavior - Add sweeper for MACsec keys to clean up dangling acceptance test resources

NetDevAutomate · 2022-10-19T21:59:08Z

@ddericco All tests pass other than the TestAccDirectConnectConnection_macsecRequested test:

I get an error 'Failed state verification, resource with ID <site ID> not found'

ddericco · 2022-10-19T23:09:53Z

@ddericco All tests pass other than the TestAccDirectConnectConnection_macsecRequested test:

I get an error 'Failed state verification, resource with ID <site ID> not found'

@NetDevAutomate I haven't been able to reproduce this locally - I've tried manually setting AWS_DEFAULT_REGION to different regions - but I do see an possible issue with the acceptance test trying to create MACsec connections in unsupported locations. I'll try to fix this.

silvaalbert

Looks pretty good thus far! I provided repeated comments/suggestions on a resource and schema names for your consideration.

internal/service/directconnect/connection.go

internal/service/directconnect/connection_test.go

internal/service/directconnect/macsec_key_test.go

Update attribute name to align with API Co-authored-by: Albert Silva <50742829+silvaalbert@users.noreply.github.com>

internal/service/directconnect/connection_test.go

ewbankkit

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccDirectConnectConnection_' PKG=directconnect ACCTEST_PARALLELISM=3
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 3  -run=TestAccDirectConnectConnection_ -timeout 180m
=== RUN   TestAccDirectConnectConnection_basic
=== PAUSE TestAccDirectConnectConnection_basic
=== RUN   TestAccDirectConnectConnection_disappears
=== PAUSE TestAccDirectConnectConnection_disappears
=== RUN   TestAccDirectConnectConnection_encryptionMode
    connection_test.go:82: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectConnection_encryptionMode (0.00s)
=== RUN   TestAccDirectConnectConnection_macsecRequested
=== PAUSE TestAccDirectConnectConnection_macsecRequested
=== RUN   TestAccDirectConnectConnection_providerName
=== PAUSE TestAccDirectConnectConnection_providerName
=== RUN   TestAccDirectConnectConnection_skipDestroy
=== PAUSE TestAccDirectConnectConnection_skipDestroy
=== RUN   TestAccDirectConnectConnection_tags
=== PAUSE TestAccDirectConnectConnection_tags
=== CONT  TestAccDirectConnectConnection_basic
=== CONT  TestAccDirectConnectConnection_providerName
=== CONT  TestAccDirectConnectConnection_macsecRequested
=== CONT  TestAccDirectConnectConnection_tags
--- PASS: TestAccDirectConnectConnection_basic (21.30s)
--- PASS: TestAccDirectConnectConnection_providerName (23.31s)
=== CONT  TestAccDirectConnectConnection_skipDestroy
--- PASS: TestAccDirectConnectConnection_macsecRequested (23.49s)
=== CONT  TestAccDirectConnectConnection_disappears
--- PASS: TestAccDirectConnectConnection_disappears (17.44s)
--- PASS: TestAccDirectConnectConnection_skipDestroy (18.00s)
--- PASS: TestAccDirectConnectConnection_tags (46.81s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/directconnect	73.409s
 make testacc TESTARGS='-run=TestAccDirectConnectMacSecKey_' PKG=directconnect ACCTEST_PARALLELISM=3
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 3  -run=TestAccDirectConnectMacSecKey_ -timeout 180m
=== RUN   TestAccDirectConnectMacSecKey_withCkn
    macsec_key_test.go:21: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectMacSecKey_withCkn (0.00s)
=== RUN   TestAccDirectConnectMacSecKey_withSecret
    macsec_key_test.go:56: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectMacSecKey_withSecret (0.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/directconnect	4.897s

ewbankkit · 2022-12-16T21:52:02Z

Verified that terraform plan on a connection created with the latest released version shows no significant diffs:

% terraform plan

aws_dx_connection.test: Refreshing state... [id=dxcon-ffjmkunm]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # aws_dx_connection.test has been changed
  ~ resource "aws_dx_connection" "test" {
      + aws_device             = "ECPO1-251t75d1q8gru"
      + encryption_mode        = "unknown"
      ~ has_logical_redundancy = "unknown" -> "no"
        id                     = "dxcon-ffjmkunm"
      ~ jumbo_frame_capable    = false -> true
      + macsec_capable         = false
        name                   = "ewbankkit-test"
      + port_encryption_status = "unknown"
      + tags                   = {}
        # (5 unchanged attributes hidden)
    }

Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the
following plan may include actions to undo or respond to these changes.

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

No changes. Your infrastructure matches the configuration.

Your configuration already matches the changes detected above. If you'd like to update the Terraform state to match, create and
apply a refresh-only plan:
  terraform apply -refresh-only

ddericco · 2022-12-18T21:59:21Z

$ make testacc TESTS=TestAccDirectConnectConnection_encryptionMode PKG=directconnect                                                       
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectConnection_encryptionMode'  -timeout 180m
=== RUN   TestAccDirectConnectConnection_encryptionMode
=== PAUSE TestAccDirectConnectConnection_encryptionMode
=== CONT  TestAccDirectConnectConnection_encryptionMode
--- PASS: TestAccDirectConnectConnection_encryptionMode (626.40s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      629.449s
$ make testacc TESTS=TestAccDirectConnectMacSecKey_withCkn PKG=directconnect                                                                 
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectMacSecKey_withCkn'  -timeout 180m
=== RUN   TestAccDirectConnectMacSecKey_withCkn
=== PAUSE TestAccDirectConnectMacSecKey_withCkn
=== CONT  TestAccDirectConnectMacSecKey_withCkn
--- PASS: TestAccDirectConnectMacSecKey_withCkn (13.46s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      16.370s
$ make testacc TESTS=TestAccDirectConnectMacSecKey_withSecret PKG=directconnect                                                              
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 20 -run='TestAccDirectConnectMacSecKey_withSecret'  -timeout 180m
=== RUN   TestAccDirectConnectMacSecKey_withSecret
=== PAUSE TestAccDirectConnectMacSecKey_withSecret
=== CONT  TestAccDirectConnectMacSecKey_withSecret
--- PASS: TestAccDirectConnectMacSecKey_withSecret (15.78s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/directconnect      18.793s

ewbankkit · 2022-12-19T13:22:39Z

% make testacc TESTARGS='-run=TestAccDirectConnectConnection_\|TestAccDirectConnectMacSecKey_' PKG=directconnect ACCTEST_PARALLELISM=3
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/directconnect/... -v -count 1 -parallel 3  -run=TestAccDirectConnectConnection_\|TestAccDirectConnectMacSecKey_ -timeout 180m
=== RUN   TestAccDirectConnectConnection_basic
=== PAUSE TestAccDirectConnectConnection_basic
=== RUN   TestAccDirectConnectConnection_disappears
=== PAUSE TestAccDirectConnectConnection_disappears
=== RUN   TestAccDirectConnectConnection_encryptionMode
    connection_test.go:82: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectConnection_encryptionMode (0.00s)
=== RUN   TestAccDirectConnectConnection_macsecRequested
=== PAUSE TestAccDirectConnectConnection_macsecRequested
=== RUN   TestAccDirectConnectConnection_providerName
=== PAUSE TestAccDirectConnectConnection_providerName
=== RUN   TestAccDirectConnectConnection_skipDestroy
=== PAUSE TestAccDirectConnectConnection_skipDestroy
=== RUN   TestAccDirectConnectConnection_tags
=== PAUSE TestAccDirectConnectConnection_tags
=== RUN   TestAccDirectConnectMacSecKey_withCkn
    macsec_key_test.go:21: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectMacSecKey_withCkn (0.00s)
=== RUN   TestAccDirectConnectMacSecKey_withSecret
    macsec_key_test.go:56: Environment variable DX_CONNECTION_ID is not set
--- SKIP: TestAccDirectConnectMacSecKey_withSecret (0.00s)
=== CONT  TestAccDirectConnectConnection_basic
=== CONT  TestAccDirectConnectConnection_providerName
=== CONT  TestAccDirectConnectConnection_tags
--- PASS: TestAccDirectConnectConnection_basic (29.07s)
=== CONT  TestAccDirectConnectConnection_skipDestroy
--- PASS: TestAccDirectConnectConnection_providerName (30.32s)
=== CONT  TestAccDirectConnectConnection_macsecRequested
--- PASS: TestAccDirectConnectConnection_skipDestroy (27.34s)
=== CONT  TestAccDirectConnectConnection_disappears
--- PASS: TestAccDirectConnectConnection_macsecRequested (35.14s)
--- PASS: TestAccDirectConnectConnection_tags (72.86s)
--- PASS: TestAccDirectConnectConnection_disappears (21.99s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/directconnect	88.039s

ewbankkit · 2022-12-19T13:45:03Z

@ddericco Thanks for the contribution 🎉 👏.

github-actions · 2022-12-19T23:15:36Z

This functionality has been released in v4.48.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions · 2023-02-03T02:18:56Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

justinretzolk added enhancement Requests to existing resources that expand the functionality or scope. and removed needs-triage Waiting for first response or review from a maintainer. labels Aug 23, 2022

github-actions bot added the documentation Introduces or discusses updates to documentation. label Aug 23, 2022

github-actions bot added the sweeper Pertains to changes to or issues with the sweeper. label Sep 15, 2022

Dave DeRicco and others added 12 commits September 15, 2022 12:38

First push to add MACSec support

8d71007

Add working acceptance tests

5c4d093

Add changelog, run acc test linting

6738f1f

[WIP] Add and update docs

a1c5b07

- Create docs for resource `aws_dx_macsec_key` - [WIP] Update existing docs for resource `aws_dx_connection`

Minor doc/linting fixes

45071a7

Add support to delete keys on disassociate

dd223d2

Add read function to macsec_key resource

4ca85df

Update acceptance tests, clean up dx_connection resource

96a5dd5

Minor linting fixes

c23c8f1

Add sweeper for aws_dx_macsec_keys, remove secret delete function

063abff

- Remove default "secret delete" behavior to align with API behavior - Add sweeper for MACsec keys to clean up dangling acceptance test resources

Update aws_dx_connection documentation, fix sweeper attribute error

810926c

Remove unneeded schema items, fix docs conflict

ae5cc7f

ddericco force-pushed the f-aws_directconnect_connection-macsec branch from 694c200 to ae5cc7f Compare September 15, 2022 16:43

ddericco added 2 commits September 15, 2022 13:54

Minor linting fixes

c12eecc

Additional linting fixes

143007a

ddericco marked this pull request as ready for review September 15, 2022 21:39

ddericco changed the title ~~[WIP] f-aws_directconnect_connection_macsec~~ f-aws_directconnect_connection_macsec Sep 16, 2022

silvaalbert reviewed Nov 1, 2022

View reviewed changes

Apply code review suggestion: request_macsec attribute

b07f472

Update attribute name to align with API Co-authored-by: Albert Silva <50742829+silvaalbert@users.noreply.github.com>

Rename docs, add encryption_mode acc test [WIP]

fd0aa9d

ewbankkit mentioned this pull request Feb 28, 2023

Acceptance testing: Ability to prevent a resource being deleted at the end of a TestCase hashicorp/terraform-plugin-testing#85

Closed

Add skip_destroy argument for aws_dx_connection

3e236d9

ewbankkit reviewed Dec 16, 2022

View reviewed changes

internal/service/directconnect/connection_test.go Show resolved Hide resolved

ddericco and others added 6 commits December 16, 2022 14:58

WIP - encryption_mode acceptance test

4f71c06

Tweak CHANGELOG entries.

63282e5

Fix semgrep 'dgryski.semgrep-go.oddifsequence.odd-sequence-ifs'.

9da4e2b

Fix golangci-lint 'whitespace'.

3d6318c

Remove unused commented functions

e87145e

Cosmetics.

3f6e762

ewbankkit approved these changes Dec 16, 2022

View reviewed changes

Finalize encryption_mode acc test

9e087b5

r/aws_dx_connection: Fix golangci-lint 'unparam'.

1a820f4

ewbankkit merged commit 8e36aaf into hashicorp:main Dec 19, 2022

github-actions bot added this to the v4.48.0 milestone Dec 19, 2022

ddericco deleted the f-aws_directconnect_connection-macsec branch December 27, 2022 15:41

ddericco restored the f-aws_directconnect_connection-macsec branch December 27, 2022 15:42

ddericco deleted the f-aws_directconnect_connection-macsec branch December 27, 2022 15:42

ddericco restored the f-aws_directconnect_connection-macsec branch December 27, 2022 15:42

This was referenced Dec 27, 2022

[Docs]: Nonexistent resource type referenced in aws_dx_macsec_key_association #28587

Closed

Update resource references to aws_macsec_key_association #28588

Merged

ddericco deleted the f-aws_directconnect_connection-macsec branch January 3, 2023 14:09

github-actions bot locked as resolved and limited conversation to collaborators Feb 3, 2023

justinretzolk added the partner Contribution from a partner. label May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

f-aws_directconnect_connection_macsec #26274

f-aws_directconnect_connection_macsec #26274

ddericco commented Aug 12, 2022 •

edited

Loading

NetDevAutomate commented Oct 19, 2022

ddericco commented Oct 19, 2022

silvaalbert left a comment

ewbankkit left a comment

ewbankkit commented Dec 16, 2022

ddericco commented Dec 18, 2022

ewbankkit commented Dec 19, 2022

ewbankkit commented Dec 19, 2022

github-actions bot commented Dec 19, 2022

github-actions bot commented Feb 3, 2023

f-aws_directconnect_connection_macsec #26274

f-aws_directconnect_connection_macsec #26274

Conversation

ddericco commented Aug 12, 2022 • edited Loading

Notes

Community Note

NetDevAutomate commented Oct 19, 2022

ddericco commented Oct 19, 2022

silvaalbert left a comment

Choose a reason for hiding this comment

ewbankkit left a comment

Choose a reason for hiding this comment

ewbankkit commented Dec 16, 2022

ddericco commented Dec 18, 2022

ewbankkit commented Dec 19, 2022

ewbankkit commented Dec 19, 2022

github-actions bot commented Dec 19, 2022

github-actions bot commented Feb 3, 2023

ddericco commented Aug 12, 2022 •

edited

Loading