From 85fdcd5160d6c7a35a57d401a599c63f59c6ccd1 Mon Sep 17 00:00:00 2001
From: Charlie Stocker <charlie.stocker@depop.com>
Date: Thu, 27 Feb 2020 18:55:32 +0000
Subject: [PATCH 1/3] aws_ssm_maintenance_window_task: allow service_role_arn
 to be optional

---
 ...esource_aws_ssm_maintenance_window_task.go |  12 +-
 ...ce_aws_ssm_maintenance_window_task_test.go | 174 +++++++++---------
 .../ssm_maintenance_window_task.html.markdown |   6 +-
 3 files changed, 96 insertions(+), 96 deletions(-)

diff --git a/aws/resource_aws_ssm_maintenance_window_task.go b/aws/resource_aws_ssm_maintenance_window_task.go
index 72d7148027d..d814657c25e 100644
--- a/aws/resource_aws_ssm_maintenance_window_task.go
+++ b/aws/resource_aws_ssm_maintenance_window_task.go
@@ -54,7 +54,7 @@ func resourceAwsSsmMaintenanceWindowTask() *schema.Resource {
 
 			"service_role_arn": {
 				Type:     schema.TypeString,
-				Required: true,
+				Optional: true,
 			},
 
 			"targets": {
@@ -680,11 +680,14 @@ func resourceAwsSsmMaintenanceWindowTaskCreate(d *schema.ResourceData, meta inte
 		MaxConcurrency: aws.String(d.Get("max_concurrency").(string)),
 		MaxErrors:      aws.String(d.Get("max_errors").(string)),
 		TaskType:       aws.String(d.Get("task_type").(string)),
-		ServiceRoleArn: aws.String(d.Get("service_role_arn").(string)),
 		TaskArn:        aws.String(d.Get("task_arn").(string)),
 		Targets:        expandAwsSsmTargets(d.Get("targets").([]interface{})),
 	}
 
+	if v, ok := d.GetOk("service_role_arn"); ok {
+		params.ServiceRoleArn = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("name"); ok {
 		params.Name = aws.String(v.(string))
 	}
@@ -781,12 +784,15 @@ func resourceAwsSsmMaintenanceWindowTaskUpdate(d *schema.ResourceData, meta inte
 		WindowTaskId:   aws.String(d.Id()),
 		MaxConcurrency: aws.String(d.Get("max_concurrency").(string)),
 		MaxErrors:      aws.String(d.Get("max_errors").(string)),
-		ServiceRoleArn: aws.String(d.Get("service_role_arn").(string)),
 		TaskArn:        aws.String(d.Get("task_arn").(string)),
 		Targets:        expandAwsSsmTargets(d.Get("targets").([]interface{})),
 		Replace:        aws.Bool(true),
 	}
 
+	if v, ok := d.GetOk("service_role_arn"); ok {
+		params.ServiceRoleArn = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("name"); ok {
 		params.Name = aws.String(v.(string))
 	}
diff --git a/aws/resource_aws_ssm_maintenance_window_task_test.go b/aws/resource_aws_ssm_maintenance_window_task_test.go
index 73292c1a48f..c2d27648cf8 100644
--- a/aws/resource_aws_ssm_maintenance_window_task_test.go
+++ b/aws/resource_aws_ssm_maintenance_window_task_test.go
@@ -52,6 +52,27 @@ func TestAccAWSSSMMaintenanceWindowTask_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSSSMMaintenanceWindowTask_noRole(t *testing.T) {
+	var task ssm.MaintenanceWindowTask
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_ssm_maintenance_window_task.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSSMMaintenanceWindowTaskDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSSMMaintenanceWindowTaskNoRoleConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSSMMaintenanceWindowTaskExists(resourceName, &task),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccAWSSSMMaintenanceWindowTask_updateForcesNewResource(t *testing.T) {
 	var before, after ssm.MaintenanceWindowTask
 	name := acctest.RandString(10)
@@ -378,45 +399,49 @@ resource "aws_ssm_maintenance_window_target" "test" {
     values = ["tf-acc-test"]
   }
 }
+`, rName)
+}
 
+func testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName string) string {
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
 resource "aws_iam_role" "test" {
-  name = %[1]q
-  assume_role_policy = <<POLICY
+    name = %[1]q
+    assume_role_policy = <<POLICY
 {
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": "sts:AssumeRole",
-            "Principal": {
-                "Service": "events.amazonaws.com"
-            },
-            "Effect": "Allow",
-            "Sid": ""
-        }
-    ]
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+              "Action": "sts:AssumeRole",
+              "Principal": {
+                  "Service": "events.amazonaws.com"
+              },
+              "Effect": "Allow",
+              "Sid": ""
+          }
+      ]
 }
 POLICY
 }
-
+  
 resource "aws_iam_role_policy" "test" {
-  name = %[1]q
-  role = "${aws_iam_role.test.name}"
-  policy = <<POLICY
+    name = %[1]q
+    role = "${aws_iam_role.test.name}"
+    policy = <<POLICY
 {
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "ssm:*",
-    "Resource": "*"
-  }
+    "Version": "2012-10-17",
+    "Statement": {
+      "Effect": "Allow",
+      "Action": "ssm:*",
+      "Resource": "*"
+    }
 }
 POLICY
 }
-`, rName)
+  `, rName)
 }
 
 func testAccAWSSSMMaintenanceWindowTaskBasicConfig(rName string) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName) + `
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName) + `
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id   = "${aws_ssm_maintenance_window.test.id}"
@@ -442,7 +467,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskBasicConfigUpdate(rName, description, taskType, taskArn string, priority, maxConcurrency, maxErrors int) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id   = "${aws_ssm_maintenance_window.test.id}"
@@ -505,7 +530,7 @@ EOF
 }
 
 func testAccAWSSSMMaintenanceWindowTaskBasicConfigUpdated(rName string) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName) + `
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName) + `
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id   = "${aws_ssm_maintenance_window.test.id}"
@@ -533,7 +558,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskConfigEmptyNotifcationConfig(rName string) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName) + `
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName) + `
 
 resource "aws_ssm_maintenance_window_task" "test" {
     window_id = "${aws_ssm_maintenance_window.test.id}"
@@ -561,8 +586,33 @@ resource "aws_ssm_maintenance_window_task" "test" {
 `)
 }
 
+func testAccAWSSSMMaintenanceWindowTaskNoRoleConfig(rName string) string {
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName) + `
+  resource "aws_ssm_maintenance_window_task" "test" {
+    window_id   = "${aws_ssm_maintenance_window.test.id}"
+    task_type   = "RUN_COMMAND"
+    task_arn    = "AWS-RunShellScript"
+    priority    = 1
+    max_concurrency  = "2"
+    max_errors  = "1"
+    name      = "TestMaintenanceWindowTask"
+    description    = "This resource is for test purpose only"  
+  
+    targets {
+      key    = "WindowTargetIds"
+      values = ["${aws_ssm_maintenance_window_target.test.id}"]
+    }
+  
+    task_parameters {
+      name   = "commands"
+      values = ["pwd"]
+    }
+  }  
+  `)
+}
+
 func testAccAWSSSMMaintenanceWindowTaskAutomationConfig(rName, version string) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id = "${aws_ssm_maintenance_window.test.id}"
@@ -595,7 +645,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskAutomationConfigUpdate(rName, version string) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 resource "aws_s3_bucket" "foo" {
     bucket = "tf-s3-%[1]s"
     acl = "private"
@@ -633,7 +683,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 
 func testAccAWSSSMMaintenanceWindowTaskLambdaConfig(funcName, policyName, roleName, sgName, rName string, rInt int) string {
 	return fmt.Sprintf(testAccAWSLambdaConfigBasic(funcName, policyName, roleName, sgName)+
-		testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+		testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id = "${aws_ssm_maintenance_window.test.id}"
@@ -664,7 +714,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskRunCommandConfig(rName, comment string, timeoutSeconds int) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id = "${aws_ssm_maintenance_window.test.id}"
@@ -697,7 +747,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskRunCommandConfigUpdate(rName, comment string, timeoutSeconds int) string {
-	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBase(rName)+`
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName)+`
 resource "aws_s3_bucket" "foo" {
     bucket = "tf-s3-%[1]s"
     acl = "private"
@@ -738,7 +788,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskStepFunctionConfig(rName string) string {
-	return testAccAWSSSMMaintenanceWindowTaskConfigBase(rName) + fmt.Sprintf(`
+	return testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName) + fmt.Sprintf(`
 resource "aws_sfn_activity" "test" {
   name = %[1]q
 }
@@ -770,59 +820,7 @@ resource "aws_ssm_maintenance_window_task" "test" {
 }
 
 func testAccAWSSSMMaintenanceWindowTaskConfigTaskParametersMultiple(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_ssm_maintenance_window" "test" {
-  cutoff   = 1
-  duration = 3
-  name     = %[1]q
-  schedule = "cron(0 16 ? * TUE *)"
-}
-
-resource "aws_ssm_maintenance_window_target" "test" {
-  name          = %[1]q
-  resource_type = "INSTANCE"
-  window_id     = "${aws_ssm_maintenance_window.test.id}"
-
-  targets {
-    key    = "tag:Name"
-    values = ["tf-acc-test"]
-  }
-}
-
-resource "aws_iam_role" "test" {
-  name = %[1]q
-  assume_role_policy = <<POLICY
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": "sts:AssumeRole",
-            "Principal": {
-                "Service": "events.amazonaws.com"
-            },
-            "Effect": "Allow",
-            "Sid": ""
-        }
-    ]
-}
-POLICY
-}
-
-resource "aws_iam_role_policy" "test" {
-  name = %[1]q
-  role = "${aws_iam_role.test.name}"
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "ssm:*",
-    "Resource": "*"
-  }
-}
-POLICY
-}
-
+	return fmt.Sprintf(testAccAWSSSMMaintenanceWindowTaskConfigBaseIAM(rName) + `
 resource "aws_ssm_maintenance_window_task" "test" {
   max_concurrency  = 1
   max_errors       = 1
@@ -852,5 +850,5 @@ resource "aws_ssm_maintenance_window_task" "test" {
     values = ["date"]
   }
 }
-`, rName)
+`)
 }
diff --git a/website/docs/r/ssm_maintenance_window_task.html.markdown b/website/docs/r/ssm_maintenance_window_task.html.markdown
index a2aed895be3..6a38e953de0 100644
--- a/website/docs/r/ssm_maintenance_window_task.html.markdown
+++ b/website/docs/r/ssm_maintenance_window_task.html.markdown
@@ -19,7 +19,6 @@ resource "aws_ssm_maintenance_window_task" "example" {
   max_concurrency  = 2
   max_errors       = 1
   priority         = 1
-  service_role_arn = "${aws_iam_role.example.arn}"
   task_arn         = "AWS-RestartEC2Instance"
   task_type        = "AUTOMATION"
   window_id        = "${aws_ssm_maintenance_window.example.id}"
@@ -49,7 +48,6 @@ resource "aws_ssm_maintenance_window_task" "example" {
   max_concurrency  = 2
   max_errors       = 1
   priority         = 1
-  service_role_arn = "${aws_iam_role.example.arn}"
   task_arn         = "${aws_lambda_function.example.arn}"
   task_type        = "LAMBDA"
   window_id        = "${aws_ssm_maintenance_window.example.id}"
@@ -75,7 +73,6 @@ resource "aws_ssm_maintenance_window_task" "example" {
   max_concurrency  = 2
   max_errors       = 1
   priority         = 1
-  service_role_arn = "${aws_iam_role.example.arn}"
   task_arn         = "AWS-RunShellScript"
   task_type        = "RUN_COMMAND"
   window_id        = "${aws_ssm_maintenance_window.example.id}"
@@ -114,7 +111,6 @@ resource "aws_ssm_maintenance_window_task" "example" {
   max_concurrency  = 2
   max_errors       = 1
   priority         = 1
-  service_role_arn = "${aws_iam_role.example.arn}"
   task_arn         = "${aws_sfn_activity.example.id}"
   task_type        = "STEP_FUNCTIONS"
   window_id        = "${aws_ssm_maintenance_window.example.id}"
@@ -142,7 +138,7 @@ The following arguments are supported:
 * `max_errors` - (Required) The maximum number of errors allowed before this task stops being scheduled.
 * `task_type` - (Required) The type of task being registered. The only allowed value is `RUN_COMMAND`.
 * `task_arn` - (Required) The ARN of the task to execute.
-* `service_role_arn` - (Required) The role that should be assumed when executing the task.
+* `service_role_arn` - (Optional) The role that should be assumed when executing the task. If a role is not provided, Systems Manager uses your account's service-linked role. If no service-linked role for Systems Manager exists in your account, it is created for you.
 * `name` - (Optional) The name of the maintenance window task.
 * `description` - (Optional) The description of the maintenance window task.
 * `targets` - (Required) The targets (either instances or window target ids). Instances are specified using Key=InstanceIds,Values=instanceid1,instanceid2. Window target ids are specified using Key=WindowTargetIds,Values=window target id1, window target id2.

From f934ca7b85c4772573e60ffbbcc524f8c341f5b1 Mon Sep 17 00:00:00 2001
From: Brian Flad <bflad417@gmail.com>
Date: Thu, 11 Feb 2021 22:37:12 -0500
Subject: [PATCH 2/3] Apply suggestions from code review

---
 ...urce_aws_ssm_maintenance_window_task_test.go | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/aws/resource_aws_ssm_maintenance_window_task_test.go b/aws/resource_aws_ssm_maintenance_window_task_test.go
index d3cd52d6e5f..54a43e83d97 100644
--- a/aws/resource_aws_ssm_maintenance_window_task_test.go
+++ b/aws/resource_aws_ssm_maintenance_window_task_test.go
@@ -466,24 +466,23 @@ resource "aws_iam_role" "test" {
 POLICY
 
 }
-  
 resource "aws_iam_role_policy" "test" {
   name = %[1]q
   role = aws_iam_role.test.name
 
   policy = <<POLICY
 {
-    "Version": "2012-10-17",
-    "Statement": {
-      "Effect": "Allow",
-      "Action": "ssm:*",
-      "Resource": "*"
-    }
+  "Version": "2012-10-17",
+  "Statement": {
+    "Effect": "Allow",
+    "Action": "ssm:*",
+    "Resource": "*"
+  }
 }
 POLICY
 
 }
-  `, rName)
+`, rName)
 }
 
 func testAccAWSSSMMaintenanceWindowTaskBasicConfig(rName string) string {
@@ -937,5 +936,5 @@ resource "aws_ssm_maintenance_window_task" "test" {
     }
   }
 }
-`)
+`, rName)
 }

From 72cf9ccff84dcdd21a848585ec713179f5bd261b Mon Sep 17 00:00:00 2001
From: Brian Flad <bflad417@gmail.com>
Date: Thu, 11 Feb 2021 22:38:26 -0500
Subject: [PATCH 3/3] Update
 aws/resource_aws_ssm_maintenance_window_task_test.go

---
 aws/resource_aws_ssm_maintenance_window_task_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/aws/resource_aws_ssm_maintenance_window_task_test.go b/aws/resource_aws_ssm_maintenance_window_task_test.go
index 54a43e83d97..410038a9de2 100644
--- a/aws/resource_aws_ssm_maintenance_window_task_test.go
+++ b/aws/resource_aws_ssm_maintenance_window_task_test.go
@@ -466,6 +466,7 @@ resource "aws_iam_role" "test" {
 POLICY
 
 }
+
 resource "aws_iam_role_policy" "test" {
   name = %[1]q
   role = aws_iam_role.test.name