Service Catalog Provisioned Product and related resources

aws/provider.go

@@ -805,6 +805,10 @@ func Provider() terraform.ResourceProvider {
 			"aws_securityhub_product_subscription":                    resourceAwsSecurityHubProductSubscription(),
 			"aws_securityhub_standards_subscription":                  resourceAwsSecurityHubStandardsSubscription(),
 			"aws_servicecatalog_portfolio":                            resourceAwsServiceCatalogPortfolio(),
+			"aws_servicecatalog_portfolio_principal_association":      resourceAwsServiceCatalogPortfolioPrincipalAssociation(),
+			"aws_servicecatalog_portfolio_product_association":        resourceAwsServiceCatalogPortfolioProductAssociation(),
+			"aws_servicecatalog_product":                              resourceAwsServiceCatalogProduct(),
+			"aws_servicecatalog_provisioned_product":                  resourceAwsServiceCatalogProvisionedProduct(),
 			"aws_service_discovery_http_namespace":                    resourceAwsServiceDiscoveryHttpNamespace(),
 			"aws_service_discovery_private_dns_namespace":             resourceAwsServiceDiscoveryPrivateDnsNamespace(),
 			"aws_service_discovery_public_dns_namespace":              resourceAwsServiceDiscoveryPublicDnsNamespace(),

aws/resource_aws_servicecatalog_portfolio_principal_association.go

@@ -0,0 +1,165 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/servicecatalog"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"log"
+	"strings"
+	"time"
+)
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociation() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsServiceCatalogPortfolioPrincipalAssociationCreate,
+		Read:   resourceAwsServiceCatalogPortfolioPrincipalAssociationRead,
+		Update: resourceAwsServiceCatalogPortfolioPrincipalAssociationUpdate,
+		Delete: resourceAwsServiceCatalogPortfolioPrincipalAssociationDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Update: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+		Schema: map[string]*schema.Schema{
+			"portfolio_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"principal_arn": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationCreate(d *schema.ResourceData, meta interface{}) error {
+	_, portfolioId, principalArn := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	input := servicecatalog.AssociatePrincipalWithPortfolioInput{
+		PortfolioId:   aws.String(portfolioId),
+		PrincipalARN:  aws.String(principalArn),
+		PrincipalType: aws.String("IAM"),
+	}
+	conn := meta.(*AWSClient).scconn
+	_, err := conn.AssociatePrincipalWithPortfolio(&input)
+	if err != nil {
+		return fmt.Errorf("creating Service Catalog Principal(%s)/Portfolio(%s) Association failed: %s",
+			principalArn, portfolioId, err.Error())
+	}
+
+	stateConf := resource.StateChangeConf{
+		Pending:      []string{servicecatalog.StatusCreating},
+		Target:       []string{servicecatalog.StatusAvailable},
+		Timeout:      1 * time.Minute,
+		PollInterval: 3 * time.Second,
+		Refresh: func() (interface{}, string, error) {
+			err := resourceAwsServiceCatalogPortfolioPrincipalAssociationRead(d, meta)
+			if err != nil {
+				return 42, "", err
+			}
+			if d.Id() != "" {
+				return 42, servicecatalog.StatusAvailable, err
+			}
+			return 0, servicecatalog.StatusCreating, err
+		},
+	}
+	_, err = stateConf.WaitForState()
+	return err
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationRead(d *schema.ResourceData, meta interface{}) error {
+	id, portfolioId, principalArn := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	input := servicecatalog.ListPrincipalsForPortfolioInput{
+		PortfolioId: aws.String(portfolioId),
+	}
+	conn := meta.(*AWSClient).scconn
+	var pageToken = ""
+	isFound := false
+	for {
+		pageOfDetails, nextPageToken, err := resourceAwsServiceCatalogPortfolioPrincipalAssociationListPrincipalsForPortfolioPage(conn, input, &pageToken)
+		if err != nil {
+			return err
+		}
+		for _, principal := range pageOfDetails {
+			if *principal.PrincipalARN == principalArn {
+				isFound = true
+				d.SetId(id)
+				break
+			}
+		}
+		if nextPageToken == nil || isFound {
+			break
+		}
+		pageToken = *nextPageToken
+	}
+	if !isFound {
+		log.Printf("[WARN] Service Catalog Principal(%s)/Portfolio(%s) Association not found, removing from state",
+			principalArn, portfolioId)
+		d.SetId("")
+	}
+	d.Set("principal_arn", principalArn)
+	d.Set("portfolio_id", portfolioId)
+	return nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationListPrincipalsForPortfolioPage(conn *servicecatalog.ServiceCatalog, input servicecatalog.ListPrincipalsForPortfolioInput, nextPageToken *string) ([]*servicecatalog.Principal, *string, error) {
+	input.PageToken = nextPageToken
+	var page, err = conn.ListPrincipalsForPortfolio(&input)
+	if err != nil {
+		return nil, nil, fmt.Errorf("retrieving Service Catalog Associations for Principal/Portfolios: %s", err.Error())
+	}
+	principalDetails := page.Principals
+	return principalDetails, page.NextPageToken, nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationUpdate(d *schema.ResourceData, meta interface{}) error {
+	const principalArnKey = "principal_arn"
+	const portfolioIdKey = "portfolio_id"
+	if d.HasChange(principalArnKey) || d.HasChange(portfolioIdKey) {
+		oldPrincipalArn, newPrincipalArn := d.GetChange(principalArnKey)
+		oldPortfolioId, newPortfolioId := d.GetChange(portfolioIdKey)
+		d.Set(principalArnKey, oldPrincipalArn)
+		d.Set(portfolioIdKey, oldPortfolioId)
+		resourceAwsServiceCatalogPortfolioPrincipalAssociationDelete(d, meta)
+		d.Set(principalArnKey, newPrincipalArn)
+		d.Set(portfolioIdKey, newPortfolioId)
+		resourceAwsServiceCatalogPortfolioPrincipalAssociationCreate(d, meta)
+	}
+	return resourceAwsServiceCatalogPortfolioPrincipalAssociationRead(d, meta)
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationDelete(d *schema.ResourceData, meta interface{}) error {
+	_, portfolioId, principalArn := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	input := servicecatalog.DisassociatePrincipalFromPortfolioInput{
+		PortfolioId:  aws.String(portfolioId),
+		PrincipalARN: aws.String(principalArn),
+	}
+	conn := meta.(*AWSClient).scconn
+	_, err := conn.DisassociatePrincipalFromPortfolio(&input)
+	if err != nil {
+		return fmt.Errorf("deleting Service Catalog Principal(%s)/Portfolio(%s) Association failed: %s",
+			principalArn, portfolioId, err.Error())
+	}
+	return nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d *schema.ResourceData) (string, string, string) {
+	if principalArn, ok := d.GetOk("principal_arn"); ok {
+		portfolioId := d.Get("portfolio_id").(string)
+		id := portfolioId + "--" + principalArn.(string)
+		return id, portfolioId, principalArn.(string)
+	}
+	return parseServiceCatalogPortfolioPrincipalAssociationResourceId(d.Id())
+}
+
+func parseServiceCatalogPortfolioPrincipalAssociationResourceId(id string) (string, string, string) {
+	s := strings.SplitN(id, "--", 2)
+	portfolioId := s[0]
+	principalArn := s[1]
+	return id, portfolioId, principalArn
+}

aws/resource_aws_servicecatalog_portfolio_principal_association_test.go

@@ -0,0 +1,119 @@
+package aws
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/service/servicecatalog"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/terraform"
+	"testing"
+)
+
+func TestAccAWSServiceCatalogPortfolioPrincipalAssociation_Basic(t *testing.T) {
+	salt := acctest.RandString(5)
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckServiceCatalogPortfolioPrincipalAssociationDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigBasic(salt),
+				Check:  testAccCheckAwsServiceCatalogPortfolioPrincipalAssociation(),
+			},
+			{
+				ResourceName:      "aws_servicecatalog_portfolio_principal_association.association",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckAwsServiceCatalogPortfolioPrincipalAssociation() resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := testAccProvider.Meta().(*AWSClient).scconn
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_servicecatalog_portfolio_principal_association" {
+				continue // not our monkey
+			}
+			_, portfolioId, principalArn := parseServiceCatalogPortfolioPrincipalAssociationResourceId(rs.Primary.ID)
+			input := servicecatalog.ListPrincipalsForPortfolioInput{PortfolioId: &portfolioId}
+			page, err := conn.ListPrincipalsForPortfolio(&input)
+			if err != nil {
+				return err
+			}
+			for _, principalDetail := range page.Principals {
+				if *principalDetail.PrincipalARN == principalArn {
+					return nil //is good
+				}
+			}
+			return fmt.Errorf("association not found between portfolio %s and principal %s", portfolioId, principalArn)
+		}
+		return fmt.Errorf("no associations found")
+	}
+}
+
+func testAccCheckServiceCatalogPortfolioPrincipalAssociationDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).scconn
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_servicecatalog_portfolio_principal_association" {
+			continue // not our monkey
+		}
+		_, portfolioId, principalArn := parseServiceCatalogPortfolioPrincipalAssociationResourceId(rs.Primary.ID)
+		input := servicecatalog.ListPrincipalsForPortfolioInput{PortfolioId: &portfolioId}
+		page, err := conn.ListPrincipalsForPortfolio(&input)
+		if err != nil {
+			if isAWSErr(err, servicecatalog.ErrCodeResourceNotFoundException, "") {
+				return nil // not found for principal is good
+			}
+			return err // some other unexpected error
+		}
+		for _, principalDetail := range page.Principals {
+			if *principalDetail.PrincipalARN == principalArn {
+				return fmt.Errorf("expected AWS Service Catalog Portfolio Principal Association to be gone, but it was still found")
+			}
+		}
+	}
+	return nil
+}
+
+func testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigBasic(salt string) string {
+	return testAccCheckAwsServiceCatalogPortfolioResourceConfigBasic("tfm-test-"+salt) + "\n" +
+		testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigRoleAndAssociation(salt)
+}
+
+func testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigRole(salt string) string {
+	roleName := "tfm-sc-tester-" + salt
+	return fmt.Sprintf(`
+# IAM
+resource "aws_iam_role" "tfm-sc-tester" {
+  name = "%s"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": { "AWS": "*" },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+`, roleName)
+}
+
+func testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigAssociation() string {
+	return fmt.Sprintf(`
+resource "aws_servicecatalog_portfolio_principal_association" "association" {
+    portfolio_id = aws_servicecatalog_portfolio.test.id
+    principal_arn = aws_iam_role.tfm-sc-tester.arn
+}`)
+}
+
+func testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigRoleAndAssociation(salt string) string {
+	return testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigRole(salt) +
+		testAccCheckAwsServiceCatalogPortfolioPrincipalAssociationConfigAssociation()
+}