f-data-networkfirewall_firewall_resource_policy

.changelog/25474.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_networkfirewall_resource_policy
+```

internal/service/networkfirewall/firewall_resource_policy_data_source.go

@@ -0,0 +1,51 @@
+package networkfirewall
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// @SDKDataSource("aws_networkfirewall_resource_policy")
+func DataSourceFirewallResourcePolicy() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceFirewallResourcePolicyRead,
+
+		Schema: map[string]*schema.Schema{
+			"policy": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"resource_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+		},
+	}
+}
+
+func dataSourceFirewallResourcePolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).NetworkFirewallConn()
+
+	resourceARN := d.Get("resource_arn").(string)
+	policy, err := FindResourcePolicy(ctx, conn, resourceARN)
+
+	if err != nil {
+		return diag.Errorf("reading NetworkFirewall Resource Policy (%s): %s", resourceARN, err)
+	}
+
+	if policy == nil {
+		return diag.Errorf("reading NetworkFirewall Resource Policy (%s): empty output", resourceARN)
+	}
+
+	d.SetId(resourceARN)
+	d.Set("policy", policy)
+	d.Set("resource_arn", resourceARN)
+
+	return nil
+}

internal/service/networkfirewall/firewall_resource_policy_data_source_test.go

@@ -0,0 +1,73 @@
+package networkfirewall_test
+
+import (
+	"fmt"
+	"regexp"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/networkfirewall"
+	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccNetworkFirewallFirewallResourcePolicyDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_networkfirewall_resource_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, networkfirewall.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourcePolicyDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_networkfirewall_firewall_policy.test", "arn"),
+				),
+			},
+		},
+	})
+}
+
+func testAccResourcePolicyDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_networkfirewall_resource_policy" "test" {
+  resource_arn = aws_networkfirewall_resource_policy.test.resource_arn
+}
+
+resource "aws_networkfirewall_firewall_policy" "test" {
+  name = %[1]q
+
+  firewall_policy {
+    stateless_fragment_default_actions = ["aws:drop"]
+    stateless_default_actions          = ["aws:pass"]
+  }
+}
+
+resource "aws_networkfirewall_resource_policy" "test" {
+  resource_arn = aws_networkfirewall_firewall_policy.test.arn
+
+  policy = jsonencode({
+    Statement = [{
+      Action = [
+        "network-firewall:AssociateFirewallPolicy",
+        "network-firewall:ListFirewallPolicies",
+      ]
+      Effect   = "Allow"
+      Resource = aws_networkfirewall_firewall_policy.test.arn
+      Principal = {
+        AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      }
+    }]
+    Version = "2012-10-17"
+  })
+}
+`, rName)
+}

website/docs/d/networkfirewall_resource_policy.html.markdown

@@ -0,0 +1,32 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_resource_policy"
+description: |-
+  Retrieve information about a Network Firewall resource policy.
+---
+
+# Data Source: aws_networkfirewall_resource_policy
+
+Retrieve information about a Network Firewall resource policy.
+
+## Example Usage
+
+```terraform
+data "aws_networkfirewall_resource_policy" "example" {
+  resource_arn = var.resource_policy_arn
+}
+```
+
+## Argument Reference
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) that identifies the resource policy.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the resource policy.
+* `policy` - The [policy][1] for the resource.
+
+[1]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_resource_policy