add data source for aws_controltower_controls

.changelog/26978.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_controltower_controls
+```

internal/provider/provider.go

@@ -61,6 +61,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/service/comprehend"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/configservice"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/connect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/controltower"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/cur"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/dataexchange"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/datapipeline"
@@ -515,6 +516,8 @@ func New(_ context.Context) (*schema.Provider, error) {
 			"aws_connect_user_hierarchy_group":        connect.DataSourceUserHierarchyGroup(),
 			"aws_connect_user_hierarchy_structure":    connect.DataSourceUserHierarchyStructure(),
 
+			"aws_controltower_controls": controltower.DataSourceControls(),
+
 			"aws_cur_report_definition": cur.DataSourceReportDefinition(),
 
 			"aws_datapipeline_pipeline":            datapipeline.DataSourcePipeline(),

internal/service/controltower/controls_data_source.go

@@ -0,0 +1,65 @@
+package controltower
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/controltower"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+func DataSourceControls() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: DataSourceControlsRead,
+
+		Schema: map[string]*schema.Schema{
+			"enabled_controls": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"target_identifier": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+		},
+	}
+}
+
+func DataSourceControlsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).ControlTowerConn
+
+	targetIdentifier := d.Get("target_identifier").(string)
+	input := &controltower.ListEnabledControlsInput{
+		TargetIdentifier: aws.String(targetIdentifier),
+	}
+
+	var controls []string
+	err := conn.ListEnabledControlsPagesWithContext(ctx, input, func(page *controltower.ListEnabledControlsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, control := range page.EnabledControls {
+			if control == nil {
+				continue
+			}
+			controls = append(controls, aws.StringValue(control.ControlIdentifier))
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return diag.Errorf("listing ControlTower Controls (%s): %s", targetIdentifier, err)
+	}
+
+	d.SetId(targetIdentifier)
+	d.Set("enabled_controls", controls)
+
+	return nil
+}

internal/service/controltower/controls_data_source_test.go

@@ -0,0 +1,89 @@
+package controltower_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/cloudtrail"
+	"github.com/aws/aws-sdk-go/service/controltower"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+)
+
+func TestAccControlTowerControlsDataSource_basic(t *testing.T) {
+	dataSourceName := "data.aws_controltower_controls.test"
+	ouName := "Security"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(t)
+			acctest.PreCheckOrganizationManagementAccount(t)
+			testAccPreCheck(t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, controltower.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccControlsDataSourceConfig_id(ouName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, "enabled_controls.#"),
+				),
+			},
+		},
+	})
+}
+
+func testAccPreCheck(t *testing.T) {
+	// leverage the control tower created "aws-controltower-BaselineCloudTrail" to confirm control tower is deployed
+	var trails []string
+	conn := acctest.Provider.Meta().(*conns.AWSClient).CloudTrailConn
+
+	input := &cloudtrail.ListTrailsInput{}
+	err := conn.ListTrailsPages(input, func(page *cloudtrail.ListTrailsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, trail := range page.Trails {
+			if trail == nil {
+				continue
+			}
+			trails = append(trails, *trail.Name)
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+
+	// Ensure there is a Control Tower trail
+	ctTrail := false
+	for _, t := range trails {
+		if t == "aws-controltower-BaselineCloudTrail" {
+			ctTrail = true
+		}
+	}
+	if !ctTrail {
+		t.Skip("skipping since Control Tower not found")
+	}
+}
+
+func testAccControlsDataSourceConfig_id(ouName string) string {
+	return fmt.Sprintf(`
+data "aws_organizations_organization" "test" {}
+
+data "aws_organizations_organizational_units" "test" {
+  parent_id = data.aws_organizations_organization.test.roots[0].id
+}
+
+data "aws_controltower_controls" "test" {
+  target_identifier = [
+    for x in data.aws_organizations_organizational_units.test.children :
+    x.arn if x.name == "%[1]s"
+  ][0]
+}
+`, ouName)
+}

website/docs/d/controltower_controls.html.markdown

@@ -0,0 +1,43 @@
+---
+subcategory: "Control Tower"
+layout: "aws"
+page_title: "AWS: aws_controltower_controls"
+description: |-
+  List of Control Tower controls applied to an OU.
+---
+
+# Data Source: aws_controltower_controls
+
+List of Control Tower controls applied to an OU.
+
+## Example Usage
+
+```terraform
+data "aws_organizations_organization" "this" {}
+
+data "aws_organizations_organizational_units" "this" {
+  parent_id = data.aws_organizations_organization.this.roots[0].id
+}
+
+data "aws_controltower_controls" "this" {
+
+  target_identifier = [
+    for x in data.aws_organizations_organizational_units.this.children :
+    x.arn if x.name == "Security"
+  ][0]
+
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `target_identifier` - (Required) The ARN of the organizational unit.
+
+## Attribute Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `enabled_controls` - List of all the ARNs for the controls applied to the `target_identifier`.