Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

resource/aws_acm_certificate_validation: Fix root and wildcard validation_record_fqdns handling #3366

Merged
merged 2 commits into from
Feb 16, 2018
Merged

resource/aws_acm_certificate_validation: Fix root and wildcard validation_record_fqdns handling #3366

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d201aae
resource/aws_acm_certificate_validation: Fix root and wildcard valida…
bflad Feb 14, 2018
ec6f2eb
resource/aws_acm_certificate_validation: #3366 PR review comments
bflad Feb 16, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
241 changes: 219 additions & 22 deletions aws/resource_aws_acm_certificate_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,16 +17,19 @@ import (

var certificateArnRegex = regexp.MustCompile(`^arn:aws:acm:[^:]+:[^:]+:certificate/.+$`)

func TestAccAwsAcmCertificate_emailValidation(t *testing.T) {
func testAccAwsAcmCertificateDomainFromEnv(t *testing.T) string {
if os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN") == "" {
t.Skip("Environment variable ACM_CERTIFICATE_ROOT_DOMAIN is not set")
}
return os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add any brief instructions in a comment on what is this domain in case it's not clear from the ENV variable name?

e.g.

// ACM_CERTIFICATE_ROOT_DOMAIN is a domain that was previously registered
// and successfully verified via ACM either via email or DNS
// See https://us-west-2.console.aws.amazon.com/acm/home

Also I assume the verification only needs to be done for the TLD (root) domain (e.g. terraformtesting.com), not for SAN or anything else?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, its more complicated then that. Its per domain in each certificate request done via email validation. So if I request foo.example.com and bar.example.com with email validation, I will get two approval emails for that single request. If I go to renew them, I have to click the emails again. Hence why everyone was clamoring for DNS validation 😁

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I'll definitely add information about the environment variable, its non-descriptive at the moment.

}

root_zone_domain := os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN")
func TestAccAwsAcmCertificate_emailValidation(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

rInt1 := acctest.RandInt()

domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, root_zone_domain)
domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand All @@ -38,6 +41,7 @@ func TestAccAwsAcmCertificate_emailValidation(t *testing.T) {
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", domain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "0"),
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "validation_emails.0", regexp.MustCompile(`^[^@]+@.+$`)),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodEmail),
Expand All @@ -54,15 +58,11 @@ func TestAccAwsAcmCertificate_emailValidation(t *testing.T) {
}

func TestAccAwsAcmCertificate_dnsValidation(t *testing.T) {
if os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN") == "" {
t.Skip("Environment variable ACM_CERTIFICATE_ROOT_DOMAIN is not set")
}

root_zone_domain := os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN")
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

rInt1 := acctest.RandInt()

domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, root_zone_domain)
domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand All @@ -74,7 +74,13 @@ func TestAccAwsAcmCertificate_dnsValidation(t *testing.T) {
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", domain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", domain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
Expand All @@ -87,17 +93,83 @@ func TestAccAwsAcmCertificate_dnsValidation(t *testing.T) {
})
}

func TestAccAwsAcmCertificate_subjectAlternativeNames(t *testing.T) {
if os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN") == "" {
t.Skip("Environment variable ACM_CERTIFICATE_ROOT_DOMAIN is not set")
}
func TestAccAwsAcmCertificate_root(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAcmCertificateDestroy,
Steps: []resource.TestStep{
resource.TestStep{
Config: testAccAcmCertificateConfig(rootDomain, acm.ValidationMethodDns),
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", rootDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", rootDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
resource.TestStep{
ResourceName: "aws_acm_certificate.cert",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

root_zone_domain := os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN")
func TestAccAwsAcmCertificate_rootAndWildcardSubjectAlternativeName(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)
wildcardDomain := fmt.Sprintf("*.%s", rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAcmCertificateDestroy,
Steps: []resource.TestStep{
resource.TestStep{
Config: testAccAcmCertificateConfig_subjectAlternativeNames(rootDomain, strconv.Quote(wildcardDomain), acm.ValidationMethodDns),
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", rootDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "2"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", rootDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.domain_name", wildcardDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.0", wildcardDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
resource.TestStep{
ResourceName: "aws_acm_certificate.cert",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccAwsAcmCertificate_subjectAlternativeName(t *testing.T) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick: I'd perhaps pick different names for TestAccAwsAcmCertificate_subjectAlternativeName and TestAccAwsAcmCertificate_subjectAlternativeNames below so we can run the first one in isolation if we want to.

e.g. TestAccAwsAcmCertificate_subjectAlternativeName_single and TestAccAwsAcmCertificate_subjectAlternativeName_multiple or we can shorten subjectAlternativeName to SAN as it's very common to do so.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll do both 😄

rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

rInt1 := acctest.RandInt()

domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, root_zone_domain)
sanDomain := fmt.Sprintf("tf-acc-%d-san.%s", rInt1, root_zone_domain)
domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, rootDomain)
sanDomain := fmt.Sprintf("tf-acc-%d-san.%s", rInt1, rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand All @@ -109,8 +181,18 @@ func TestAccAwsAcmCertificate_subjectAlternativeNames(t *testing.T) {
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", domain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "2"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", domain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.domain_name", sanDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.0", sanDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
Expand All @@ -123,16 +205,131 @@ func TestAccAwsAcmCertificate_subjectAlternativeNames(t *testing.T) {
})
}

func TestAccAwsAcmCertificate_tags(t *testing.T) {
if os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN") == "" {
t.Skip("Environment variable ACM_CERTIFICATE_ROOT_DOMAIN is not set")
}
func TestAccAwsAcmCertificate_subjectAlternativeNames(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

rInt1 := acctest.RandInt()

domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, rootDomain)
sanDomain1 := fmt.Sprintf("tf-acc-%d-san1.%s", rInt1, rootDomain)
sanDomain2 := fmt.Sprintf("tf-acc-%d-san2.%s", rInt1, rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAcmCertificateDestroy,
Steps: []resource.TestStep{
resource.TestStep{
Config: testAccAcmCertificateConfig_subjectAlternativeNames(domain, fmt.Sprintf("%q, %q", sanDomain1, sanDomain2), acm.ValidationMethodDns),
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", domain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "3"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", domain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.domain_name", sanDomain1),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.2.domain_name", sanDomain2),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.2.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.2.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.2.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "2"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.0", sanDomain1),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.1", sanDomain2),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
resource.TestStep{
ResourceName: "aws_acm_certificate.cert",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccAwsAcmCertificate_wildcard(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)
wildcardDomain := fmt.Sprintf("*.%s", rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAcmCertificateDestroy,
Steps: []resource.TestStep{
resource.TestStep{
Config: testAccAcmCertificateConfig(wildcardDomain, acm.ValidationMethodDns),
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", wildcardDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", wildcardDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
resource.TestStep{
ResourceName: "aws_acm_certificate.cert",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccAwsAcmCertificate_wildcardAndRootSubjectAlternativeName(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)
wildcardDomain := fmt.Sprintf("*.%s", rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAcmCertificateDestroy,
Steps: []resource.TestStep{
resource.TestStep{
Config: testAccAcmCertificateConfig_subjectAlternativeNames(wildcardDomain, strconv.Quote(rootDomain), acm.ValidationMethodDns),
Check: resource.ComposeTestCheckFunc(
resource.TestMatchResourceAttr("aws_acm_certificate.cert", "arn", certificateArnRegex),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_name", wildcardDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.#", "2"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.domain_name", wildcardDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.0.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.domain_name", rootDomain),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_name"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_type", "CNAME"),
resource.TestCheckResourceAttrSet("aws_acm_certificate.cert", "domain_validation_options.1.resource_record_value"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.#", "1"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "subject_alternative_names.0", rootDomain),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_emails.#", "0"),
resource.TestCheckResourceAttr("aws_acm_certificate.cert", "validation_method", acm.ValidationMethodDns),
),
},
resource.TestStep{
ResourceName: "aws_acm_certificate.cert",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

root_zone_domain := os.Getenv("ACM_CERTIFICATE_ROOT_DOMAIN")
func TestAccAwsAcmCertificate_tags(t *testing.T) {
rootDomain := testAccAwsAcmCertificateDomainFromEnv(t)

rInt1 := acctest.RandInt()

domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, root_zone_domain)
domain := fmt.Sprintf("tf-acc-%d.%s", rInt1, rootDomain)

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand Down
Loading