New resource: aws_macie_member_account_association

[ewbankkit]

Fixes #5202.

[ewbankkit]

Still WIP as I investigate how to deal with the setup steps for Macie member accounts.
Current acceptance tests:

$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSMacieMemberAccountAssociation_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAWSMacieMemberAccountAssociation_ -timeout 120m
=== RUN   TestAccAWSMacieMemberAccountAssociation_self
--- PASS: TestAccAWSMacieMemberAccountAssociation_self (16.57s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	16.580s

[ewbankkit]

For acceptance tests the environment variable MACIE_MEMBER_ACCOUNT_ID should be set the the AWS account ID of an account that has had the setup steps applied.

$ MACIE_MEMBER_ACCOUNT_ID=123456789012 make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSMacieMemberAccountAssociation_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAWSMacieMemberAccountAssociation_ -timeout 120m
=== RUN   TestAccAWSMacieMemberAccountAssociation_basic
--- PASS: TestAccAWSMacieMemberAccountAssociation_basic (17.67s)
=== RUN   TestAccAWSMacieMemberAccountAssociation_self
--- PASS: TestAccAWSMacieMemberAccountAssociation_self (19.48s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	37.166s

[ewbankkit]

Removed WIP.

[bflad]

LGTM -- thanks @ewbankkit! Verified between two test accounts after creating the required IAM setup. 🚀

locals {
  macie_master_account_id = "..."
}

resource "aws_iam_service_linked_role" "AWSServiceRoleForAmazonMacie" {
  aws_service_name = "macie.amazonaws.com"
}

resource "aws_iam_role" "AWSMacieServiceCustomerHandshakeRole" {
  name = "AWSMacieServiceCustomerHandshakeRole"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "macie.amazonaws.com"
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "${local.macie_master_account_id}"
        }
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "AWSMacieServiceCustomerHandshakeRole-AmazonMacieHandshakeRole" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonMacieHandshakeRole"
  role       = "${aws_iam_role.AWSMacieServiceCustomerHandshakeRole.name}"
}

make testacc TEST=./aws TESTARGS='-run=TestAccAWSMacieMemberAccountAssociation'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSMacieMemberAccountAssociation -timeout 120m
=== RUN   TestAccAWSMacieMemberAccountAssociation_basic
--- PASS: TestAccAWSMacieMemberAccountAssociation_basic (13.78s)
=== RUN   TestAccAWSMacieMemberAccountAssociation_self
--- PASS: TestAccAWSMacieMemberAccountAssociation_self (13.65s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	28.038s

[bflad]

Nitpick: We might want to clarify that this is the member account ID

[bflad]

This has been released in version 1.30.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!