terraform/builtin/providers/aws/resource_aws_db_security_gr...

427 lines
11 KiB
Go
Raw Normal View History

2014-07-23 04:22:52 +02:00
package aws
import (
2014-11-24 14:04:48 +01:00
"bytes"
2014-07-23 04:22:52 +02:00
"fmt"
"log"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/service/rds"
"github.com/hashicorp/go-multierror"
2014-11-24 14:04:48 +01:00
"github.com/hashicorp/terraform/helper/hashcode"
2014-07-23 04:22:52 +02:00
"github.com/hashicorp/terraform/helper/resource"
"github.com/hashicorp/terraform/helper/schema"
2014-07-23 04:22:52 +02:00
)
func resourceAwsDbSecurityGroup() *schema.Resource {
return &schema.Resource{
Create: resourceAwsDbSecurityGroupCreate,
Read: resourceAwsDbSecurityGroupRead,
Update: resourceAwsDbSecurityGroupUpdate,
Delete: resourceAwsDbSecurityGroupDelete,
Importer: &schema.ResourceImporter{
State: schema.ImportStatePassthrough,
},
Schema: map[string]*schema.Schema{
"arn": &schema.Schema{
Type: schema.TypeString,
Computed: true,
},
"name": &schema.Schema{
Type: schema.TypeString,
Required: true,
ForceNew: true,
},
"description": &schema.Schema{
Type: schema.TypeString,
Optional: true,
ForceNew: true,
Default: "Managed by Terraform",
},
"ingress": &schema.Schema{
2014-11-24 14:04:48 +01:00
Type: schema.TypeSet,
Required: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"cidr": &schema.Schema{
Type: schema.TypeString,
2014-11-24 14:04:48 +01:00
Optional: true,
},
"security_group_name": &schema.Schema{
Type: schema.TypeString,
2014-11-24 14:04:48 +01:00
Optional: true,
Computed: true,
},
"security_group_id": &schema.Schema{
Type: schema.TypeString,
Optional: true,
Computed: true,
},
"security_group_owner_id": &schema.Schema{
Type: schema.TypeString,
Optional: true,
Computed: true,
},
},
},
2014-11-24 14:04:48 +01:00
Set: resourceAwsDbSecurityGroupIngressHash,
},
"tags": tagsSchema(),
},
}
}
2014-07-23 04:22:52 +02:00
func resourceAwsDbSecurityGroupCreate(d *schema.ResourceData, meta interface{}) error {
conn := meta.(*AWSClient).rdsconn
tags := tagsFromMapRDS(d.Get("tags").(map[string]interface{}))
2014-07-23 04:22:52 +02:00
var err error
var errs []error
2015-04-15 22:02:52 +02:00
opts := rds.CreateDBSecurityGroupInput{
DBSecurityGroupName: aws.String(d.Get("name").(string)),
DBSecurityGroupDescription: aws.String(d.Get("description").(string)),
Tags: tags,
2014-07-23 04:22:52 +02:00
}
log.Printf("[DEBUG] DB Security Group create configuration: %#v", opts)
_, err = conn.CreateDBSecurityGroup(&opts)
if err != nil {
return fmt.Errorf("Error creating DB Security Group: %s", err)
2014-07-23 04:22:52 +02:00
}
d.SetId(d.Get("name").(string))
2014-07-23 04:22:52 +02:00
log.Printf("[INFO] DB Security Group ID: %s", d.Id())
2014-07-23 04:22:52 +02:00
sg, err := resourceAwsDbSecurityGroupRetrieve(d, meta)
2014-07-23 04:22:52 +02:00
if err != nil {
return err
2014-07-23 04:22:52 +02:00
}
2014-11-24 14:04:48 +01:00
ingresses := d.Get("ingress").(*schema.Set)
for _, ing := range ingresses.List() {
err := resourceAwsDbSecurityGroupAuthorizeRule(ing, *sg.DBSecurityGroupName, conn)
2014-11-24 14:04:48 +01:00
if err != nil {
errs = append(errs, err)
2014-07-23 04:22:52 +02:00
}
2014-11-24 14:04:48 +01:00
}
2014-07-23 04:22:52 +02:00
2014-11-24 14:04:48 +01:00
if len(errs) > 0 {
return &multierror.Error{Errors: errs}
2014-07-23 04:22:52 +02:00
}
log.Println(
"[INFO] Waiting for Ingress Authorizations to be authorized")
stateConf := &resource.StateChangeConf{
Pending: []string{"authorizing"},
Target: []string{"authorized"},
2014-11-24 14:04:48 +01:00
Refresh: resourceAwsDbSecurityGroupStateRefreshFunc(d, meta),
2014-07-23 04:22:52 +02:00
Timeout: 10 * time.Minute,
}
// Wait, catching any errors
_, err = stateConf.WaitForState()
if err != nil {
return err
}
return resourceAwsDbSecurityGroupRead(d, meta)
2014-07-23 04:22:52 +02:00
}
func resourceAwsDbSecurityGroupRead(d *schema.ResourceData, meta interface{}) error {
sg, err := resourceAwsDbSecurityGroupRetrieve(d, meta)
2014-07-23 04:22:52 +02:00
if err != nil {
return err
2014-07-23 04:22:52 +02:00
}
d.Set("name", *sg.DBSecurityGroupName)
d.Set("description", *sg.DBSecurityGroupDescription)
2014-07-23 04:22:52 +02:00
2014-11-24 14:04:48 +01:00
// Create an empty schema.Set to hold all ingress rules
rules := &schema.Set{
F: resourceAwsDbSecurityGroupIngressHash,
2014-07-23 04:22:52 +02:00
}
for _, v := range sg.IPRanges {
rule := map[string]interface{}{"cidr": *v.CIDRIP}
2014-11-24 14:04:48 +01:00
rules.Add(rule)
2014-07-23 04:22:52 +02:00
}
for _, g := range sg.EC2SecurityGroups {
2014-11-24 14:04:48 +01:00
rule := map[string]interface{}{
"security_group_name": *g.EC2SecurityGroupName,
"security_group_id": *g.EC2SecurityGroupId,
"security_group_owner_id": *g.EC2SecurityGroupOwnerId,
2014-11-24 14:04:48 +01:00
}
rules.Add(rule)
2014-07-23 04:22:52 +02:00
}
2014-11-24 14:04:48 +01:00
d.Set("ingress", rules)
conn := meta.(*AWSClient).rdsconn
arn, err := buildRDSSecurityGroupARN(d.Id(), meta.(*AWSClient).accountid, meta.(*AWSClient).region)
if err != nil {
name := "<empty>"
if sg.DBSecurityGroupName != nil && *sg.DBSecurityGroupName != "" {
name = *sg.DBSecurityGroupName
}
log.Printf("[DEBUG] Error building ARN for DB Security Group, not setting Tags for DB Security Group %s", name)
} else {
d.Set("arn", arn)
resp, err := conn.ListTagsForResource(&rds.ListTagsForResourceInput{
ResourceName: aws.String(arn),
})
if err != nil {
log.Printf("[DEBUG] Error retrieving tags for ARN: %s", arn)
}
var dt []*rds.Tag
if len(resp.TagList) > 0 {
dt = resp.TagList
}
d.Set("tags", tagsToMapRDS(dt))
}
return nil
2014-07-23 04:22:52 +02:00
}
func resourceAwsDbSecurityGroupUpdate(d *schema.ResourceData, meta interface{}) error {
conn := meta.(*AWSClient).rdsconn
d.Partial(true)
if arn, err := buildRDSSecurityGroupARN(d.Id(), meta.(*AWSClient).accountid, meta.(*AWSClient).region); err == nil {
if err := setTagsRDS(conn, d, arn); err != nil {
return err
} else {
d.SetPartial("tags")
}
}
if d.HasChange("ingress") {
sg, err := resourceAwsDbSecurityGroupRetrieve(d, meta)
if err != nil {
return err
}
oi, ni := d.GetChange("ingress")
if oi == nil {
oi = new(schema.Set)
}
if ni == nil {
ni = new(schema.Set)
}
ois := oi.(*schema.Set)
nis := ni.(*schema.Set)
removeIngress := ois.Difference(nis).List()
newIngress := nis.Difference(ois).List()
// DELETE old Ingress rules
for _, ing := range removeIngress {
err := resourceAwsDbSecurityGroupRevokeRule(ing, *sg.DBSecurityGroupName, conn)
if err != nil {
return err
}
}
// ADD new/updated Ingress rules
for _, ing := range newIngress {
err := resourceAwsDbSecurityGroupAuthorizeRule(ing, *sg.DBSecurityGroupName, conn)
if err != nil {
return err
}
}
}
d.Partial(false)
return resourceAwsDbSecurityGroupRead(d, meta)
}
func resourceAwsDbSecurityGroupDelete(d *schema.ResourceData, meta interface{}) error {
conn := meta.(*AWSClient).rdsconn
log.Printf("[DEBUG] DB Security Group destroy: %v", d.Id())
2015-04-15 22:02:52 +02:00
opts := rds.DeleteDBSecurityGroupInput{DBSecurityGroupName: aws.String(d.Id())}
log.Printf("[DEBUG] DB Security Group destroy configuration: %v", opts)
2015-04-15 22:02:52 +02:00
_, err := conn.DeleteDBSecurityGroup(&opts)
if err != nil {
newerr, ok := err.(awserr.Error)
if ok && newerr.Code() == "InvalidDBSecurityGroup.NotFound" {
return nil
}
return err
}
return nil
}
func resourceAwsDbSecurityGroupRetrieve(d *schema.ResourceData, meta interface{}) (*rds.DBSecurityGroup, error) {
conn := meta.(*AWSClient).rdsconn
2015-04-15 22:02:52 +02:00
opts := rds.DescribeDBSecurityGroupsInput{
DBSecurityGroupName: aws.String(d.Id()),
2014-07-23 04:22:52 +02:00
}
log.Printf("[DEBUG] DB Security Group describe configuration: %#v", opts)
resp, err := conn.DescribeDBSecurityGroups(&opts)
if err != nil {
return nil, fmt.Errorf("Error retrieving DB Security Groups: %s", err)
}
if len(resp.DBSecurityGroups) != 1 ||
*resp.DBSecurityGroups[0].DBSecurityGroupName != d.Id() {
return nil, fmt.Errorf("Unable to find DB Security Group: %#v", resp.DBSecurityGroups)
2014-07-23 04:22:52 +02:00
}
2015-04-15 22:02:52 +02:00
return resp.DBSecurityGroups[0], nil
2014-07-23 04:22:52 +02:00
}
// Authorizes the ingress rule on the db security group
func resourceAwsDbSecurityGroupAuthorizeRule(ingress interface{}, dbSecurityGroupName string, conn *rds.RDS) error {
2014-07-23 04:22:52 +02:00
ing := ingress.(map[string]interface{})
2015-04-15 22:02:52 +02:00
opts := rds.AuthorizeDBSecurityGroupIngressInput{
DBSecurityGroupName: aws.String(dbSecurityGroupName),
2014-07-23 04:22:52 +02:00
}
2014-11-24 14:04:48 +01:00
if attr, ok := ing["cidr"]; ok && attr != "" {
opts.CIDRIP = aws.String(attr.(string))
2014-11-24 14:04:48 +01:00
}
2014-07-23 04:22:52 +02:00
2014-11-24 14:04:48 +01:00
if attr, ok := ing["security_group_name"]; ok && attr != "" {
opts.EC2SecurityGroupName = aws.String(attr.(string))
2014-07-23 04:22:52 +02:00
}
2014-11-24 14:04:48 +01:00
if attr, ok := ing["security_group_id"]; ok && attr != "" {
opts.EC2SecurityGroupId = aws.String(attr.(string))
2014-11-24 14:04:48 +01:00
}
if attr, ok := ing["security_group_owner_id"]; ok && attr != "" {
opts.EC2SecurityGroupOwnerId = aws.String(attr.(string))
2014-07-23 04:22:52 +02:00
}
log.Printf("[DEBUG] Authorize ingress rule configuration: %#v", opts)
_, err := conn.AuthorizeDBSecurityGroupIngress(&opts)
if err != nil {
return fmt.Errorf("Error authorizing security group ingress: %s", err)
}
return nil
}
// Revokes the ingress rule on the db security group
func resourceAwsDbSecurityGroupRevokeRule(ingress interface{}, dbSecurityGroupName string, conn *rds.RDS) error {
ing := ingress.(map[string]interface{})
opts := rds.RevokeDBSecurityGroupIngressInput{
DBSecurityGroupName: aws.String(dbSecurityGroupName),
}
if attr, ok := ing["cidr"]; ok && attr != "" {
opts.CIDRIP = aws.String(attr.(string))
}
if attr, ok := ing["security_group_name"]; ok && attr != "" {
opts.EC2SecurityGroupName = aws.String(attr.(string))
}
if attr, ok := ing["security_group_id"]; ok && attr != "" {
opts.EC2SecurityGroupId = aws.String(attr.(string))
}
if attr, ok := ing["security_group_owner_id"]; ok && attr != "" {
opts.EC2SecurityGroupOwnerId = aws.String(attr.(string))
}
log.Printf("[DEBUG] Revoking ingress rule configuration: %#v", opts)
_, err := conn.RevokeDBSecurityGroupIngress(&opts)
if err != nil {
return fmt.Errorf("Error revoking security group ingress: %s", err)
}
return nil
}
2014-11-24 14:04:48 +01:00
func resourceAwsDbSecurityGroupIngressHash(v interface{}) int {
var buf bytes.Buffer
m := v.(map[string]interface{})
if v, ok := m["cidr"]; ok {
buf.WriteString(fmt.Sprintf("%s-", v.(string)))
}
if v, ok := m["security_group_name"]; ok {
buf.WriteString(fmt.Sprintf("%s-", v.(string)))
}
if v, ok := m["security_group_id"]; ok {
buf.WriteString(fmt.Sprintf("%s-", v.(string)))
}
if v, ok := m["security_group_owner_id"]; ok {
buf.WriteString(fmt.Sprintf("%s-", v.(string)))
}
return hashcode.String(buf.String())
}
func resourceAwsDbSecurityGroupStateRefreshFunc(
d *schema.ResourceData, meta interface{}) resource.StateRefreshFunc {
2014-07-23 04:22:52 +02:00
return func() (interface{}, string, error) {
2014-11-24 14:04:48 +01:00
v, err := resourceAwsDbSecurityGroupRetrieve(d, meta)
2014-07-23 04:22:52 +02:00
if err != nil {
log.Printf("Error on retrieving DB Security Group when waiting: %s", err)
return nil, "", err
}
statuses := make([]string, 0, len(v.EC2SecurityGroups)+len(v.IPRanges))
for _, ec2g := range v.EC2SecurityGroups {
statuses = append(statuses, *ec2g.Status)
}
for _, ips := range v.IPRanges {
statuses = append(statuses, *ips.Status)
}
2014-07-23 04:22:52 +02:00
for _, stat := range statuses {
// Not done
if stat != "authorized" {
return nil, "authorizing", nil
}
}
return v, "authorized", nil
}
}
func buildRDSSecurityGroupARN(identifier, accountid, region string) (string, error) {
if accountid == "" {
return "", fmt.Errorf("Unable to construct RDS ARN because of missing AWS Account ID")
}
arn := fmt.Sprintf("arn:aws:rds:%s:%s:secgrp:%s", region, accountid, identifier)
return arn, nil
}