From 0edf83008c11e5aca44d3ed22e4280dc7fad3908 Mon Sep 17 00:00:00 2001
From: Paul Stack <public@paulstack.co.uk>
Date: Wed, 20 Jul 2016 17:00:57 +0100
Subject: [PATCH] provider/aws: Support `task_role_arn` on
 `aws_ecs_task_definition` (#7653)

Fixes #7633
---
 .../aws/resource_aws_ecs_task_definition.go   | 11 +++
 .../resource_aws_ecs_task_definition_test.go  | 79 +++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition.go b/builtin/providers/aws/resource_aws_ecs_task_definition.go
index b9b40d6bf..117bbcdf2 100644
--- a/builtin/providers/aws/resource_aws_ecs_task_definition.go
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition.go
@@ -46,6 +46,12 @@ func resourceAwsEcsTaskDefinition() *schema.Resource {
 				},
 			},
 
+			"task_role_arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+
 			"volume": &schema.Schema{
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -83,6 +89,10 @@ func resourceAwsEcsTaskDefinitionCreate(d *schema.ResourceData, meta interface{}
 		Family:               aws.String(d.Get("family").(string)),
 	}
 
+	if v, ok := d.GetOk("task_role_arn"); ok {
+		input.TaskRoleArn = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("volume"); ok {
 		volumes, err := expandEcsVolumes(v.(*schema.Set).List())
 		if err != nil {
@@ -127,6 +137,7 @@ func resourceAwsEcsTaskDefinitionRead(d *schema.ResourceData, meta interface{})
 	d.Set("family", *taskDefinition.Family)
 	d.Set("revision", *taskDefinition.Revision)
 	d.Set("container_definitions", taskDefinition.ContainerDefinitions)
+	d.Set("task_role_arn", taskDefinition.TaskRoleArn)
 	d.Set("volumes", flattenEcsVolumes(taskDefinition.Volumes))
 
 	return nil
diff --git a/builtin/providers/aws/resource_aws_ecs_task_definition_test.go b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
index 9972bba7b..d075a429a 100644
--- a/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
+++ b/builtin/providers/aws/resource_aws_ecs_task_definition_test.go
@@ -74,6 +74,22 @@ func TestAccAWSEcsTaskDefinition_withEcsService(t *testing.T) {
 	})
 }
 
+func TestAccAWSEcsTaskDefinition_withTaskRoleArn(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsTaskDefinitionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsTaskDefinitionWithTaskRoleArn,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsTaskDefinitionExists("aws_ecs_task_definition.sleep"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSEcsTaskDefinitionDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ecsconn
 
@@ -182,6 +198,69 @@ TASK_DEFINITION
 }
 `
 
+var testAccAWSEcsTaskDefinitionWithTaskRoleArn = `
+resource "aws_iam_role" "role_test" {
+  name = "tf_old_name"
+  path = "/test/"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "role_test" {
+  name = "role_update_test"
+  role = "${aws_iam_role.role_test.id}"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListAllMyBuckets"
+      ],
+      "Resource": "arn:aws:s3:::*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_ecs_task_definition" "sleep" {
+  family = "terraform-acc-sc-volume-test"
+  task_role_arn = "${aws_iam_role.role_test.arn}"
+  container_definitions = <<TASK_DEFINITION
+[
+  {
+    "name": "sleep",
+    "image": "busybox",
+    "cpu": 10,
+    "command": ["sleep","360"],
+    "memory": 10,
+    "essential": true
+  }
+]
+TASK_DEFINITION
+
+  volume {
+    name = "database_scratch"
+  }
+}
+`
+
 var testAccAWSEcsTaskDefinitionWithEcsService = `
 resource "aws_ecs_cluster" "default" {
   name = "terraform-acc-test"