From 410fdad2cbd01936d3136c3353e51e8eb3aa5fb2 Mon Sep 17 00:00:00 2001 From: Masayuki Morita Date: Thu, 4 May 2017 22:28:06 +0900 Subject: [PATCH 1/2] provider/aws: Add support description to aws_iam_role Fixes #14198 --- .../providers/aws/resource_aws_iam_role.go | 27 +++++++++++++++++++ .../aws/resource_aws_iam_role_test.go | 5 ++++ .../providers/aws/r/iam_role.html.markdown | 2 ++ 3 files changed, 34 insertions(+) diff --git a/builtin/providers/aws/resource_aws_iam_role.go b/builtin/providers/aws/resource_aws_iam_role.go index 3833ea278..935f649f0 100644 --- a/builtin/providers/aws/resource_aws_iam_role.go +++ b/builtin/providers/aws/resource_aws_iam_role.go @@ -82,6 +82,11 @@ func resourceAwsIamRole() *schema.Resource { ForceNew: true, }, + "description": &schema.Schema{ + Type: schema.TypeString, + Optional: true, + }, + "assume_role_policy": { Type: schema.TypeString, Required: true, @@ -112,6 +117,7 @@ func resourceAwsIamRoleCreate(d *schema.ResourceData, meta interface{}) error { request := &iam.CreateRoleInput{ Path: aws.String(d.Get("path").(string)), RoleName: aws.String(name), + Description: aws.String(d.Get("description").(string)), AssumeRolePolicyDocument: aws.String(d.Get("assume_role_policy").(string)), } @@ -168,6 +174,20 @@ func resourceAwsIamRoleUpdate(d *schema.ResourceData, meta interface{}) error { } } + if d.HasChange("description") { + roleDescriptionInput := &iam.UpdateRoleDescriptionInput{ + RoleName: aws.String(d.Id()), + Description: aws.String(d.Get("description").(string)), + } + _, err := iamconn.UpdateRoleDescription(roleDescriptionInput) + if err != nil { + if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" { + d.SetId("") + return nil + } + return fmt.Errorf("Error Updating IAM Role (%s) Description: %s", d.Id(), err) + } + } return nil } @@ -189,6 +209,13 @@ func resourceAwsIamRoleReadResult(d *schema.ResourceData, role *iam.Role) error return err } + if role.Description != nil { + // the description isn't present in the response to CreateRole. + if err := d.Set("description", role.Description); err != nil { + return err + } + } + assumRolePolicy, err := url.QueryUnescape(*role.AssumeRolePolicyDocument) if err != nil { return err diff --git a/builtin/providers/aws/resource_aws_iam_role_test.go b/builtin/providers/aws/resource_aws_iam_role_test.go index 22ffa8ec3..b6a3eb293 100644 --- a/builtin/providers/aws/resource_aws_iam_role_test.go +++ b/builtin/providers/aws/resource_aws_iam_role_test.go @@ -178,6 +178,10 @@ func testAccCheckAWSRoleAttributes(role *iam.GetRoleOutput) resource.TestCheckFu if *role.Role.Path != "/" { return fmt.Errorf("Bad path: %s", *role.Role.Path) } + + if *role.Role.Description != "Test Role" { + return fmt.Errorf("Bad description: %s", *role.Role.Description) + } return nil } } @@ -186,6 +190,7 @@ const testAccAWSRoleConfig = ` resource "aws_iam_role" "role" { name = "test-role" path = "/" + description = "Test Role" assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"ec2.amazonaws.com\"]},\"Action\":[\"sts:AssumeRole\"]}]}" } ` diff --git a/website/source/docs/providers/aws/r/iam_role.html.markdown b/website/source/docs/providers/aws/r/iam_role.html.markdown index ecba4be52..ad8b983d3 100644 --- a/website/source/docs/providers/aws/r/iam_role.html.markdown +++ b/website/source/docs/providers/aws/r/iam_role.html.markdown @@ -46,6 +46,7 @@ The following arguments are supported: * `path` - (Optional) The path to the role. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information. +* `description` - (Optional) The description of the role. ## Attributes Reference @@ -55,6 +56,7 @@ The following attributes are exported: * `create_date` - The creation date of the IAM role. * `unique_id` - The stable and unique string identifying the role. * `name` - The name of the role. +* `description` - The description of the role. ## Example of Using Data Source for Assume Role Policy From fff5fed0f0cf949f0cfd591fa01ed6d5135bc51c Mon Sep 17 00:00:00 2001 From: stack72 Date: Thu, 4 May 2017 18:46:36 +0300 Subject: [PATCH 2/2] provider/aws: Change aws_iam_role description to not pass empty string --- builtin/providers/aws/resource_aws_iam_role.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/builtin/providers/aws/resource_aws_iam_role.go b/builtin/providers/aws/resource_aws_iam_role.go index 935f649f0..f79b5a360 100644 --- a/builtin/providers/aws/resource_aws_iam_role.go +++ b/builtin/providers/aws/resource_aws_iam_role.go @@ -82,7 +82,7 @@ func resourceAwsIamRole() *schema.Resource { ForceNew: true, }, - "description": &schema.Schema{ + "description": { Type: schema.TypeString, Optional: true, }, @@ -117,10 +117,13 @@ func resourceAwsIamRoleCreate(d *schema.ResourceData, meta interface{}) error { request := &iam.CreateRoleInput{ Path: aws.String(d.Get("path").(string)), RoleName: aws.String(name), - Description: aws.String(d.Get("description").(string)), AssumeRolePolicyDocument: aws.String(d.Get("assume_role_policy").(string)), } + if v, ok := d.GetOk("description"); ok { + request.Description = aws.String(v.(string)) + } + var createResp *iam.CreateRoleOutput err := resource.Retry(30*time.Second, func() *resource.RetryError { var err error