Add test for flattenSecurityGroups

builtin/providers/aws/structure.go

@@ -321,7 +321,7 @@ func flattenHealthCheck(check *elb.HealthCheck) []map[string]interface{} {
 	return result
 }
 
-// Flattens an array of UserSecurityGroups into a []string
+// Flattens an array of UserSecurityGroups into a []*ec2.GroupIdentifier
 func flattenSecurityGroups(list []*ec2.UserIdGroupPair, ownerId *string) []*ec2.GroupIdentifier {
 	result := make([]*ec2.GroupIdentifier, 0, len(list))
 	for _, g := range list {

builtin/providers/aws/structure_test.go

@@ -769,3 +769,85 @@ func TestFlattenAsgEnabledMetrics(t *testing.T) {
 		t.Fatalf("expected id to be GroupMaxSize, but was %s", result[1])
 	}
 }
+
+func TestFlattenSecurityGroups(t *testing.T) {
+	cases := []struct {
+		ownerId  *string
+		pairs    []*ec2.UserIdGroupPair
+		expected []*ec2.GroupIdentifier
+	}{
+		// simple, no user id included (we ignore it mostly)
+		{
+			ownerId: aws.String("user1234"),
+			pairs: []*ec2.UserIdGroupPair{
+				&ec2.UserIdGroupPair{
+					GroupId: aws.String("sg-12345"),
+				},
+			},
+			expected: []*ec2.GroupIdentifier{
+				&ec2.GroupIdentifier{
+					GroupId: aws.String("sg-12345"),
+				},
+			},
+		},
+		// include the owner id, but keep it consitent with the same account. Tests
+		// EC2 classic situation
+		{
+			ownerId: aws.String("user1234"),
+			pairs: []*ec2.UserIdGroupPair{
+				&ec2.UserIdGroupPair{
+					GroupId: aws.String("sg-12345"),
+					UserId:  aws.String("user1234"),
+				},
+			},
+			expected: []*ec2.GroupIdentifier{
+				&ec2.GroupIdentifier{
+					GroupId: aws.String("sg-12345"),
+				},
+			},
+		},
+
+		// include the owner id, but from a different account. This is reflects
+		// EC2 Classic when refering to groups by name
+		{
+			ownerId: aws.String("user1234"),
+			pairs: []*ec2.UserIdGroupPair{
+				&ec2.UserIdGroupPair{
+					GroupId:   aws.String("sg-12345"),
+					GroupName: aws.String("somegroup"), // GroupName is only included in Classic
+					UserId:    aws.String("user4321"),
+				},
+			},
+			expected: []*ec2.GroupIdentifier{
+				&ec2.GroupIdentifier{
+					GroupId:   aws.String("sg-12345"),
+					GroupName: aws.String("user4321/somegroup"),
+				},
+			},
+		},
+
+		// include the owner id, but from a different account. This reflects in
+		// EC2 VPC when refering to groups by id
+		{
+			ownerId: aws.String("user1234"),
+			pairs: []*ec2.UserIdGroupPair{
+				&ec2.UserIdGroupPair{
+					GroupId: aws.String("sg-12345"),
+					UserId:  aws.String("user4321"),
+				},
+			},
+			expected: []*ec2.GroupIdentifier{
+				&ec2.GroupIdentifier{
+					GroupId: aws.String("user4321/sg-12345"),
+				},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		out := flattenSecurityGroups(c.pairs, c.ownerId)
+		if !reflect.DeepEqual(out, c.expected) {
+			t.Fatalf("Error matching output and expected: %#v vs %#v", out, c.expected)
+		}
+	}
+}