diff --git a/builtin/providers/aws/provider.go b/builtin/providers/aws/provider.go index b02119ed2..cdb6b0d06 100644 --- a/builtin/providers/aws/provider.go +++ b/builtin/providers/aws/provider.go @@ -352,6 +352,7 @@ func Provider() terraform.ResourceProvider { "aws_spot_fleet_request": resourceAwsSpotFleetRequest(), "aws_sqs_queue": resourceAwsSqsQueue(), "aws_sqs_queue_policy": resourceAwsSqsQueuePolicy(), + "aws_snapshot_create_volume_permission": resourceAwsSnapshotCreateVolumePermission(), "aws_sns_topic": resourceAwsSnsTopic(), "aws_sns_topic_policy": resourceAwsSnsTopicPolicy(), "aws_sns_topic_subscription": resourceAwsSnsTopicSubscription(), diff --git a/builtin/providers/aws/resource_aws_snapshot_create_volume_permission.go b/builtin/providers/aws/resource_aws_snapshot_create_volume_permission.go new file mode 100644 index 000000000..6a7fd40a1 --- /dev/null +++ b/builtin/providers/aws/resource_aws_snapshot_create_volume_permission.go @@ -0,0 +1,152 @@ +package aws + +import ( + "fmt" + "time" + + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/service/ec2" + "github.com/hashicorp/terraform/helper/resource" + "github.com/hashicorp/terraform/helper/schema" +) + +func resourceAwsSnapshotCreateVolumePermission() *schema.Resource { + return &schema.Resource{ + Exists: resourceAwsSnapshotCreateVolumePermissionExists, + Create: resourceAwsSnapshotCreateVolumePermissionCreate, + Read: resourceAwsSnapshotCreateVolumePermissionRead, + Delete: resourceAwsSnapshotCreateVolumePermissionDelete, + + Schema: map[string]*schema.Schema{ + "snapshot_id": &schema.Schema{ + Type: schema.TypeString, + Required: true, + ForceNew: true, + }, + "account_id": &schema.Schema{ + Type: schema.TypeString, + Required: true, + ForceNew: true, + }, + }, + } +} + +func resourceAwsSnapshotCreateVolumePermissionExists(d *schema.ResourceData, meta interface{}) (bool, error) { + conn := meta.(*AWSClient).ec2conn + + snapshot_id := d.Get("snapshot_id").(string) + account_id := d.Get("account_id").(string) + return hasCreateVolumePermission(conn, snapshot_id, account_id) +} + +func resourceAwsSnapshotCreateVolumePermissionCreate(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).ec2conn + + snapshot_id := d.Get("snapshot_id").(string) + account_id := d.Get("account_id").(string) + + _, err := conn.ModifySnapshotAttribute(&ec2.ModifySnapshotAttributeInput{ + SnapshotId: aws.String(snapshot_id), + Attribute: aws.String("createVolumePermission"), + CreateVolumePermission: &ec2.CreateVolumePermissionModifications{ + Add: []*ec2.CreateVolumePermission{ + &ec2.CreateVolumePermission{UserId: aws.String(account_id)}, + }, + }, + }) + if err != nil { + return fmt.Errorf("Error adding snapshot createVolumePermission: %s", err) + } + + d.SetId(fmt.Sprintf("%s-%s", snapshot_id, account_id)) + + // Wait for the account to appear in the permission list + stateConf := &resource.StateChangeConf{ + Pending: []string{"denied"}, + Target: []string{"granted"}, + Refresh: resourceAwsSnapshotCreateVolumePermissionStateRefreshFunc(conn, snapshot_id, account_id), + Timeout: 5 * time.Minute, + Delay: 10 * time.Second, + MinTimeout: 10 * time.Second, + } + if _, err := stateConf.WaitForState(); err != nil { + return fmt.Errorf( + "Error waiting for snapshot createVolumePermission (%s) to be added: %s", + d.Id(), err) + } + + return nil +} + +func resourceAwsSnapshotCreateVolumePermissionRead(d *schema.ResourceData, meta interface{}) error { + return nil +} + +func resourceAwsSnapshotCreateVolumePermissionDelete(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).ec2conn + + snapshot_id := d.Get("snapshot_id").(string) + account_id := d.Get("account_id").(string) + + _, err := conn.ModifySnapshotAttribute(&ec2.ModifySnapshotAttributeInput{ + SnapshotId: aws.String(snapshot_id), + Attribute: aws.String("createVolumePermission"), + CreateVolumePermission: &ec2.CreateVolumePermissionModifications{ + Remove: []*ec2.CreateVolumePermission{ + &ec2.CreateVolumePermission{UserId: aws.String(account_id)}, + }, + }, + }) + if err != nil { + return fmt.Errorf("Error removing snapshot createVolumePermission: %s", err) + } + + // Wait for the account to disappear from the permission list + stateConf := &resource.StateChangeConf{ + Pending: []string{"granted"}, + Target: []string{"denied"}, + Refresh: resourceAwsSnapshotCreateVolumePermissionStateRefreshFunc(conn, snapshot_id, account_id), + Timeout: 5 * time.Minute, + Delay: 10 * time.Second, + MinTimeout: 10 * time.Second, + } + if _, err := stateConf.WaitForState(); err != nil { + return fmt.Errorf( + "Error waiting for snapshot createVolumePermission (%s) to be removed: %s", + d.Id(), err) + } + + return nil +} + +func hasCreateVolumePermission(conn *ec2.EC2, snapshot_id string, account_id string) (bool, error) { + _, state, err := resourceAwsSnapshotCreateVolumePermissionStateRefreshFunc(conn, snapshot_id, account_id)() + if err != nil { + return false, err + } + if state == "granted" { + return true, nil + } else { + return false, nil + } +} + +func resourceAwsSnapshotCreateVolumePermissionStateRefreshFunc(conn *ec2.EC2, snapshot_id string, account_id string) resource.StateRefreshFunc { + return func() (interface{}, string, error) { + attrs, err := conn.DescribeSnapshotAttribute(&ec2.DescribeSnapshotAttributeInput{ + SnapshotId: aws.String(snapshot_id), + Attribute: aws.String("createVolumePermission"), + }) + if err != nil { + return nil, "", fmt.Errorf("Error refreshing snapshot createVolumePermission state: %s", err) + } + + for _, vp := range attrs.CreateVolumePermissions { + if *vp.UserId == account_id { + return attrs, "granted", nil + } + } + return attrs, "denied", nil + } +} diff --git a/builtin/providers/aws/resource_aws_snapshot_create_volume_permission_test.go b/builtin/providers/aws/resource_aws_snapshot_create_volume_permission_test.go new file mode 100644 index 000000000..53691350c --- /dev/null +++ b/builtin/providers/aws/resource_aws_snapshot_create_volume_permission_test.go @@ -0,0 +1,89 @@ +package aws + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform/helper/resource" + "github.com/hashicorp/terraform/terraform" +) + +func TestAccAWSSnapshotCreateVolumePermission_Basic(t *testing.T) { + var snapshotId, accountId string + + resource.Test(t, resource.TestCase{ + Providers: testAccProviders, + Steps: []resource.TestStep{ + // Scaffold everything + resource.TestStep{ + Config: testAccAWSSnapshotCreateVolumePermissionConfig(true), + Check: resource.ComposeTestCheckFunc( + testCheckResourceGetAttr("aws_ebs_snapshot.example_snapshot", "id", &snapshotId), + testCheckResourceGetAttr("data.aws_caller_identity.current", "account_id", &accountId), + testAccAWSSnapshotCreateVolumePermissionExists(&accountId, &snapshotId), + ), + }, + // Drop just create volume permission to test destruction + resource.TestStep{ + Config: testAccAWSSnapshotCreateVolumePermissionConfig(false), + Check: resource.ComposeTestCheckFunc( + testAccAWSSnapshotCreateVolumePermissionDestroyed(&accountId, &snapshotId), + ), + }, + }, + }) +} + +func testAccAWSSnapshotCreateVolumePermissionExists(accountId, snapshotId *string) resource.TestCheckFunc { + return func(s *terraform.State) error { + conn := testAccProvider.Meta().(*AWSClient).ec2conn + if has, err := hasCreateVolumePermission(conn, *snapshotId, *accountId); err != nil { + return err + } else if !has { + return fmt.Errorf("create volume permission does not exist for '%s' on '%s'", *accountId, *snapshotId) + } + return nil + } +} + +func testAccAWSSnapshotCreateVolumePermissionDestroyed(accountId, snapshotId *string) resource.TestCheckFunc { + return func(s *terraform.State) error { + conn := testAccProvider.Meta().(*AWSClient).ec2conn + if has, err := hasCreateVolumePermission(conn, *snapshotId, *accountId); err != nil { + return err + } else if has { + return fmt.Errorf("create volume permission still exists for '%s' on '%s'", *accountId, *snapshotId) + } + return nil + } +} + +func testAccAWSSnapshotCreateVolumePermissionConfig(includeCreateVolumePermission bool) string { + base := ` +data "aws_caller_identity" "current" {} + +resource "aws_ebs_volume" "example" { + availability_zone = "us-west-2a" + size = 40 + + tags { + Name = "ebs_snap_perm" + } +} + +resource "aws_ebs_snapshot" "example_snapshot" { + volume_id = "${aws_ebs_volume.example.id}" +} +` + + if !includeCreateVolumePermission { + return base + } + + return base + fmt.Sprintf(` +resource "aws_snapshot_create_volume_permission" "self-test" { + snapshot_id = "${aws_ebs_snapshot.example_snapshot.id}" + account_id = "${data.aws_caller_identity.current.account_id}" +} +`) +} diff --git a/website/source/docs/providers/aws/r/snapshot_create_volume_permission.html.markdown b/website/source/docs/providers/aws/r/snapshot_create_volume_permission.html.markdown new file mode 100644 index 000000000..6d571725a --- /dev/null +++ b/website/source/docs/providers/aws/r/snapshot_create_volume_permission.html.markdown @@ -0,0 +1,42 @@ +--- +layout: "aws" +page_title: "AWS: aws_snapshot_create_volume_permission" +sidebar_current: "docs-aws-resource-snapshot-create-volume-permission" +description: |- + Adds create volume permission to an EBS Snapshot +--- + +# aws\_snapshot\_create\_volume\_permission + +Adds permission to create volumes off of a given EBS Snapshot. + +## Example Usage + +``` +resource "aws_snapshot_create_volume_permission" "example_perm" { + snapshot_id = "${aws_ebs_snapshot.example_snapshot.id}" + account_id = "12345678" +} + +resource "aws_ebs_volume" "example" { + availability_zone = "us-west-2a" + size = 40 +} + +resource "aws_ebs_snapshot" "example_snapshot" { + volume_id = "${aws_ebs_volume.example.id}" +} +``` + +## Argument Reference + +The following arguments are supported: + + * `snapshot_id` - (required) A snapshot ID + * `account_id` - (required) An AWS Account ID to add create volume permissions + +## Attributes Reference + +The following attributes are exported: + + * `id` - A combination of "`snapshot_id`-`account_id`". diff --git a/website/source/layouts/aws.erb b/website/source/layouts/aws.erb index 304e079d3..6fe0724b3 100644 --- a/website/source/layouts/aws.erb +++ b/website/source/layouts/aws.erb @@ -266,7 +266,7 @@ - > + > EC2 Resources