provider/aws: DataSource for RedShift Account ID (#8224)
When you need to enable monitoring for Redshift, you need to create the correct policy in the bucket for logging. This needs to have the Redshift Account ID for a given region. This data source provides a handy lookup for this http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging % make testacc TEST=./builtin/providers/aws % TESTARGS='-run=TestAccAWSRedshiftAccountId_basic' 2 ↵ ✹ ✭ ==> Checking that code complies with gofmt requirements... /Users/stacko/Code/go/bin/stringer go generate $(go list ./... | grep -v /terraform/vendor/) 2016/08/16 14:39:35 Generated command/internal_plugin_list.go TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSRedshiftAccountId_basic -timeout 120m === RUN TestAccAWSRedshiftAccountId_basic --- PASS: TestAccAWSRedshiftAccountId_basic (19.47s) PASS ok github.com/hashicorp/terraform/builtin/providers/aws 19.483s
This commit is contained in:
Paul Stack
GitHub
parent
24e7c3b0c2
commit
65aa02b6df
|
|
@ -0,0 +1,48 @@
|
|||
package aws
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/hashicorp/terraform/helper/schema"
|
||||
)
|
||||
|
||||
// See http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging
|
||||
var redshiftServiceAccountPerRegionMap = map[string]string{
|
||||
"us-east-1": "193672423079",
|
||||
"us-west-1": "262260360010",
|
||||
"us-west-2": "902366379725",
|
||||
"ap-south-1": "865932855811",
|
||||
"ap-northeast-2": "760740231472",
|
||||
"ap-southeast-1": "361669875840",
|
||||
"ap-southeast-2": "762762565011",
|
||||
"ap-northeast-1": "404641285394",
|
||||
"eu-central-1": "053454850223",
|
||||
"eu-west-1": "210876761215",
|
||||
}
|
||||
|
||||
func dataSourceAwsRedshiftServiceAccount() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Read: dataSourceAwsRedshiftServiceAccountRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
"region": &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceAwsRedshiftServiceAccountRead(d *schema.ResourceData, meta interface{}) error {
|
||||
region := meta.(*AWSClient).region
|
||||
if v, ok := d.GetOk("region"); ok {
|
||||
region = v.(string)
|
||||
}
|
||||
|
||||
if accid, ok := redshiftServiceAccountPerRegionMap[region]; ok {
|
||||
d.SetId(accid)
|
||||
return nil
|
||||
}
|
||||
|
||||
return fmt.Errorf("Unknown region (%q)", region)
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
package aws
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/terraform/helper/resource"
|
||||
)
|
||||
|
||||
func TestAccAWSRedshiftServiceAccount_basic(t *testing.T) {
|
||||
resource.Test(t, resource.TestCase{
|
||||
PreCheck: func() { testAccPreCheck(t) },
|
||||
Providers: testAccProviders,
|
||||
Steps: []resource.TestStep{
|
||||
resource.TestStep{
|
||||
Config: testAccCheckAwsRedshiftServiceAccountConfig,
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("data.aws_redshift_service_account.main", "id", "902366379725"),
|
||||
),
|
||||
},
|
||||
resource.TestStep{
|
||||
Config: testAccCheckAwsRedshiftServiceAccountExplicitRegionConfig,
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("data.aws_redshift_service_account.regional", "id", "210876761215"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
const testAccCheckAwsRedshiftServiceAccountConfig = `
|
||||
data "aws_redshift_service_account" "main" { }
|
||||
`
|
||||
|
||||
const testAccCheckAwsRedshiftServiceAccountExplicitRegionConfig = `
|
||||
data "aws_redshift_service_account" "regional" {
|
||||
region = "eu-west-1"
|
||||
}
|
||||
`
|
||||
|
|
@ -143,11 +143,12 @@ func Provider() terraform.ResourceProvider {
|
|||
"aws_ami": dataSourceAwsAmi(),
|
||||
"aws_availability_zones": dataSourceAwsAvailabilityZones(),
|
||||
"aws_caller_identity": dataSourceAwsCallerIdentity(),
|
||||
"aws_ecs_container_definition": dataSourceAwsEcsContainerDefinition(),
|
||||
"aws_elb_account_id": dataSourceAwsElbAccountId(),
|
||||
"aws_iam_policy_document": dataSourceAwsIamPolicyDocument(),
|
||||
"aws_ip_ranges": dataSourceAwsIPRanges(),
|
||||
"aws_redshift_service_account": dataSourceAwsRedshiftServiceAccount(),
|
||||
"aws_s3_bucket_object": dataSourceAwsS3BucketObject(),
|
||||
"aws_ecs_container_definition": dataSourceAwsEcsContainerDefinition(),
|
||||
},
|
||||
|
||||
ResourcesMap: map[string]*schema.Resource{
|
||||
|
|
|
|||
|
|
@ -0,0 +1,57 @@
|
|||
---
|
||||
layout: "aws"
|
||||
page_title: "AWS: aws_redshift_account_id"
|
||||
sidebar_current: "docs-aws-datasource-redshift-account-id"
|
||||
description: |-
|
||||
Get AWS Redshift Service Account ID for storing audit data in S3.
|
||||
---
|
||||
|
||||
# aws\_redshift\_service\_account
|
||||
|
||||
Use this data source to get the Service Account ID of the [AWS Redshift Account](http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging)
|
||||
in a given region for the purpose of allowing Redshift to store audit data in S3.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```
|
||||
data "aws_redshift_service_account" "main" { }
|
||||
|
||||
resource "aws_s3_bucket" "bucket" {
|
||||
bucket = "tf-redshift-logging-test-bucket"
|
||||
force_destroy = true
|
||||
policy = <<EOF
|
||||
{
|
||||
"Version": "2008-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "Put bucket policy needed for audit logging",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam:${data.aws_redshift_account_id.main.id}:user/logs"
|
||||
},
|
||||
"Action": "s3:PutObject",
|
||||
"Resource": "arn:aws:s3:::tf-redshift-logging-test-bucket/*"
|
||||
},
|
||||
{
|
||||
"Sid": "Get bucket policy needed for audit logging ",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam:${data.aws_redshift_account_id.main.id}:user/logs"
|
||||
},
|
||||
"Action": "s3:GetBucketAcl",
|
||||
"Resource": "arn:aws:s3:::tf-redshift-logging-test-bucket"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
```
|
||||
|
||||
## Argument Reference
|
||||
|
||||
* `region` - (Optional) Name of the Region whose Redshift account id is desired. If not specified, default's to the region from the AWS provider configuration.
|
||||
|
||||
|
||||
## Attributes Reference
|
||||
|
||||
* `id` - The ID of the Redshift service Account in the selected region.
|
||||
|
|
@ -35,6 +35,9 @@
|
|||
<li<%= sidebar_current("docs-aws-datasource-ip_ranges") %>>
|
||||
<a href="/docs/providers/aws/d/ip_ranges.html">aws_ip_ranges</a>
|
||||
</li>
|
||||
<li<%= sidebar_current("docs-aws-datasource-redshift-account-id") %>>
|
||||
<a href="/docs/providers/aws/d/redshift_service_account.html">aws_redshift_servcice_account</a>
|
||||
</li>
|
||||
<li<%= sidebar_current("docs-aws-datasource-s3-bucket-object") %>>
|
||||
<a href="/docs/providers/aws/d/s3_bucket_object.html">aws_s3_bucket_object</a>
|
||||
</li>
|
||||
|
|
|
|||
Loading…
Reference in New Issue