ResiLien
/
terraform
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #11861 from hashicorp/b-fix-security-group-rule-regression 

provider/aws: Fix SecurityGroupRule regression
This commit is contained in:
Jake Champlin 2017-02-10 13:53:47 -05:00 committed by GitHub
parent 8271a739f2 4586b3727d
commit aa1c4cafa4
2 changed files with 223 additions and 208 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
builtin/providers/aws/resource_aws_security_group_rule.go
View File

@ -608,9 +608,10 @@ func validateAwsSecurityGroupRule(d *schema.ResourceData) error {
_, blocksOk := d.GetOk("cidr_blocks")
_, sourceOk := d.GetOk("source_security_group_id")
_, selfOk := d.GetOk("self")
if !blocksOk && !sourceOk && !selfOk {
_, prefixOk := d.GetOk("prefix_list_ids")
if !blocksOk && !sourceOk && !selfOk && !prefixOk {
return fmt.Errorf(
"One of ['cidr_blocks', 'self', 'source_security_group_id'] must be set to create an AWS Security Group Rule")
"One of ['cidr_blocks', 'self', 'source_security_group_id', 'prefix_list_ids'] must be set to create an AWS Security Group Rule")
}
return nil
}

76
builtin/providers/aws/resource_aws_security_group_rule_test.go
View File

@ -4,6 +4,7 @@ import (
"bytes"
"fmt"
"log"
"regexp"
"testing"
"github.com/aws/aws-sdk-go/aws"
@ -12,7 +13,6 @@ import (
"github.com/hashicorp/terraform/helper/acctest"
"github.com/hashicorp/terraform/helper/resource"
"github.com/hashicorp/terraform/terraform"
"regexp"
)
func TestIpPermissionIDHash(t *testing.T) {
@ -110,6 +110,7 @@ func TestIpPermissionIDHash(t *testing.T) {
func TestAccAWSSecurityGroupRule_Ingress_VPC(t *testing.T) {
var group ec2.SecurityGroup
rInt := acctest.RandInt()
testRuleCount := func(*terraform.State) error {
if len(group.IpPermissions) != 1 {
@ -132,7 +133,7 @@ func TestAccAWSSecurityGroupRule_Ingress_VPC(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRuleIngressConfig,
Config: testAccAWSSecurityGroupRuleIngressConfig(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
testAccCheckAWSSecurityGroupRuleAttributes("aws_security_group_rule.ingress_1", &group, nil, "ingress"),
@ -184,6 +185,7 @@ func TestAccAWSSecurityGroupRule_Ingress_Protocol(t *testing.T) {
func TestAccAWSSecurityGroupRule_Ingress_Classic(t *testing.T) {
var group ec2.SecurityGroup
rInt := acctest.RandInt()
testRuleCount := func(*terraform.State) error {
if len(group.IpPermissions) != 1 {
@ -206,7 +208,7 @@ func TestAccAWSSecurityGroupRule_Ingress_Classic(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRuleIngressClassicConfig,
Config: testAccAWSSecurityGroupRuleIngressClassicConfig(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
testAccCheckAWSSecurityGroupRuleAttributes("aws_security_group_rule.ingress_1", &group, nil, "ingress"),
@ -261,6 +263,7 @@ func TestAccAWSSecurityGroupRule_MultiIngress(t *testing.T) {
func TestAccAWSSecurityGroupRule_Egress(t *testing.T) {
var group ec2.SecurityGroup
rInt := acctest.RandInt()
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
@ -268,7 +271,7 @@ func TestAccAWSSecurityGroupRule_Egress(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRuleEgressConfig,
Config: testAccAWSSecurityGroupRuleEgressConfig(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
testAccCheckAWSSecurityGroupRuleAttributes("aws_security_group_rule.egress_1", &group, nil, "egress"),
@ -297,13 +300,14 @@ func TestAccAWSSecurityGroupRule_SelfReference(t *testing.T) {
}
func TestAccAWSSecurityGroupRule_ExpectInvalidTypeError(t *testing.T) {
rInt := acctest.RandInt()
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRuleExpectInvalidType,
Config: testAccAWSSecurityGroupRuleExpectInvalidType(rInt),
ExpectError: regexp.MustCompile(`\\"type\\" contains an invalid Security Group Rule type \\"foobar\\"`),
},
},
@ -313,6 +317,7 @@ func TestAccAWSSecurityGroupRule_ExpectInvalidTypeError(t *testing.T) {
// testing partial match implementation
func TestAccAWSSecurityGroupRule_PartialMatching_basic(t *testing.T) {
var group ec2.SecurityGroup
rInt := acctest.RandInt()
p := ec2.IpPermission{
FromPort: aws.Int64(80),
@ -340,7 +345,7 @@ func TestAccAWSSecurityGroupRule_PartialMatching_basic(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRulePartialMatching,
Config: testAccAWSSecurityGroupRulePartialMatching(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
testAccCheckAWSSecurityGroupRuleAttributes("aws_security_group_rule.ingress", &group, &p, "ingress"),
@ -356,6 +361,7 @@ func TestAccAWSSecurityGroupRule_PartialMatching_Source(t *testing.T) {
var group ec2.SecurityGroup
var nat ec2.SecurityGroup
var p ec2.IpPermission
rInt := acctest.RandInt()
// This function creates the expected IPPermission with the group id from an
// external security group, needed because Security Group IDs are generated on
@ -383,7 +389,7 @@ func TestAccAWSSecurityGroupRule_PartialMatching_Source(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRulePartialMatching_Source,
Config: testAccAWSSecurityGroupRulePartialMatching_Source(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.nat", &nat),
@ -433,6 +439,7 @@ func TestAccAWSSecurityGroupRule_Race(t *testing.T) {
func TestAccAWSSecurityGroupRule_SelfSource(t *testing.T) {
var group ec2.SecurityGroup
rInt := acctest.RandInt()
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
@ -440,7 +447,7 @@ func TestAccAWSSecurityGroupRule_SelfSource(t *testing.T) {
CheckDestroy: testAccCheckAWSSecurityGroupRuleDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSSecurityGroupRuleSelfInSource,
Config: testAccAWSSecurityGroupRuleSelfInSource(rInt),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSSecurityGroupRuleExists("aws_security_group.web", &group),
),
@ -667,9 +674,10 @@ func testAccCheckAWSSecurityGroupRuleAttributes(n string, group *ec2.SecurityGro
}
}
const testAccAWSSecurityGroupRuleIngressConfig = `
func testAccAWSSecurityGroupRuleIngressConfig(rInt int) string {
return fmt.Sprintf(`
resource "aws_security_group" "web" {
name = "terraform_acceptance_test_example"
name = "terraform_test_%d"
description = "Used in the terraform acceptance tests"
tags {
@ -685,8 +693,8 @@ resource "aws_security_group_rule" "ingress_1" {
cidr_blocks = ["10.0.0.0/8"]
security_group_id = "${aws_security_group.web.id}"
}`, rInt)
}
`
const testAccAWSSecurityGroupRuleIngress_protocolConfig = `
resource "aws_vpc" "tftest" {
@ -737,13 +745,14 @@ resource "aws_security_group_rule" "issue_5310" {
}
`
const testAccAWSSecurityGroupRuleIngressClassicConfig = `
func testAccAWSSecurityGroupRuleIngressClassicConfig(rInt int) string {
return fmt.Sprintf(`
provider "aws" {
region = "us-east-1"
}
resource "aws_security_group" "web" {
name = "terraform_acceptance_test_example"
name = "terraform_test_%d"
description = "Used in the terraform acceptance tests"
tags {
@ -759,12 +768,13 @@ resource "aws_security_group_rule" "ingress_1" {
cidr_blocks = ["10.0.0.0/8"]
security_group_id = "${aws_security_group.web.id}"
}`, rInt)
}
`
const testAccAWSSecurityGroupRuleEgressConfig = `
func testAccAWSSecurityGroupRuleEgressConfig(rInt int) string {
return fmt.Sprintf(`
resource "aws_security_group" "web" {
name = "terraform_acceptance_test_example"
name = "terraform_test_%d"
description = "Used in the terraform acceptance tests"
tags {
@ -780,8 +790,8 @@ resource "aws_security_group_rule" "egress_1" {
cidr_blocks = ["10.0.0.0/8"]
security_group_id = "${aws_security_group.web.id}"
}`, rInt)
}
`
const testAccAWSSecurityGroupRuleConfigMultiIngress = `
resource "aws_security_group" "web" {
@ -847,7 +857,8 @@ resource "aws_security_group_rule" "self" {
}
`
const testAccAWSSecurityGroupRulePartialMatching = `
func testAccAWSSecurityGroupRulePartialMatching(rInt int) string {
return fmt.Sprintf(`
resource "aws_vpc" "default" {
cidr_block = "10.0.0.0/16"
tags {
@ -856,7 +867,7 @@ resource "aws_vpc" "default" {
}
resource "aws_security_group" "web" {
name = "tf-other"
name = "tf-other-%d"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "tf-other-sg"
@ -864,7 +875,7 @@ resource "aws_security_group" "web" {
}
resource "aws_security_group" "nat" {
name = "tf-nat"
name = "tf-nat-%d"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "tf-nat-sg"
@ -900,10 +911,11 @@ resource "aws_security_group_rule" "nat_ingress" {
cidr_blocks = ["10.0.2.0/24", "10.0.3.0/24", "10.0.4.0/24"]
security_group_id = "${aws_security_group.nat.id}"
}`, rInt, rInt)
}
`
const testAccAWSSecurityGroupRulePartialMatching_Source = `
func testAccAWSSecurityGroupRulePartialMatching_Source(rInt int) string {
return fmt.Sprintf(`
resource "aws_vpc" "default" {
cidr_block = "10.0.0.0/16"
tags {
@ -912,7 +924,7 @@ resource "aws_vpc" "default" {
}
resource "aws_security_group" "web" {
name = "tf-other"
name = "tf-other-%d"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "tf-other-sg"
@ -920,7 +932,7 @@ resource "aws_security_group" "web" {
}
resource "aws_security_group" "nat" {
name = "tf-nat"
name = "tf-nat-%d"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "tf-nat-sg"
@ -945,8 +957,8 @@ resource "aws_security_group_rule" "other_ingress" {
cidr_blocks = ["10.0.2.0/24", "10.0.3.0/24", "10.0.4.0/24"]
security_group_id = "${aws_security_group.web.id}"
}`, rInt, rInt)
}
`
var testAccAWSSecurityGroupRuleRace = func() string {
var b bytes.Buffer
@ -1035,7 +1047,8 @@ resource "aws_security_group_rule" "egress_1" {
}
`
const testAccAWSSecurityGroupRuleSelfInSource = `
func testAccAWSSecurityGroupRuleSelfInSource(rInt int) string {
return fmt.Sprintf(`
resource "aws_vpc" "foo" {
cidr_block = "10.1.0.0/16"
@ -1045,7 +1058,7 @@ resource "aws_vpc" "foo" {
}
resource "aws_security_group" "web" {
name = "allow_all"
name = "allow_all-%d"
description = "Allow all inbound traffic"
vpc_id = "${aws_vpc.foo.id}"
}
@ -1057,10 +1070,11 @@ resource "aws_security_group_rule" "allow_self" {
protocol = "-1"
security_group_id = "${aws_security_group.web.id}"
source_security_group_id = "${aws_security_group.web.id}"
}`, rInt)
}
`
const testAccAWSSecurityGroupRuleExpectInvalidType = `
func testAccAWSSecurityGroupRuleExpectInvalidType(rInt int) string {
return fmt.Sprintf(`
resource "aws_vpc" "foo" {
cidr_block = "10.1.0.0/16"
@ -1070,7 +1084,7 @@ resource "aws_vpc" "foo" {
}
resource "aws_security_group" "web" {
name = "allow_all"
name = "allow_all-%d"
description = "Allow all inbound traffic"
vpc_id = "${aws_vpc.foo.id}"
}
@ -1082,5 +1096,5 @@ resource "aws_security_group_rule" "allow_self" {
protocol = "-1"
security_group_id = "${aws_security_group.web.id}"
source_security_group_id = "${aws_security_group.web.id}"
}`, rInt)
}
`