ResiLien
/
terraform
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1180 from hashicorp/aws-go-network-acl 

provider/aws: Convert AWS Network ACL to aws-sdk-go
This commit is contained in:
Clint 2015-03-11 17:06:37 -05:00
parent 558775d115 670d53b1a1
commit bd6d2caf36
5 changed files with 221 additions and 169 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
builtin/providers/aws/network_acl_entry.go
View File

@ -2,11 +2,14 @@ package aws
import ( import (
"fmt" "fmt"
"github.com/mitchellh/goamz/ec2" "strconv"
"github.com/hashicorp/aws-sdk-go/aws"
"github.com/hashicorp/aws-sdk-go/gen/ec2"
) )
func expandNetworkAclEntries(configured []interface{}, entryType string) ([]ec2.NetworkAclEntry, error) { func expandNetworkAclEntries(configured []interface{}, entryType string) ([]ec2.NetworkACLEntry, error) {
entries := make([]ec2.NetworkAclEntry, 0, len(configured)) entries := make([]ec2.NetworkACLEntry, 0, len(configured))
for _, eRaw := range configured { for _, eRaw := range configured {
data := eRaw.(map[string]interface{}) data := eRaw.(map[string]interface{})
protocol := data["protocol"].(string) protocol := data["protocol"].(string)
@ -15,16 +18,16 @@ func expandNetworkAclEntries(configured []interface{}, entryType string) ([]ec2.
return nil, fmt.Errorf("Invalid Protocol %s for rule %#v", protocol, data) return nil, fmt.Errorf("Invalid Protocol %s for rule %#v", protocol, data)
} }
p := extractProtocolInteger(data["protocol"].(string)) p := extractProtocolInteger(data["protocol"].(string))
e := ec2.NetworkAclEntry{ e := ec2.NetworkACLEntry{
Protocol: p, Protocol: aws.String(strconv.Itoa(p)),
PortRange: ec2.PortRange{ PortRange: &ec2.PortRange{
From: data["from_port"].(int), From: aws.Integer(data["from_port"].(int)),
To: data["to_port"].(int), To: aws.Integer(data["to_port"].(int)),
}, },
Egress: (entryType == "egress"), Egress: aws.Boolean((entryType == "egress")),
RuleAction: data["action"].(string), RuleAction: aws.String(data["action"].(string)),
RuleNumber: data["rule_no"].(int), RuleNumber: aws.Integer(data["rule_no"].(int)),
CidrBlock: data["cidr_block"].(string), CIDRBlock: aws.String(data["cidr_block"].(string)),
} }
entries = append(entries, e) entries = append(entries, e)
} }
@ -33,17 +36,17 @@ func expandNetworkAclEntries(configured []interface{}, entryType string) ([]ec2.
} }
func flattenNetworkAclEntries(list []ec2.NetworkAclEntry) []map[string]interface{} { func flattenNetworkAclEntries(list []ec2.NetworkACLEntry) []map[string]interface{} {
entries := make([]map[string]interface{}, 0, len(list)) entries := make([]map[string]interface{}, 0, len(list))
for _, entry := range list { for _, entry := range list {
entries = append(entries, map[string]interface{}{ entries = append(entries, map[string]interface{}{
"from_port": entry.PortRange.From, "from_port": *entry.PortRange.From,
"to_port": entry.PortRange.To, "to_port": *entry.PortRange.To,
"action": entry.RuleAction, "action": *entry.RuleAction,
"rule_no": entry.RuleNumber, "rule_no": *entry.RuleNumber,
"protocol": extractProtocolString(entry.Protocol), "protocol": *entry.Protocol,
"cidr_block": entry.CidrBlock, "cidr_block": *entry.CIDRBlock,
}) })
} }
return entries return entries

81
builtin/providers/aws/network_acl_entry_test.go
View File

@ -4,10 +4,11 @@ import (
"reflect" "reflect"
"testing" "testing"
"github.com/mitchellh/goamz/ec2" "github.com/hashicorp/aws-sdk-go/aws"
"github.com/hashicorp/aws-sdk-go/gen/ec2"
) )
func Test_expandNetworkAclEntry(t *testing.T) { func Test_expandNetworkACLEntry(t *testing.T) {
input := []interface{}{ input := []interface{}{
map[string]interface{}{ map[string]interface{}{
"protocol": "tcp", "protocol": "tcp",
@ -28,30 +29,28 @@ func Test_expandNetworkAclEntry(t *testing.T) {
} }
expanded, _ := expandNetworkAclEntries(input, "egress") expanded, _ := expandNetworkAclEntries(input, "egress")
expected := []ec2.NetworkAclEntry{ expected := []ec2.NetworkACLEntry{
ec2.NetworkAclEntry{ ec2.NetworkACLEntry{
Protocol: 6, Protocol: aws.String("6"),
PortRange: ec2.PortRange{ PortRange: &ec2.PortRange{
From: 22, From: aws.Integer(22),
To: 22, To: aws.Integer(22),
}, },
RuleAction: "deny", RuleAction: aws.String("deny"),
RuleNumber: 1, RuleNumber: aws.Integer(1),
CidrBlock: "0.0.0.0/0", CIDRBlock: aws.String("0.0.0.0/0"),
Egress: true, Egress: aws.Boolean(true),
IcmpCode: ec2.IcmpCode{Code: 0, Type: 0},
}, },
ec2.NetworkAclEntry{ ec2.NetworkACLEntry{
Protocol: 6, Protocol: aws.String("6"),
PortRange: ec2.PortRange{ PortRange: &ec2.PortRange{
From: 443, From: aws.Integer(443),
To: 443, To: aws.Integer(443),
}, },
RuleAction: "deny", RuleAction: aws.String("deny"),
RuleNumber: 2, RuleNumber: aws.Integer(2),
CidrBlock: "0.0.0.0/0", CIDRBlock: aws.String("0.0.0.0/0"),
Egress: true, Egress: aws.Boolean(true),
IcmpCode: ec2.IcmpCode{Code: 0, Type: 0},
}, },
} }
@ -64,28 +63,28 @@ func Test_expandNetworkAclEntry(t *testing.T) {
} }
func Test_flattenNetworkAclEntry(t *testing.T) { func Test_flattenNetworkACLEntry(t *testing.T) {
apiInput := []ec2.NetworkAclEntry{ apiInput := []ec2.NetworkACLEntry{
ec2.NetworkAclEntry{ ec2.NetworkACLEntry{
Protocol: 6, Protocol: aws.String("tcp"),
PortRange: ec2.PortRange{ PortRange: &ec2.PortRange{
From: 22, From: aws.Integer(22),
To: 22, To: aws.Integer(22),
}, },
RuleAction: "deny", RuleAction: aws.String("deny"),
RuleNumber: 1, RuleNumber: aws.Integer(1),
CidrBlock: "0.0.0.0/0", CIDRBlock: aws.String("0.0.0.0/0"),
}, },
ec2.NetworkAclEntry{ ec2.NetworkACLEntry{
Protocol: 6, Protocol: aws.String("tcp"),
PortRange: ec2.PortRange{ PortRange: &ec2.PortRange{
From: 443, From: aws.Integer(443),
To: 443, To: aws.Integer(443),
}, },
RuleAction: "deny", RuleAction: aws.String("deny"),
RuleNumber: 2, RuleNumber: aws.Integer(2),
CidrBlock: "0.0.0.0/0", CIDRBlock: aws.String("0.0.0.0/0"),
}, },
} }
flattened := flattenNetworkAclEntries(apiInput) flattened := flattenNetworkAclEntries(apiInput)

117
builtin/providers/aws/resource_aws_network_acl.go
View File

@ -6,10 +6,11 @@ import (
"log" "log"
"time" "time"
"github.com/hashicorp/aws-sdk-go/aws"
"github.com/hashicorp/aws-sdk-go/gen/ec2"
"github.com/hashicorp/terraform/helper/hashcode" "github.com/hashicorp/terraform/helper/hashcode"
"github.com/hashicorp/terraform/helper/resource" "github.com/hashicorp/terraform/helper/resource"
"github.com/hashicorp/terraform/helper/schema" "github.com/hashicorp/terraform/helper/schema"
"github.com/mitchellh/goamz/ec2"
) )
func resourceAwsNetworkAcl() *schema.Resource { func resourceAwsNetworkAcl() *schema.Resource {
@ -108,32 +109,34 @@ func resourceAwsNetworkAcl() *schema.Resource {
func resourceAwsNetworkAclCreate(d *schema.ResourceData, meta interface{}) error { func resourceAwsNetworkAclCreate(d *schema.ResourceData, meta interface{}) error {
ec2conn := meta.(*AWSClient).ec2conn ec2conn := meta.(*AWSClient).awsEC2conn
// Create the Network Acl // Create the Network Acl
createOpts := &ec2.CreateNetworkAcl{ createOpts := &ec2.CreateNetworkACLRequest{
VpcId: d.Get("vpc_id").(string), VPCID: aws.String(d.Get("vpc_id").(string)),
} }
log.Printf("[DEBUG] Network Acl create config: %#v", createOpts) log.Printf("[DEBUG] Network Acl create config: %#v", createOpts)
resp, err := ec2conn.CreateNetworkAcl(createOpts) resp, err := ec2conn.CreateNetworkACL(createOpts)
if err != nil { if err != nil {
return fmt.Errorf("Error creating network acl: %s", err) return fmt.Errorf("Error creating network acl: %s", err)
} }
// Get the ID and store it // Get the ID and store it
networkAcl := &resp.NetworkAcl networkAcl := resp.NetworkACL
d.SetId(networkAcl.NetworkAclId) d.SetId(*networkAcl.NetworkACLID)
log.Printf("[INFO] Network Acl ID: %s", networkAcl.NetworkAclId) log.Printf("[INFO] Network Acl ID: %s", *networkAcl.NetworkACLID)
// Update rules and subnet association once acl is created // Update rules and subnet association once acl is created
return resourceAwsNetworkAclUpdate(d, meta) return resourceAwsNetworkAclUpdate(d, meta)
} }
func resourceAwsNetworkAclRead(d *schema.ResourceData, meta interface{}) error { func resourceAwsNetworkAclRead(d *schema.ResourceData, meta interface{}) error {
ec2conn := meta.(*AWSClient).ec2conn ec2conn := meta.(*AWSClient).awsEC2conn
resp, err := ec2conn.NetworkAcls([]string{d.Id()}, ec2.NewFilter()) resp, err := ec2conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
NetworkACLIDs: []string{d.Id()},
})
if err != nil { if err != nil {
return err return err
@ -142,29 +145,29 @@ func resourceAwsNetworkAclRead(d *schema.ResourceData, meta interface{}) error {
return nil return nil
} }
networkAcl := &resp.NetworkAcls[0] networkAcl := &resp.NetworkACLs[0]
var ingressEntries []ec2.NetworkAclEntry var ingressEntries []ec2.NetworkACLEntry
var egressEntries []ec2.NetworkAclEntry var egressEntries []ec2.NetworkACLEntry
// separate the ingress and egress rules // separate the ingress and egress rules
for _, e := range networkAcl.EntrySet { for _, e := range networkAcl.Entries {
if e.Egress == true { if *e.Egress == true {
egressEntries = append(egressEntries, e) egressEntries = append(egressEntries, e)
} else { } else {
ingressEntries = append(ingressEntries, e) ingressEntries = append(ingressEntries, e)
} }
} }
d.Set("vpc_id", networkAcl.VpcId) d.Set("vpc_id", networkAcl.VPCID)
d.Set("ingress", ingressEntries) d.Set("ingress", ingressEntries)
d.Set("egress", egressEntries) d.Set("egress", egressEntries)
d.Set("tags", tagsToMap(networkAcl.Tags)) d.Set("tags", tagsToMapSDK(networkAcl.Tags))
return nil return nil
} }
func resourceAwsNetworkAclUpdate(d *schema.ResourceData, meta interface{}) error { func resourceAwsNetworkAclUpdate(d *schema.ResourceData, meta interface{}) error {
ec2conn := meta.(*AWSClient).ec2conn ec2conn := meta.(*AWSClient).awsEC2conn
d.Partial(true) d.Partial(true)
if d.HasChange("ingress") { if d.HasChange("ingress") {
@ -190,13 +193,16 @@ func resourceAwsNetworkAclUpdate(d *schema.ResourceData, meta interface{}) error
if err != nil { if err != nil {
return fmt.Errorf("Failed to update acl %s with subnet %s: %s", d.Id(), newSubnet, err) return fmt.Errorf("Failed to update acl %s with subnet %s: %s", d.Id(), newSubnet, err)
} }
_, err = ec2conn.ReplaceNetworkAclAssociation(association.NetworkAclAssociationId, d.Id()) _, err = ec2conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationRequest{
AssociationID: association.NetworkACLAssociationID,
NetworkACLID: aws.String(d.Id()),
})
if err != nil { if err != nil {
return err return err
} }
} }
if err := setTags(ec2conn, d); err != nil { if err := setTagsSDK(ec2conn, d); err != nil {
return err return err
} else { } else {
d.SetPartial("tags") d.SetPartial("tags")
@ -226,7 +232,11 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, ec2conn *
} }
for _, remove := range toBeDeleted { for _, remove := range toBeDeleted {
// Delete old Acl // Delete old Acl
_, err := ec2conn.DeleteNetworkAclEntry(d.Id(), remove.RuleNumber, remove.Egress) err := ec2conn.DeleteNetworkACLEntry(&ec2.DeleteNetworkACLEntryRequest{
NetworkACLID: aws.String(d.Id()),
RuleNumber: remove.RuleNumber,
Egress: remove.Egress,
})
if err != nil { if err != nil {
return fmt.Errorf("Error deleting %s entry: %s", entryType, err) return fmt.Errorf("Error deleting %s entry: %s", entryType, err)
} }
@ -238,7 +248,15 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, ec2conn *
} }
for _, add := range toBeCreated { for _, add := range toBeCreated {
// Add new Acl entry // Add new Acl entry
_, err := ec2conn.CreateNetworkAclEntry(d.Id(), &add) err := ec2conn.CreateNetworkACLEntry(&ec2.CreateNetworkACLEntryRequest{
NetworkACLID: aws.String(d.Id()),
CIDRBlock: add.CIDRBlock,
Egress: add.Egress,
PortRange: add.PortRange,
Protocol: add.Protocol,
RuleAction: add.RuleAction,
RuleNumber: add.RuleNumber,
})
if err != nil { if err != nil {
return fmt.Errorf("Error creating %s entry: %s", entryType, err) return fmt.Errorf("Error creating %s entry: %s", entryType, err)
} }
@ -247,12 +265,15 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, ec2conn *
} }
func resourceAwsNetworkAclDelete(d *schema.ResourceData, meta interface{}) error { func resourceAwsNetworkAclDelete(d *schema.ResourceData, meta interface{}) error {
ec2conn := meta.(*AWSClient).ec2conn ec2conn := meta.(*AWSClient).awsEC2conn
log.Printf("[INFO] Deleting Network Acl: %s", d.Id()) log.Printf("[INFO] Deleting Network Acl: %s", d.Id())
return resource.Retry(5*time.Minute, func() error { return resource.Retry(5*time.Minute, func() error {
if _, err := ec2conn.DeleteNetworkAcl(d.Id()); err != nil { err := ec2conn.DeleteNetworkACL(&ec2.DeleteNetworkACLRequest{
ec2err := err.(*ec2.Error) NetworkACLID: aws.String(d.Id()),
})
if err != nil {
ec2err := err.(aws.APIError)
switch ec2err.Code { switch ec2err.Code {
case "InvalidNetworkAclID.NotFound": case "InvalidNetworkAclID.NotFound":
return nil return nil
@ -267,7 +288,10 @@ func resourceAwsNetworkAclDelete(d *schema.ResourceData, meta interface{}) error
if err != nil { if err != nil {
return fmt.Errorf("Dependency violation: Cannot delete acl %s: %s", d.Id(), err) return fmt.Errorf("Dependency violation: Cannot delete acl %s: %s", d.Id(), err)
} }
_, err = ec2conn.ReplaceNetworkAclAssociation(association.NetworkAclAssociationId, defaultAcl.NetworkAclId) _, err = ec2conn.ReplaceNetworkACLAssociation(&ec2.ReplaceNetworkACLAssociationRequest{
AssociationID: association.NetworkACLAssociationID,
NetworkACLID: defaultAcl.NetworkACLID,
})
return resource.RetryError{Err: err} return resource.RetryError{Err: err}
default: default:
// Any other error, we want to quit the retry loop immediately // Any other error, we want to quit the retry loop immediately
@ -296,30 +320,43 @@ func resourceAwsNetworkAclEntryHash(v interface{}) int {
return hashcode.String(buf.String()) return hashcode.String(buf.String())
} }
func getDefaultNetworkAcl(vpc_id string, ec2conn *ec2.EC2) (defaultAcl *ec2.NetworkAcl, err error) { func getDefaultNetworkAcl(vpc_id string, ec2conn *ec2.EC2) (defaultAcl *ec2.NetworkACL, err error) {
filter := ec2.NewFilter() resp, err := ec2conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
filter.Add("default", "true") NetworkACLIDs: []string{},
filter.Add("vpc-id", vpc_id) Filters: []ec2.Filter{
ec2.Filter{
resp, err := ec2conn.NetworkAcls([]string{}, filter) Name: aws.String("default"),
Values: []string{"true"},
},
ec2.Filter{
Name: aws.String("vpc-id"),
Values: []string{vpc_id},
},
},
})
if err != nil { if err != nil {
return nil, err return nil, err
} }
return &resp.NetworkAcls[0], nil return &resp.NetworkACLs[0], nil
} }
func findNetworkAclAssociation(subnetId string, ec2conn *ec2.EC2) (networkAclAssociation *ec2.NetworkAclAssociation, err error) { func findNetworkAclAssociation(subnetId string, ec2conn *ec2.EC2) (networkAclAssociation *ec2.NetworkACLAssociation, err error) {
filter := ec2.NewFilter() resp, err := ec2conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
filter.Add("association.subnet-id", subnetId) NetworkACLIDs: []string{},
Filters: []ec2.Filter{
resp, err := ec2conn.NetworkAcls([]string{}, filter) ec2.Filter{
Name: aws.String("association.subnet-id"),
Values: []string{subnetId},
},
},
})
if err != nil { if err != nil {
return nil, err return nil, err
} }
for _, association := range resp.NetworkAcls[0].AssociationSet { for _, association := range resp.NetworkACLs[0].Associations {
if association.SubnetId == subnetId { if *association.SubnetID == subnetId {
return &association, nil return &association, nil
} }
} }

148
builtin/providers/aws/resource_aws_network_acl_test.go
View File

@ -4,15 +4,16 @@ import (
"fmt" "fmt"
"testing" "testing"
"github.com/hashicorp/aws-sdk-go/aws"
"github.com/hashicorp/aws-sdk-go/gen/ec2"
"github.com/hashicorp/terraform/terraform" "github.com/hashicorp/terraform/terraform"
"github.com/mitchellh/goamz/ec2"
// "github.com/hashicorp/terraform/helper/hashcode" // "github.com/hashicorp/terraform/helper/hashcode"
"github.com/hashicorp/terraform/helper/resource" "github.com/hashicorp/terraform/helper/resource"
// "github.com/hashicorp/terraform/helper/schema" // "github.com/hashicorp/terraform/helper/schema"
) )
func TestAccAWSNetworkAclsWithEgressAndIngressRules(t *testing.T) { func TestAccAWSNetworkAclsWithEgressAndIngressRules(t *testing.T) {
var networkAcl ec2.NetworkAcl var networkAcl ec2.NetworkACL
resource.Test(t, resource.TestCase{ resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) }, PreCheck: func() { testAccPreCheck(t) },
@ -24,29 +25,29 @@ func TestAccAWSNetworkAclsWithEgressAndIngressRules(t *testing.T) {
Check: resource.ComposeTestCheckFunc( Check: resource.ComposeTestCheckFunc(
testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl), testAccCheckAWSNetworkAclExists("aws_network_acl.bar", &networkAcl),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.protocol", "tcp"), "aws_network_acl.bar", "ingress.3409203205.protocol", "tcp"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.rule_no", "1"), "aws_network_acl.bar", "ingress.3409203205.rule_no", "1"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.from_port", "80"), "aws_network_acl.bar", "ingress.3409203205.from_port", "80"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.to_port", "80"), "aws_network_acl.bar", "ingress.3409203205.to_port", "80"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.action", "allow"), "aws_network_acl.bar", "ingress.3409203205.action", "allow"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "ingress.580214135.cidr_block", "10.3.10.3/18"), "aws_network_acl.bar", "ingress.3409203205.cidr_block", "10.3.10.3/18"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.protocol", "tcp"), "aws_network_acl.bar", "egress.2579689292.protocol", "tcp"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.rule_no", "2"), "aws_network_acl.bar", "egress.2579689292.rule_no", "2"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.from_port", "443"), "aws_network_acl.bar", "egress.2579689292.from_port", "443"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.to_port", "443"), "aws_network_acl.bar", "egress.2579689292.to_port", "443"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.cidr_block", "10.3.2.3/18"), "aws_network_acl.bar", "egress.2579689292.cidr_block", "10.3.2.3/18"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.bar", "egress.1730430240.action", "allow"), "aws_network_acl.bar", "egress.2579689292.action", "allow"),
), ),
}, },
}, },
@ -54,7 +55,7 @@ func TestAccAWSNetworkAclsWithEgressAndIngressRules(t *testing.T) {
} }
func TestAccAWSNetworkAclsOnlyIngressRules(t *testing.T) { func TestAccAWSNetworkAclsOnlyIngressRules(t *testing.T) {
var networkAcl ec2.NetworkAcl var networkAcl ec2.NetworkACL
resource.Test(t, resource.TestCase{ resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) }, PreCheck: func() { testAccPreCheck(t) },
@ -67,17 +68,17 @@ func TestAccAWSNetworkAclsOnlyIngressRules(t *testing.T) {
testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl), testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
// testAccCheckSubnetAssociation("aws_network_acl.foos", "aws_subnet.blob"), // testAccCheckSubnetAssociation("aws_network_acl.foos", "aws_subnet.blob"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.protocol", "tcp"), "aws_network_acl.foos", "ingress.2750166237.protocol", "tcp"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.rule_no", "1"), "aws_network_acl.foos", "ingress.2750166237.rule_no", "1"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.from_port", "0"), "aws_network_acl.foos", "ingress.2750166237.from_port", "0"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.to_port", "22"), "aws_network_acl.foos", "ingress.2750166237.to_port", "22"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.action", "deny"), "aws_network_acl.foos", "ingress.2750166237.action", "deny"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.cidr_block", "10.2.2.3/18"), "aws_network_acl.foos", "ingress.2750166237.cidr_block", "10.2.2.3/18"),
), ),
}, },
}, },
@ -85,7 +86,7 @@ func TestAccAWSNetworkAclsOnlyIngressRules(t *testing.T) {
} }
func TestAccAWSNetworkAclsOnlyIngressRulesChange(t *testing.T) { func TestAccAWSNetworkAclsOnlyIngressRulesChange(t *testing.T) {
var networkAcl ec2.NetworkAcl var networkAcl ec2.NetworkACL
resource.Test(t, resource.TestCase{ resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) }, PreCheck: func() { testAccPreCheck(t) },
@ -98,21 +99,21 @@ func TestAccAWSNetworkAclsOnlyIngressRulesChange(t *testing.T) {
testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl), testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
testIngressRuleLength(&networkAcl, 2), testIngressRuleLength(&networkAcl, 2),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.protocol", "tcp"), "aws_network_acl.foos", "ingress.37211640.protocol", "tcp"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.rule_no", "1"), "aws_network_acl.foos", "ingress.37211640.rule_no", "1"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.from_port", "0"), "aws_network_acl.foos", "ingress.37211640.from_port", "0"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.to_port", "22"), "aws_network_acl.foos", "ingress.37211640.to_port", "22"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.action", "deny"), "aws_network_acl.foos", "ingress.37211640.action", "deny"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.cidr_block", "10.2.2.3/18"), "aws_network_acl.foos", "ingress.37211640.cidr_block", "10.2.2.3/18"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.2438803013.from_port", "443"), "aws_network_acl.foos", "ingress.2750166237.from_port", "443"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.2438803013.rule_no", "2"), "aws_network_acl.foos", "ingress.2750166237.rule_no", "2"),
), ),
}, },
resource.TestStep{ resource.TestStep{
@ -121,17 +122,17 @@ func TestAccAWSNetworkAclsOnlyIngressRulesChange(t *testing.T) {
testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl), testAccCheckAWSNetworkAclExists("aws_network_acl.foos", &networkAcl),
testIngressRuleLength(&networkAcl, 1), testIngressRuleLength(&networkAcl, 1),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.protocol", "tcp"), "aws_network_acl.foos", "ingress.37211640.protocol", "tcp"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.rule_no", "1"), "aws_network_acl.foos", "ingress.37211640.rule_no", "1"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.from_port", "0"), "aws_network_acl.foos", "ingress.37211640.from_port", "0"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.to_port", "22"), "aws_network_acl.foos", "ingress.37211640.to_port", "22"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.action", "deny"), "aws_network_acl.foos", "ingress.37211640.action", "deny"),
resource.TestCheckResourceAttr( resource.TestCheckResourceAttr(
"aws_network_acl.foos", "ingress.3697634361.cidr_block", "10.2.2.3/18"), "aws_network_acl.foos", "ingress.37211640.cidr_block", "10.2.2.3/18"),
), ),
}, },
}, },
@ -139,7 +140,7 @@ func TestAccAWSNetworkAclsOnlyIngressRulesChange(t *testing.T) {
} }
func TestAccAWSNetworkAclsOnlyEgressRules(t *testing.T) { func TestAccAWSNetworkAclsOnlyEgressRules(t *testing.T) {
var networkAcl ec2.NetworkAcl var networkAcl ec2.NetworkACL
resource.Test(t, resource.TestCase{ resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) }, PreCheck: func() { testAccPreCheck(t) },
@ -150,14 +151,14 @@ func TestAccAWSNetworkAclsOnlyEgressRules(t *testing.T) {
Config: testAccAWSNetworkAclEgressConfig, Config: testAccAWSNetworkAclEgressConfig,
Check: resource.ComposeTestCheckFunc( Check: resource.ComposeTestCheckFunc(
testAccCheckAWSNetworkAclExists("aws_network_acl.bond", &networkAcl), testAccCheckAWSNetworkAclExists("aws_network_acl.bond", &networkAcl),
testAccCheckTags(&networkAcl.Tags, "foo", "bar"), testAccCheckTagsSDK(&networkAcl.Tags, "foo", "bar"),
), ),
}, },
}, },
}) })
} }
func TestAccNetworkAcl_SubnetChange(t *testing.T) { func TestAccAWSNetworkAcl_SubnetChange(t *testing.T) {
resource.Test(t, resource.TestCase{ resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) }, PreCheck: func() { testAccPreCheck(t) },
@ -183,7 +184,7 @@ func TestAccNetworkAcl_SubnetChange(t *testing.T) {
} }
func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error { func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error {
conn := testAccProvider.Meta().(*AWSClient).ec2conn conn := testAccProvider.Meta().(*AWSClient).awsEC2conn
for _, rs := range s.RootModule().Resources { for _, rs := range s.RootModule().Resources {
if rs.Type != "aws_network" { if rs.Type != "aws_network" {
@ -191,16 +192,18 @@ func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error {
} }
// Retrieve the network acl // Retrieve the network acl
resp, err := conn.NetworkAcls([]string{rs.Primary.ID}, ec2.NewFilter()) resp, err := conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
NetworkACLIDs: []string{rs.Primary.ID},
})
if err == nil { if err == nil {
if len(resp.NetworkAcls) > 0 && resp.NetworkAcls[0].NetworkAclId == rs.Primary.ID { if len(resp.NetworkACLs) > 0 && *resp.NetworkACLs[0].NetworkACLID == rs.Primary.ID {
return fmt.Errorf("Network Acl (%s) still exists.", rs.Primary.ID) return fmt.Errorf("Network Acl (%s) still exists.", rs.Primary.ID)
} }
return nil return nil
} }
ec2err, ok := err.(*ec2.Error) ec2err, ok := err.(aws.APIError)
if !ok { if !ok {
return err return err
} }
@ -213,7 +216,7 @@ func testAccCheckAWSNetworkAclDestroy(s *terraform.State) error {
return nil return nil
} }
func testAccCheckAWSNetworkAclExists(n string, networkAcl *ec2.NetworkAcl) resource.TestCheckFunc { func testAccCheckAWSNetworkAclExists(n string, networkAcl *ec2.NetworkACL) resource.TestCheckFunc {
return func(s *terraform.State) error { return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[n] rs, ok := s.RootModule().Resources[n]
if !ok { if !ok {
@ -223,15 +226,17 @@ func testAccCheckAWSNetworkAclExists(n string, networkAcl *ec2.NetworkAcl) resou
if rs.Primary.ID == "" { if rs.Primary.ID == "" {
return fmt.Errorf("No Security Group is set") return fmt.Errorf("No Security Group is set")
} }
conn := testAccProvider.Meta().(*AWSClient).ec2conn conn := testAccProvider.Meta().(*AWSClient).awsEC2conn
resp, err := conn.NetworkAcls([]string{rs.Primary.ID}, nil) resp, err := conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
NetworkACLIDs: []string{rs.Primary.ID},
})
if err != nil { if err != nil {
return err return err
} }
if len(resp.NetworkAcls) > 0 && resp.NetworkAcls[0].NetworkAclId == rs.Primary.ID { if len(resp.NetworkACLs) > 0 && *resp.NetworkACLs[0].NetworkACLID == rs.Primary.ID {
*networkAcl = resp.NetworkAcls[0] *networkAcl = resp.NetworkACLs[0]
return nil return nil
} }
@ -239,11 +244,11 @@ func testAccCheckAWSNetworkAclExists(n string, networkAcl *ec2.NetworkAcl) resou
} }
} }
func testIngressRuleLength(networkAcl *ec2.NetworkAcl, length int) resource.TestCheckFunc { func testIngressRuleLength(networkAcl *ec2.NetworkACL, length int) resource.TestCheckFunc {
return func(s *terraform.State) error { return func(s *terraform.State) error {
var ingressEntries []ec2.NetworkAclEntry var ingressEntries []ec2.NetworkACLEntry
for _, e := range networkAcl.EntrySet { for _, e := range networkAcl.Entries {
if e.Egress == false { if *e.Egress == false {
ingressEntries = append(ingressEntries, e) ingressEntries = append(ingressEntries, e)
} }
} }
@ -261,21 +266,26 @@ func testAccCheckSubnetIsAssociatedWithAcl(acl string, sub string) resource.Test
networkAcl := s.RootModule().Resources[acl] networkAcl := s.RootModule().Resources[acl]
subnet := s.RootModule().Resources[sub] subnet := s.RootModule().Resources[sub]
conn := testAccProvider.Meta().(*AWSClient).ec2conn conn := testAccProvider.Meta().(*AWSClient).awsEC2conn
filter := ec2.NewFilter() resp, err := conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
filter.Add("association.subnet-id", subnet.Primary.ID) NetworkACLIDs: []string{networkAcl.Primary.ID},
resp, err := conn.NetworkAcls([]string{networkAcl.Primary.ID}, filter) Filters: []ec2.Filter{
ec2.Filter{
Name: aws.String("association.subnet-id"),
Values: []string{subnet.Primary.ID},
},
},
})
if err != nil { if err != nil {
return err return err
} }
if len(resp.NetworkAcls) > 0 { if len(resp.NetworkACLs) > 0 {
return nil return nil
} }
r, _ := conn.NetworkAcls([]string{}, ec2.NewFilter()) // r, _ := conn.NetworkACLs([]string{}, ec2.NewFilter())
fmt.Printf("\n\nall acls\n %#v\n\n", r.NetworkAcls) // fmt.Printf("\n\nall acls\n %#v\n\n", r.NetworkAcls)
conn.NetworkAcls([]string{}, filter) // conn.NetworkAcls([]string{}, filter)
return fmt.Errorf("Network Acl %s is not associated with subnet %s", acl, sub) return fmt.Errorf("Network Acl %s is not associated with subnet %s", acl, sub)
} }
@ -286,15 +296,21 @@ func testAccCheckSubnetIsNotAssociatedWithAcl(acl string, subnet string) resourc
networkAcl := s.RootModule().Resources[acl] networkAcl := s.RootModule().Resources[acl]
subnet := s.RootModule().Resources[subnet] subnet := s.RootModule().Resources[subnet]
conn := testAccProvider.Meta().(*AWSClient).ec2conn conn := testAccProvider.Meta().(*AWSClient).awsEC2conn
filter := ec2.NewFilter() resp, err := conn.DescribeNetworkACLs(&ec2.DescribeNetworkACLsRequest{
filter.Add("association.subnet-id", subnet.Primary.ID) NetworkACLIDs: []string{networkAcl.Primary.ID},
resp, err := conn.NetworkAcls([]string{networkAcl.Primary.ID}, filter) Filters: []ec2.Filter{
ec2.Filter{
Name: aws.String("association.subnet-id"),
Values: []string{subnet.Primary.ID},
},
},
})
if err != nil { if err != nil {
return err return err
} }
if len(resp.NetworkAcls) > 0 { if len(resp.NetworkACLs) > 0 {
return fmt.Errorf("Network Acl %s is still associated with subnet %s", acl, subnet) return fmt.Errorf("Network Acl %s is still associated with subnet %s", acl, subnet)
} }
return nil return nil

3
builtin/providers/aws/structure_test.go
View File

@ -1,7 +1,6 @@
package aws package aws
import ( import (
"log"
"reflect" "reflect"
"testing" "testing"
@ -62,8 +61,6 @@ func TestExpandIPPerms(t *testing.T) {
} }
perms := expandIPPerms("foo", expanded) perms := expandIPPerms("foo", expanded)
log.Printf("wtf is perms:\n%#v", perms)
expected := []awsEC2.IPPermission{ expected := []awsEC2.IPPermission{
awsEC2.IPPermission{ awsEC2.IPPermission{
IPProtocol: aws.String("icmp"), IPProtocol: aws.String("icmp"),