diff --git a/builtin/providers/aws/provider.go b/builtin/providers/aws/provider.go index f28cf69ea..2a5fff987 100644 --- a/builtin/providers/aws/provider.go +++ b/builtin/providers/aws/provider.go @@ -86,12 +86,13 @@ func Provider() terraform.ResourceProvider { "aws_app_cookie_stickiness_policy": resourceAwsAppCookieStickinessPolicy(), "aws_autoscaling_group": resourceAwsAutoscalingGroup(), "aws_autoscaling_notification": resourceAwsAutoscalingNotification(), + "aws_flow_log": resourceAwsFlowLog(), "aws_customer_gateway": resourceAwsCustomerGateway(), "aws_db_instance": resourceAwsDbInstance(), "aws_db_parameter_group": resourceAwsDbParameterGroup(), "aws_db_security_group": resourceAwsDbSecurityGroup(), "aws_db_subnet_group": resourceAwsDbSubnetGroup(), - "aws_dynamodb_table": resourceAwsDynamoDbTable(), + "aws_dynamodb_table": resourceAwsDynamoDbTable(), "aws_ebs_volume": resourceAwsEbsVolume(), "aws_ecs_cluster": resourceAwsEcsCluster(), "aws_ecs_service": resourceAwsEcsService(), diff --git a/builtin/providers/aws/resource_aws_flow_log.go b/builtin/providers/aws/resource_aws_flow_log.go new file mode 100644 index 000000000..f2bb09890 --- /dev/null +++ b/builtin/providers/aws/resource_aws_flow_log.go @@ -0,0 +1,173 @@ +package aws + +import ( + "fmt" + "log" + + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/service/ec2" + "github.com/hashicorp/terraform/helper/resource" + "github.com/hashicorp/terraform/helper/schema" +) + +func resourceAwsFlowLog() *schema.Resource { + return &schema.Resource{ + Create: resourceAwsLogFlowCreate, + Read: resourceAwsLogFlowRead, + Delete: resourceAwsLogFlowDelete, + + Schema: map[string]*schema.Schema{ + // "client_token": &schema.Schema{ + // Type: schema.TypeString, + // Optional: true, + // Computed: true, + // }, + + "iam_role_arn": &schema.Schema{ + Type: schema.TypeString, + Required: true, + ForceNew: true, + }, + + "log_group_name": &schema.Schema{ + Type: schema.TypeString, + Optional: true, + Computed: true, + }, + + "vpc_id": &schema.Schema{ + Type: schema.TypeString, + Optional: true, + ForceNew: true, + ConflictsWith: []string{"subnet_id", "eni_id"}, + }, + + "subnet_id": &schema.Schema{ + Type: schema.TypeString, + Optional: true, + ForceNew: true, + ConflictsWith: []string{"eni_id", "vpc_id"}, + }, + + "eni_id": &schema.Schema{ + Type: schema.TypeString, + Optional: true, + ForceNew: true, + ConflictsWith: []string{"subnet_id", "vpc_id"}, + }, + + "traffic_type": &schema.Schema{ + Type: schema.TypeString, + Required: true, + ForceNew: true, + }, + + "flow_log_status": &schema.Schema{ + Type: schema.TypeString, + Computed: true, + }, + + "deliver_log_status": &schema.Schema{ + Type: schema.TypeString, + Computed: true, + }, + }, + } +} + +func resourceAwsLogFlowCreate(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).ec2conn + + types := []struct { + ID string + Type string + }{ + {ID: d.Get("vpc_id").(string), Type: "VPC"}, + {ID: d.Get("subnet_id").(string), Type: "Subnet"}, + {ID: d.Get("eni_id").(string), Type: "NetworkInterface"}, + } + + var resourceId string + var resourceType string + for _, t := range types { + if t.ID != "" { + resourceId = t.ID + resourceType = t.Type + break + } + } + + if resourceId == "" || resourceType == "" { + return fmt.Errorf("Error: Flow Logs require either a VPC, Subnet, or ENI ID") + } + + opts := &ec2.CreateFlowLogsInput{ + DeliverLogsPermissionARN: aws.String(d.Get("iam_role_arn").(string)), + LogGroupName: aws.String(d.Get("log_group_name").(string)), + ResourceIDs: []*string{aws.String(resourceId)}, + ResourceType: aws.String(resourceType), + TrafficType: aws.String(d.Get("traffic_type").(string)), + } + resp, err := conn.CreateFlowLogs(opts) + if err != nil { + return fmt.Errorf("Error creating Flow Log for (%s), error: %s", resourceId, err) + } + + if len(resp.FlowLogIDs) > 1 { + return fmt.Errorf("Error: multiple Flow Logs created for (%s), error: %s", resourceId) + } + + d.SetId(*resp.FlowLogIDs[0]) + + return resourceAwsLogFlowRead(d, meta) +} + +func resourceAwsLogFlowRead(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).ec2conn + + opts := &ec2.DescribeFlowLogsInput{ + FlowLogIDs: []*string{aws.String(d.Id())}, + } + + resp, err := conn.DescribeFlowLogs(opts) + if err != nil { + log.Printf("[WARN] Error describing Flow Logs for id (%s)", d.Id()) + d.SetId("") + return nil + } + + if len(resp.FlowLogs) == 0 { + log.Printf("[WARN] No Flow Logs found for id (%s)", d.Id()) + d.SetId("") + return nil + } + + fl := resp.FlowLogs[0] + + d.Set("traffic_type", fl.TrafficType) + d.Set("log_group_name", fl.LogGroupName) + d.Set("iam_role_arn", fl.DeliverLogsPermissionARN) + d.Set("flow_log_status", fl.FlowLogStatus) + d.Set("deliver_log_status", fl.DeliverLogsStatus) + + return nil +} + +func resourceAwsLogFlowDelete(d *schema.ResourceData, meta interface{}) error { + conn := meta.(*AWSClient).ec2conn + _, err := conn.DeleteFlowLogs(&ec2.DeleteFlowLogsInput{ + FlowLogIDs: []*string{aws.String(d.Id())}, + }) + + if err != nil { + return fmt.Errorf("[WARN] Error deleting Flow Log with ID (%s), error: %s", d.Id(), err) + } + + return nil +} + +func flowLogStateRefreshFunc(conn *ec2.EC2, sn string) resource.StateRefreshFunc { + return func() (interface{}, string, error) { + return nil, "ok", nil + } +} diff --git a/builtin/providers/aws/resource_aws_flow_log_test.go b/builtin/providers/aws/resource_aws_flow_log_test.go new file mode 100644 index 000000000..697d24539 --- /dev/null +++ b/builtin/providers/aws/resource_aws_flow_log_test.go @@ -0,0 +1,209 @@ +package aws + +import ( + "fmt" + "testing" + + "github.com/aws/aws-sdk-go/service/ec2" + "github.com/hashicorp/aws-sdk-go/aws" + "github.com/hashicorp/terraform/helper/resource" + "github.com/hashicorp/terraform/terraform" +) + +func TestAccFlowLog_basic(t *testing.T) { + var flowLog ec2.FlowLog + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckFlowLogDestroy, + Steps: []resource.TestStep{ + resource.TestStep{ + Config: testAccFlowLogConfig_basic, + Check: resource.ComposeTestCheckFunc( + testAccCheckFlowLogExists("aws_flow_log.test_flow_log", &flowLog), + testAccCheckAWSFlowLogAttributes(&flowLog), + ), + }, + }, + }) +} + +func TestAccFlowLog_subnet(t *testing.T) { + var flowLog ec2.FlowLog + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckFlowLogDestroy, + Steps: []resource.TestStep{ + resource.TestStep{ + Config: testAccFlowLogConfig_subnet, + Check: resource.ComposeTestCheckFunc( + testAccCheckFlowLogExists("aws_flow_log.test_flow_log_subnet", &flowLog), + testAccCheckAWSFlowLogAttributes(&flowLog), + ), + }, + }, + }) +} + +func testAccCheckFlowLogExists(n string, flowLog *ec2.FlowLog) resource.TestCheckFunc { + return func(s *terraform.State) error { + rs, ok := s.RootModule().Resources[n] + if !ok { + return fmt.Errorf("Not found: %s", n) + } + + if rs.Primary.ID == "" { + return fmt.Errorf("No Flow Log ID is set") + } + + conn := testAccProvider.Meta().(*AWSClient).ec2conn + describeOpts := &ec2.DescribeFlowLogsInput{ + FlowLogIDs: []*string{aws.String(rs.Primary.ID)}, + } + resp, err := conn.DescribeFlowLogs(describeOpts) + if err != nil { + return err + } + + if len(resp.FlowLogs) > 0 { + *flowLog = *resp.FlowLogs[0] + return nil + } + return fmt.Errorf("No Flow Logs found for id (%s)", rs.Primary.ID) + } +} + +func testAccCheckAWSFlowLogAttributes(flowLog *ec2.FlowLog) resource.TestCheckFunc { + return func(s *terraform.State) error { + if flowLog.FlowLogStatus != nil && *flowLog.FlowLogStatus == "ACTIVE" { + return nil + } + if flowLog.FlowLogStatus == nil { + return fmt.Errorf("Flow Log status is not ACTIVE, is nil") + } else { + return fmt.Errorf("Flow Log status is not ACTIVE, got: %s", *flowLog.FlowLogStatus) + } + } +} + +func testAccCheckFlowLogDestroy(s *terraform.State) error { + for _, rs := range s.RootModule().Resources { + if rs.Type != "aws_flow_log" { + continue + } + + return nil + } + + return nil +} + +var testAccFlowLogConfig_basic = ` +resource "aws_vpc" "default" { + cidr_block = "10.0.0.0/16" + tags { + Name = "tf-flow-log-test" + } +} + +resource "aws_subnet" "test_subnet" { + vpc_id = "${aws_vpc.default.id}" + cidr_block = "10.0.1.0/24" + + tags { + Name = "tf-flow-test" + } +} + +resource "aws_iam_role" "test_role" { + name = "test_role" + assume_role_policy = <