Commit Graph

4126 Commits

Author SHA1 Message Date
Nick Johnstone ab7cbb1cf9 Fix typo in validators.go (#14900)
s/conatains/contains
2017-05-29 06:07:44 +01:00
Jeff Theriault 07f89e2728 Export RDS instance and cluster resource id (#14882) 2017-05-28 06:47:55 +01:00
Paul Stack be58c809b6 provider/aws: Add support for X-Ray tracing to aws_lambda_function (#14728)
Fixes: #13801
2017-05-24 11:37:04 +01:00
Paul Stack 88d9254661 provider/aws: Add ability to define timeouts for DMS replication instance (#14729)
Fixes: #13996
2017-05-23 19:31:26 +01:00
Paul Stack cb5b5c034e provider/aws: Provider ability to enable snapshotting on ElastiCache RG (#14757)
Fixes: #10581

When a cluster was originally created, you could not enable snapshotting
on it. An error message like this was found:

```
* aws_elasticache_replication_group.bar: Error updating Elasticache replication group: InvalidParameterCombination: Must specify both SnapshotRetentionLimit and SnapshottingClusterId to turn on snapshots
    status code: 400, request id: 98d2ea4e-3fb1-11e7-b077-5967719aeab4
```

There is no guidance from AWS on which is the preferred Cluster in the RG to use for snapshotting. Therefore, I decided to set it to be the first cluster. We can now enable snapshotting

```
% make testacc TEST=./builtin/providers/aws/ TESTARGS='-run=TestAccAWSElasticacheReplicationGroup_enableSnapshotting'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/23 15:02:21 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws/ -v -run=TestAccAWSElasticacheReplicationGroup_enableSnapshotting -timeout 120m
=== RUN   TestAccAWSElasticacheReplicationGroup_enableSnapshotting
--- PASS: TestAccAWSElasticacheReplicationGroup_enableSnapshotting (1261.47s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	1261.496s
```
2017-05-23 19:30:34 +01:00
Techbrunch 170533c026 Fixes #14765 Handle migration when restoring db cluster from snapshot (#14766)
Add `migrating` to the list of pending statuses when creating a cluster from a snapshot using a different engine.
2017-05-23 18:48:15 +01:00
Jake Champlin 722436a880 Merge pull request #14727 from hashicorp/b-fix-instance-panic
provider/aws: Fix panic on instance shutdown
2017-05-22 09:53:04 -04:00
Kit Ewbank 8e130b15e4 Add 'aws_kms_ciphertext' data source. (#14691) 2017-05-22 16:46:18 +03:00
Radek Simko b90ad412d5 provider/aws: Increase timeout for creating security group (#14724) 2017-05-22 15:12:39 +02:00
Jake Champlin c1f4a6e9f8
provider/aws: Fix panic on instance shutdown
During an instance shut-down network interfaces may be detached during the `READ` method of a Terraform run.

This protects the case where a network interface was detached, and is now `nil` at the time of the Terraform run, fixing nil pointer dereferences.
2017-05-22 09:02:35 -04:00
Jake Champlin d85b8f0613 Merge pull request #14669 from hashicorp/b-add-validation-iam-role-policy
provider/aws: validation: Add validation function for IAM Policies
2017-05-22 08:26:24 -04:00
Paul Stack 542640c953 provider/aws: Do not dereference source_Dest_check in aws_instance (#14723)
Fixes: #14718

source_dest_check may not be set so we should pass the pointer to d.Set
func and allow it to dereference it safely
2017-05-22 10:44:30 +03:00
Radek Simko 600e587430 provider/aws: Configurable timeouts for EC2 instance + spot instance (#14711) 2017-05-22 09:27:06 +02:00
Radek Simko a6617c598a provider/aws: Increase timeout for retrying creation of CW log subs (#14722) 2017-05-22 09:26:24 +02:00
Radek Simko 9cb33d863d provider/aws: Increase timeout for deleting IGW (#14705) 2017-05-22 09:25:26 +02:00
Radek Simko 4a671fc92e provider/aws: Retry IAM Role deletion on DeleteConflict (#14707)
* provider/aws: Retry IAM Role deletion on DeleteConflict

* provider/aws: Add 'IAM' to relevant test names
2017-05-22 00:35:09 +03:00
Radek Simko 3a41e45180 provider/aws: Retry ECS service update on InvalidParameterException (#14708) 2017-05-21 22:19:41 +03:00
Radek Simko 60bae99a94 provider/aws: Retry ElastiCache cluster deletion when it's snapshotting (#14700) 2017-05-21 00:42:33 +03:00
Radek Simko 66ed50866d provider/aws: Increase timeout for creation of route_table (#14701) 2017-05-21 00:40:33 +03:00
Radek Simko c0a2aa3b49 provider/aws: Allow updating tuples in WAF XssMatchSet + no tuples (#14671)
* provider/aws: Allow updating tuples in WAF XssMatchSet

* provider/aws: Allow WAF XssMatchSet with no tuples
2017-05-20 02:55:58 +02:00
Jake Champlin 85895cecc7
provider/aws: rename usEast1Sess to r53Sess and document 2017-05-19 17:03:34 -04:00
Jake Champlin 0abfda4d8b
provider/aws: Allow lightsail resources to work in other regions
Previously lightsail was limited to `us-east-1` only. This restriction has now been lifted to new regions.

```
$ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSLightsailInstance_euRegion'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/19 16:40:48 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSLightsailInstance_euRegion -timeout 120m
=== RUN   TestAccAWSLightsailInstance_euRegion
--- PASS: TestAccAWSLightsailInstance_euRegion (45.31s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    45.319s
```

Fixes: #14668
2017-05-19 16:44:07 -04:00
Jake Champlin dffa575591
add docstring on ignored error 2017-05-19 14:36:39 -04:00
Kit Ewbank ca898d8d19 Add ability to 'terraform import' aws_kms_alias resources. 2017-05-19 14:35:54 -04:00
Radek Simko 79903cd7ea provider/aws: Allow updating tuples in WAF SQLInjectionMatchSet + no tuples (#14667)
* provider/aws: Allow updating tuples in WAF SQL Injection Match Set

* provider/aws: Allow WAF SQL Injection match set with no tuples
2017-05-19 17:59:15 +02:00
Jake Champlin 96e83817ef
provider/aws: validation: Add validation function for IAM Policies
The previous JSON validator that we were using for IAM policy documents wouldn't catch AWS IAM Policy errors.
The supplied policy document would pass our validator, then fail with the following API error:

```
 * aws_iam_role_policy.foo: Error putting IAM role policy tf_test_policy_ymw7hbil9w: MalformedPolicyDocument: The policy failed legacy parsing
                        status code: 400, request id: e7615d90-3c99-11e7-babc-c14e741605bf
```

This happens if the Policy Document doesn't start with the opening JSON bracket, and often happens in the following case:

```
policy = <<EOF
  {
      "Version": "2012-10-17",
      "Statement": [
          {
            ...
          }
      ]
  }
  EOF
```

Where, when using a HEREDOC, the policy document is indented incorrectly.

The new validation function for the IAM policies verifies that the first character of the supplied policy document is the leading JSON bracket, prior to validating the JSON string.

Test Output:

```
$ make test TEST=./builtin/providers/aws/ TESTARGS="-v -run=TestValidateIAMPolicyJsonString"
==> Checking that code complies with gofmt requirements...
==> Checking AWS provider for unchecked errors...
==> NOTE: at this time we only look for uncheck errors in the AWS package
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/19 10:56:32 Generated command/internal_plugin_list.go
go test -i ./builtin/providers/aws/ || exit 1
echo ./builtin/providers/aws/ | \
        xargs -t -n4 go test -v -run=TestValidateIAMPolicyJsonString -timeout=60s -parallel=4
go test -v -run=TestValidateIAMPolicyJsonString -timeout=60s -parallel=4 ./builtin/providers/aws/
=== RUN   TestValidateIAMPolicyJsonString
--- PASS: TestValidateIAMPolicyJsonString (0.00s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    0.009s
```

```
$ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAWSPolicy_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/19 10:38:43 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAWSPolicy_ -timeout 120m
=== RUN   TestAWSPolicy_namePrefix
--- PASS: TestAWSPolicy_namePrefix (20.01s)
=== RUN   TestAWSPolicy_invalidJson
--- PASS: TestAWSPolicy_invalidJson (0.00s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    20.027s
```

```
$ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSIAMRolePolicy_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/19 11:02:56 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSIAMRolePolicy_ -timeout 120m
=== RUN   TestAccAWSIAMRolePolicy_importBasic
--- PASS: TestAccAWSIAMRolePolicy_importBasic (18.45s)
=== RUN   TestAccAWSIAMRolePolicy_basic
--- PASS: TestAccAWSIAMRolePolicy_basic (35.92s)
=== RUN   TestAccAWSIAMRolePolicy_namePrefix
--- PASS: TestAccAWSIAMRolePolicy_namePrefix (14.78s)
=== RUN   TestAccAWSIAMRolePolicy_generatedName
--- PASS: TestAccAWSIAMRolePolicy_generatedName (20.20s)
=== RUN   TestAccAWSIAMRolePolicy_invalidJSON
--- PASS: TestAccAWSIAMRolePolicy_invalidJSON (0.00s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    89.363s
```
2017-05-19 11:11:44 -04:00
Paul Stack 65283fb47c provider/aws: Change AWS ssm_maintenance_window Read func (#14665)
Fixes: #14653

I was originally calling the wrong API method and only some of the
values were being persisted to state. By changing the API method, we can
now get all of the values and therefore can detech manual drift

```
% make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSSSMMaintenanceWindow_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/19 16:56:27 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSSSMMaintenanceWindow_ -timeout 120m
=== RUN   TestAccAWSSSMMaintenanceWindow_basic
--- PASS: TestAccAWSSSMMaintenanceWindow_basic (41.39s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	41.419s
```
2017-05-19 17:23:40 +03:00
Radek Simko a567cf00ce Merge pull request #14661 from hashicorp/b-aws-waf-size-constraint
provider/aws: Allow updating constraints in WAF SizeConstraintSet + no constraints
2017-05-19 16:00:36 +02:00
Radek Simko cacaf91ff2 provider/aws: Increase timeout for retrying deletion IAM server cert (#14655) 2017-05-19 16:37:07 +03:00
Radek Simko bf99b53d17
provider/aws: Allow WAF SizeConstraint with no tuples 2017-05-19 09:20:33 +02:00
Radek Simko 3fb671be1f
provider/aws: Allow updating constraints in WAF SizeConstraintSet 2017-05-19 09:20:26 +02:00
Radek Simko afe45b62df provider/aws: Allow updating tuples in WAF ByteMatchSet + no tuples (#14071)
* provider/aws: Allow updating tuples in WAF ByteMatchSet

* provider/aws: Allow WAF ByteMatchSet with no tuples
2017-05-19 09:13:58 +02:00
Radek Simko 740c92fc67 provider/aws: Support filtering in ASG data source (#14501) 2017-05-18 17:40:49 +02:00
Paul Stack 62347ea833 provider/aws: Fall back to old tagging mechanism for AWS gov and aws China (#14627)
Fixes: #14535

When in a `restricted` cloud, we should fall back to the old method of
tagging. Before this change we saw the following:

```
% terraform apply                                                                                                                                                                                         ✭
aws_instance.foo: Creating...
  ami:                          "" => "ami-0fa3c42c"
  associate_public_ip_address:  "" => "<computed>"
  availability_zone:            "" => "<computed>"
  ebs_block_device.#:           "" => "<computed>"
  ephemeral_block_device.#:     "" => "<computed>"
  instance_state:               "" => "<computed>"
  instance_type:                "" => "m1.small"
  ipv6_address_count:           "" => "<computed>"
  ipv6_addresses.#:             "" => "<computed>"
  key_name:                     "" => "<computed>"
  network_interface.#:          "" => "<computed>"
  network_interface_id:         "" => "<computed>"
  placement_group:              "" => "<computed>"
  primary_network_interface_id: "" => "<computed>"
  private_dns:                  "" => "<computed>"
  private_ip:                   "" => "<computed>"
  public_dns:                   "" => "<computed>"
  public_ip:                    "" => "<computed>"
  root_block_device.#:          "" => "<computed>"
  security_groups.#:            "" => "<computed>"
  source_dest_check:            "" => "true"
  subnet_id:                    "" => "<computed>"
  tags.%:                       "" => "1"
  tags.foo:                     "" => "bar"
  tenancy:                      "" => "<computed>"
  volume_tags.%:                "" => "<computed>"
  vpc_security_group_ids.#:     "" => "<computed>"
aws_instance.foo: Creation complete (ID: i-0009f227ae24791b9)

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

% terraform plan                                                                                                                                                                                          ✭
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

aws_instance.foo: Refreshing state... (ID: i-0009f227ae24791b9)
The Terraform execution plan has been generated and is shown below.
Resources are shown in alphabetical order for quick scanning. Green resources
will be created (or destroyed and then created if an existing resource
exists), yellow resources are being changed in-place, and red resources
will be destroyed. Cyan entries are data sources to be read.

Note: You didn't specify an "-out" parameter to save this plan, so when
"apply" is called, Terraform can't guarantee this is what will execute.

~ aws_instance.foo
    tags.%:   "0" => "1"
    tags.foo: "" => "bar"

Plan: 0 to add, 1 to change, 0 to destroy.
```

After this patch, we see the following:

```
% terraform apply                                                                                                                                                                                       ✹ ✭
[WARN] /Users/stacko/Code/go/bin/terraform-provider-aws overrides an internal plugin for aws-provider.
  If you did not expect to see this message you will need to remove the old plugin.
  See https://www.terraform.io/docs/internals/internal-plugins.html
aws_instance.foo: Creating...
  ami:                          "" => "ami-0fa3c42c"
  associate_public_ip_address:  "" => "<computed>"
  availability_zone:            "" => "<computed>"
  ebs_block_device.#:           "" => "<computed>"
  ephemeral_block_device.#:     "" => "<computed>"
  instance_state:               "" => "<computed>"
  instance_type:                "" => "m1.small"
  ipv6_address_count:           "" => "<computed>"
  ipv6_addresses.#:             "" => "<computed>"
  key_name:                     "" => "<computed>"
  network_interface.#:          "" => "<computed>"
  network_interface_id:         "" => "<computed>"
  placement_group:              "" => "<computed>"
  primary_network_interface_id: "" => "<computed>"
  private_dns:                  "" => "<computed>"
  private_ip:                   "" => "<computed>"
  public_dns:                   "" => "<computed>"
  public_ip:                    "" => "<computed>"
  root_block_device.#:          "" => "<computed>"
  security_groups.#:            "" => "<computed>"
  source_dest_check:            "" => "true"
  subnet_id:                    "" => "<computed>"
  tags.%:                       "" => "1"
  tags.foo:                     "" => "bar"
  tenancy:                      "" => "<computed>"
  volume_tags.%:                "" => "<computed>"
  vpc_security_group_ids.#:     "" => "<computed>"
aws_instance.foo: Creation complete (ID: i-04cd122e28f167a14)

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

% terraform plan                                                                                                                                                                                        ✹ ✭
[WARN] /Users/stacko/Code/go/bin/terraform-provider-aws overrides an internal plugin for aws-provider.
  If you did not expect to see this message you will need to remove the old plugin.
  See https://www.terraform.io/docs/internals/internal-plugins.html
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

aws_instance.foo: Refreshing state... (ID: i-04cd122e28f167a14)
No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, Terraform
doesn't need to do anything.
```
2017-05-18 17:28:37 +03:00
Vladislav Rassokhin 5e8306d02a Ensure schemas of `default_cache_behavior` and `cache_behavior` are same except `path_pattern` (#12628) 2017-05-18 16:42:04 +03:00
Radek Simko cf67a689db provider/aws: Randomize CloudFormation acceptance tests (#14623) 2017-05-18 15:39:51 +02:00
Paul Stack 4bb16ad7f8 provider/aws: Fix the aws_codebuild_project acceptance tests (#14626) 2017-05-18 16:19:56 +03:00
Radek Simko 506eaaa247 provider/aws: Raise timeout for attaching/detaching VPN GW (#14624) 2017-05-18 15:02:34 +02:00
Jake Champlin 9e4b62556a Merge pull request #14571 from hashicorp/b-handle-limit-exceeded
provider/aws: Handle LimitExceededException for subscriber limits
2017-05-18 08:34:30 -04:00
Radek Simko 02cacceee4 provider/aws: Fix RDS DB snapshot data source acc test (#14610) 2017-05-18 13:52:33 +02:00
Techbrunch 71e5602d79 Fixes #14620 Handle migration of data when restoring db cluster from snapshot (#14622)
Add `preparing-data-migration` to the list of pending statuses when creating a cluster from a snapshot using a different engine.
2017-05-18 14:23:55 +03:00
Radek Simko f77ccc0520 provider/aws: Randomize SNS topic names in acceptance tests (#14618) 2017-05-18 11:45:19 +02:00
Radek Simko 1b532b519f provider/aws: Increase timeout for retrying creation of IAM server cert (#14609) 2017-05-18 11:43:50 +02:00
Clint 2a36e75b9e provider/aws: Tag VPCs created in our tests to help track down leaks (#14596) 2017-05-17 16:26:40 -05:00
Jake Champlin d05fc51aa0
provider/aws: Handle LimitExceededException for subscriber limits
- Updates aws-sdk-go/request for retryer fix
 - Fixes dynamoDB exception handling to catch subscriber limit error

When the `aws-sdk-go` dep releases the next release, we can tag the vendor with the new
release version, and merge this. Until then, soft-updated the vendor solely for the `request` package to post fix.

DynamoDB Fix:
```
aws_dynamodb_table.bar: Creating...
  arn:                       "" => "<computed>"
  attribute.#:               "" => "1"
  attribute.4228504427.name: "" => "id"
  attribute.4228504427.type: "" => "S"
  hash_key:                  "" => "id"
  name:                      "" => "over-cap-test"
  read_capacity:             "" => "5"
  stream_arn:                "" => "<computed>"
  stream_enabled:            "" => "<computed>"
  stream_view_type:          "" => "<computed>"
  write_capacity:            "" => "5"
Error applying plan:

1 error(s) occurred:

* aws_dynamodb_table.bar: 1 error(s) occurred:

* aws_dynamodb_table.bar: AWS Error creating DynamoDB table: LimitExceededException: Subscriber limit exceeded: There is a limit of 256 tables per subscriber
        status code: 400, request id: J2MC7MR060VKBPHP9P6JG5B6Q3VV4KQNSO5AEMVJF66Q9ASUAAJG
```
2017-05-17 08:59:47 -04:00
Jake Champlin da2659b8e9 Merge pull request #11710 from ewbankkit/aws_default_vpc-resource
resource/aws: Add 'aws_default_vpc' resource
2017-05-17 08:37:14 -04:00
Jake Champlin a53c8825a8 Merge pull request #14463 from ewbankkit/issue-5653
Nothing to update in cloudformation should not result in errors
2017-05-17 08:08:11 -04:00
Kit Ewbank 2ed7297fa3 Add 'aws_default_vpc' resource. 2017-05-16 20:15:40 -04:00
Paul Stack 8b7f17c039 provider/aws: Change of aws_subnet ipv6 causing update failure (#14545)
Fixes: #14530

When we found an update of IPv6 cidr block, we first tried to
disassociate the old cidr block association. This caused errors if there
was none, it threw an error, as we passed an empty associationId:

```
* aws_subnet.public_subnet.0: InvalidSubnetCidrBlockAssociationId.Malformed: The subnet CIDR block with association ID  is malformed
    status code: 400, request id: f438f468-9ca4-4000-ba78-63a0f25d390a
* aws_subnet.public_subnet[1]: 1 error(s) occurred:
```

```
% make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSSubnet_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/05/16 18:28:45 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSSubnet_ -timeout 120m
=== RUN   TestAccAWSSubnet_importBasic
--- PASS: TestAccAWSSubnet_importBasic (55.40s)
=== RUN   TestAccAWSSubnet_basic
--- PASS: TestAccAWSSubnet_basic (53.62s)
=== RUN   TestAccAWSSubnet_ipv6
--- PASS: TestAccAWSSubnet_ipv6 (125.87s)
=== RUN   TestAccAWSSubnet_enableIpv6
--- PASS: TestAccAWSSubnet_enableIpv6 (88.88s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	323.787s
```
2017-05-16 23:06:28 +03:00
Paul Stack f351de9758 provider/aws: Set aws_subnet ipv6_cidr_block to computed (#14542)
Fixes: #14361

An IPv6 CIDR block is option and can be added *after* a subnet has been
created. Therefore, we should set it to `Computed: true`

Otherwise, a manually created IPv6 association will be removed on the
next terraform run
2017-05-16 17:34:16 +03:00