package aws import ( "bytes" "fmt" "log" "github.com/hashicorp/terraform/helper/hashcode" "github.com/hashicorp/terraform/helper/mutexkv" "github.com/hashicorp/terraform/helper/schema" "github.com/hashicorp/terraform/terraform" ) // Provider returns a terraform.ResourceProvider. func Provider() terraform.ResourceProvider { // TODO: Move the validation to this, requires conditional schemas // TODO: Move the configuration to this, requires validation // The actual provider return &schema.Provider{ Schema: map[string]*schema.Schema{ "access_key": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["access_key"], }, "secret_key": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["secret_key"], }, "profile": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["profile"], }, "assume_role": assumeRoleSchema(), "shared_credentials_file": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["shared_credentials_file"], }, "token": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["token"], }, "region": { Type: schema.TypeString, Required: true, DefaultFunc: schema.MultiEnvDefaultFunc([]string{ "AWS_REGION", "AWS_DEFAULT_REGION", }, nil), Description: descriptions["region"], InputDefault: "us-east-1", }, "max_retries": { Type: schema.TypeInt, Optional: true, Default: 11, Description: descriptions["max_retries"], }, "allowed_account_ids": { Type: schema.TypeSet, Elem: &schema.Schema{Type: schema.TypeString}, Optional: true, ConflictsWith: []string{"forbidden_account_ids"}, Set: schema.HashString, }, "forbidden_account_ids": { Type: schema.TypeSet, Elem: &schema.Schema{Type: schema.TypeString}, Optional: true, ConflictsWith: []string{"allowed_account_ids"}, Set: schema.HashString, }, "dynamodb_endpoint": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["dynamodb_endpoint"], }, "kinesis_endpoint": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["kinesis_endpoint"], }, "endpoints": endpointsSchema(), "insecure": { Type: schema.TypeBool, Optional: true, Default: false, Description: descriptions["insecure"], }, "skip_credentials_validation": { Type: schema.TypeBool, Optional: true, Default: false, Description: descriptions["skip_credentials_validation"], }, "skip_requesting_account_id": { Type: schema.TypeBool, Optional: true, Default: false, Description: descriptions["skip_requesting_account_id"], }, "skip_metadata_api_check": { Type: schema.TypeBool, Optional: true, Default: false, Description: descriptions["skip_metadata_api_check"], }, "s3_force_path_style": { Type: schema.TypeBool, Optional: true, Default: false, Description: descriptions["s3_force_path_style"], }, }, DataSourcesMap: map[string]*schema.Resource{ "aws_ami": dataSourceAwsAmi(), "aws_availability_zones": dataSourceAwsAvailabilityZones(), "aws_caller_identity": dataSourceAwsCallerIdentity(), "aws_cloudformation_stack": dataSourceAwsCloudFormationStack(), "aws_ecs_container_definition": dataSourceAwsEcsContainerDefinition(), "aws_elb_service_account": dataSourceAwsElbServiceAccount(), "aws_iam_policy_document": dataSourceAwsIamPolicyDocument(), "aws_ip_ranges": dataSourceAwsIPRanges(), "aws_redshift_service_account": dataSourceAwsRedshiftServiceAccount(), "aws_s3_bucket_object": dataSourceAwsS3BucketObject(), }, ResourcesMap: map[string]*schema.Resource{ "aws_alb": resourceAwsAlb(), "aws_alb_listener": resourceAwsAlbListener(), "aws_alb_listener_rule": resourceAwsAlbListenerRule(), "aws_alb_target_group": resourceAwsAlbTargetGroup(), "aws_alb_target_group_attachment": resourceAwsAlbTargetGroupAttachment(), "aws_ami": resourceAwsAmi(), "aws_ami_copy": resourceAwsAmiCopy(), "aws_ami_from_instance": resourceAwsAmiFromInstance(), "aws_ami_launch_permission": resourceAwsAmiLaunchPermission(), "aws_api_gateway_account": resourceAwsApiGatewayAccount(), "aws_api_gateway_api_key": resourceAwsApiGatewayApiKey(), "aws_api_gateway_authorizer": resourceAwsApiGatewayAuthorizer(), "aws_api_gateway_base_path_mapping": resourceAwsApiGatewayBasePathMapping(), "aws_api_gateway_deployment": resourceAwsApiGatewayDeployment(), "aws_api_gateway_domain_name": resourceAwsApiGatewayDomainName(), "aws_api_gateway_integration": resourceAwsApiGatewayIntegration(), "aws_api_gateway_integration_response": resourceAwsApiGatewayIntegrationResponse(), "aws_api_gateway_method": resourceAwsApiGatewayMethod(), "aws_api_gateway_method_response": resourceAwsApiGatewayMethodResponse(), "aws_api_gateway_model": resourceAwsApiGatewayModel(), "aws_api_gateway_resource": resourceAwsApiGatewayResource(), "aws_api_gateway_rest_api": resourceAwsApiGatewayRestApi(), "aws_app_cookie_stickiness_policy": resourceAwsAppCookieStickinessPolicy(), "aws_appautoscaling_target": resourceAwsAppautoscalingTarget(), "aws_appautoscaling_policy": resourceAwsAppautoscalingPolicy(), "aws_autoscaling_group": resourceAwsAutoscalingGroup(), "aws_autoscaling_notification": resourceAwsAutoscalingNotification(), "aws_autoscaling_policy": resourceAwsAutoscalingPolicy(), "aws_autoscaling_schedule": resourceAwsAutoscalingSchedule(), "aws_cloudformation_stack": resourceAwsCloudFormationStack(), "aws_cloudfront_distribution": resourceAwsCloudFrontDistribution(), "aws_cloudfront_origin_access_identity": resourceAwsCloudFrontOriginAccessIdentity(), "aws_cloudtrail": resourceAwsCloudTrail(), "aws_cloudwatch_event_rule": resourceAwsCloudWatchEventRule(), "aws_cloudwatch_event_target": resourceAwsCloudWatchEventTarget(), "aws_cloudwatch_log_group": resourceAwsCloudWatchLogGroup(), "aws_cloudwatch_log_metric_filter": resourceAwsCloudWatchLogMetricFilter(), "aws_cloudwatch_log_stream": resourceAwsCloudWatchLogStream(), "aws_cloudwatch_log_subscription_filter": resourceAwsCloudwatchLogSubscriptionFilter(), "aws_autoscaling_lifecycle_hook": resourceAwsAutoscalingLifecycleHook(), "aws_cloudwatch_metric_alarm": resourceAwsCloudWatchMetricAlarm(), "aws_codedeploy_app": resourceAwsCodeDeployApp(), "aws_codedeploy_deployment_group": resourceAwsCodeDeployDeploymentGroup(), "aws_codecommit_repository": resourceAwsCodeCommitRepository(), "aws_customer_gateway": resourceAwsCustomerGateway(), "aws_db_event_subscription": resourceAwsDbEventSubscription(), "aws_db_instance": resourceAwsDbInstance(), "aws_db_option_group": resourceAwsDbOptionGroup(), "aws_db_parameter_group": resourceAwsDbParameterGroup(), "aws_db_security_group": resourceAwsDbSecurityGroup(), "aws_db_subnet_group": resourceAwsDbSubnetGroup(), "aws_directory_service_directory": resourceAwsDirectoryServiceDirectory(), "aws_dynamodb_table": resourceAwsDynamoDbTable(), "aws_ebs_volume": resourceAwsEbsVolume(), "aws_ecr_repository": resourceAwsEcrRepository(), "aws_ecr_repository_policy": resourceAwsEcrRepositoryPolicy(), "aws_ecs_cluster": resourceAwsEcsCluster(), "aws_ecs_service": resourceAwsEcsService(), "aws_ecs_task_definition": resourceAwsEcsTaskDefinition(), "aws_efs_file_system": resourceAwsEfsFileSystem(), "aws_efs_mount_target": resourceAwsEfsMountTarget(), "aws_eip": resourceAwsEip(), "aws_eip_association": resourceAwsEipAssociation(), "aws_elasticache_cluster": resourceAwsElasticacheCluster(), "aws_elasticache_parameter_group": resourceAwsElasticacheParameterGroup(), "aws_elasticache_replication_group": resourceAwsElasticacheReplicationGroup(), "aws_elasticache_security_group": resourceAwsElasticacheSecurityGroup(), "aws_elasticache_subnet_group": resourceAwsElasticacheSubnetGroup(), "aws_elastic_beanstalk_application": resourceAwsElasticBeanstalkApplication(), "aws_elastic_beanstalk_configuration_template": resourceAwsElasticBeanstalkConfigurationTemplate(), "aws_elastic_beanstalk_environment": resourceAwsElasticBeanstalkEnvironment(), "aws_elasticsearch_domain": resourceAwsElasticSearchDomain(), "aws_elastictranscoder_pipeline": resourceAwsElasticTranscoderPipeline(), "aws_elastictranscoder_preset": resourceAwsElasticTranscoderPreset(), "aws_elb": resourceAwsElb(), "aws_elb_attachment": resourceAwsElbAttachment(), "aws_flow_log": resourceAwsFlowLog(), "aws_glacier_vault": resourceAwsGlacierVault(), "aws_iam_access_key": resourceAwsIamAccessKey(), "aws_iam_account_password_policy": resourceAwsIamAccountPasswordPolicy(), "aws_iam_group_policy": resourceAwsIamGroupPolicy(), "aws_iam_group": resourceAwsIamGroup(), "aws_iam_group_membership": resourceAwsIamGroupMembership(), "aws_iam_group_policy_attachment": resourceAwsIamGroupPolicyAttachment(), "aws_iam_instance_profile": resourceAwsIamInstanceProfile(), "aws_iam_policy": resourceAwsIamPolicy(), "aws_iam_policy_attachment": resourceAwsIamPolicyAttachment(), "aws_iam_role_policy_attachment": resourceAwsIamRolePolicyAttachment(), "aws_iam_role_policy": resourceAwsIamRolePolicy(), "aws_iam_role": resourceAwsIamRole(), "aws_iam_saml_provider": resourceAwsIamSamlProvider(), "aws_iam_server_certificate": resourceAwsIAMServerCertificate(), "aws_iam_user_policy_attachment": resourceAwsIamUserPolicyAttachment(), "aws_iam_user_policy": resourceAwsIamUserPolicy(), "aws_iam_user_ssh_key": resourceAwsIamUserSshKey(), "aws_iam_user": resourceAwsIamUser(), "aws_instance": resourceAwsInstance(), "aws_internet_gateway": resourceAwsInternetGateway(), "aws_key_pair": resourceAwsKeyPair(), "aws_kinesis_firehose_delivery_stream": resourceAwsKinesisFirehoseDeliveryStream(), "aws_kinesis_stream": resourceAwsKinesisStream(), "aws_kms_alias": resourceAwsKmsAlias(), "aws_kms_key": resourceAwsKmsKey(), "aws_lambda_function": resourceAwsLambdaFunction(), "aws_lambda_event_source_mapping": resourceAwsLambdaEventSourceMapping(), "aws_lambda_alias": resourceAwsLambdaAlias(), "aws_lambda_permission": resourceAwsLambdaPermission(), "aws_launch_configuration": resourceAwsLaunchConfiguration(), "aws_lb_cookie_stickiness_policy": resourceAwsLBCookieStickinessPolicy(), "aws_load_balancer_policy": resourceAwsLoadBalancerPolicy(), "aws_load_balancer_backend_server_policy": resourceAwsLoadBalancerBackendServerPolicies(), "aws_load_balancer_listener_policy": resourceAwsLoadBalancerListenerPolicies(), "aws_lb_ssl_negotiation_policy": resourceAwsLBSSLNegotiationPolicy(), "aws_main_route_table_association": resourceAwsMainRouteTableAssociation(), "aws_nat_gateway": resourceAwsNatGateway(), "aws_network_acl": resourceAwsNetworkAcl(), "aws_default_network_acl": resourceAwsDefaultNetworkAcl(), "aws_default_route_table": resourceAwsDefaultRouteTable(), "aws_network_acl_rule": resourceAwsNetworkAclRule(), "aws_network_interface": resourceAwsNetworkInterface(), "aws_opsworks_application": resourceAwsOpsworksApplication(), "aws_opsworks_stack": resourceAwsOpsworksStack(), "aws_opsworks_java_app_layer": resourceAwsOpsworksJavaAppLayer(), "aws_opsworks_haproxy_layer": resourceAwsOpsworksHaproxyLayer(), "aws_opsworks_static_web_layer": resourceAwsOpsworksStaticWebLayer(), "aws_opsworks_php_app_layer": resourceAwsOpsworksPhpAppLayer(), "aws_opsworks_rails_app_layer": resourceAwsOpsworksRailsAppLayer(), "aws_opsworks_nodejs_app_layer": resourceAwsOpsworksNodejsAppLayer(), "aws_opsworks_memcached_layer": resourceAwsOpsworksMemcachedLayer(), "aws_opsworks_mysql_layer": resourceAwsOpsworksMysqlLayer(), "aws_opsworks_ganglia_layer": resourceAwsOpsworksGangliaLayer(), "aws_opsworks_custom_layer": resourceAwsOpsworksCustomLayer(), "aws_opsworks_instance": resourceAwsOpsworksInstance(), "aws_opsworks_user_profile": resourceAwsOpsworksUserProfile(), "aws_opsworks_permission": resourceAwsOpsworksPermission(), "aws_placement_group": resourceAwsPlacementGroup(), "aws_proxy_protocol_policy": resourceAwsProxyProtocolPolicy(), "aws_rds_cluster": resourceAwsRDSCluster(), "aws_rds_cluster_instance": resourceAwsRDSClusterInstance(), "aws_rds_cluster_parameter_group": resourceAwsRDSClusterParameterGroup(), "aws_redshift_cluster": resourceAwsRedshiftCluster(), "aws_redshift_security_group": resourceAwsRedshiftSecurityGroup(), "aws_redshift_parameter_group": resourceAwsRedshiftParameterGroup(), "aws_redshift_subnet_group": resourceAwsRedshiftSubnetGroup(), "aws_route53_delegation_set": resourceAwsRoute53DelegationSet(), "aws_route53_record": resourceAwsRoute53Record(), "aws_route53_zone_association": resourceAwsRoute53ZoneAssociation(), "aws_route53_zone": resourceAwsRoute53Zone(), "aws_route53_health_check": resourceAwsRoute53HealthCheck(), "aws_route": resourceAwsRoute(), "aws_route_table": resourceAwsRouteTable(), "aws_route_table_association": resourceAwsRouteTableAssociation(), "aws_ses_active_receipt_rule_set": resourceAwsSesActiveReceiptRuleSet(), "aws_ses_receipt_filter": resourceAwsSesReceiptFilter(), "aws_ses_receipt_rule": resourceAwsSesReceiptRule(), "aws_ses_receipt_rule_set": resourceAwsSesReceiptRuleSet(), "aws_s3_bucket": resourceAwsS3Bucket(), "aws_s3_bucket_policy": resourceAwsS3BucketPolicy(), "aws_s3_bucket_object": resourceAwsS3BucketObject(), "aws_s3_bucket_notification": resourceAwsS3BucketNotification(), "aws_security_group": resourceAwsSecurityGroup(), "aws_security_group_rule": resourceAwsSecurityGroupRule(), "aws_simpledb_domain": resourceAwsSimpleDBDomain(), "aws_ssm_association": resourceAwsSsmAssociation(), "aws_ssm_document": resourceAwsSsmDocument(), "aws_spot_datafeed_subscription": resourceAwsSpotDataFeedSubscription(), "aws_spot_instance_request": resourceAwsSpotInstanceRequest(), "aws_spot_fleet_request": resourceAwsSpotFleetRequest(), "aws_sqs_queue": resourceAwsSqsQueue(), "aws_sns_topic": resourceAwsSnsTopic(), "aws_sns_topic_subscription": resourceAwsSnsTopicSubscription(), "aws_subnet": resourceAwsSubnet(), "aws_volume_attachment": resourceAwsVolumeAttachment(), "aws_vpc_dhcp_options_association": resourceAwsVpcDhcpOptionsAssociation(), "aws_vpc_dhcp_options": resourceAwsVpcDhcpOptions(), "aws_vpc_peering_connection": resourceAwsVpcPeeringConnection(), "aws_vpc": resourceAwsVpc(), "aws_vpc_endpoint": resourceAwsVpcEndpoint(), "aws_vpn_connection": resourceAwsVpnConnection(), "aws_vpn_connection_route": resourceAwsVpnConnectionRoute(), "aws_vpn_gateway": resourceAwsVpnGateway(), "aws_vpn_gateway_attachment": resourceAwsVpnGatewayAttachment(), }, ConfigureFunc: providerConfigure, } } var descriptions map[string]string func init() { descriptions = map[string]string{ "region": "The region where AWS operations will take place. Examples\n" + "are us-east-1, us-west-2, etc.", "access_key": "The access key for API operations. You can retrieve this\n" + "from the 'Security & Credentials' section of the AWS console.", "secret_key": "The secret key for API operations. You can retrieve this\n" + "from the 'Security & Credentials' section of the AWS console.", "profile": "The profile for API operations. If not set, the default profile\n" + "created with `aws configure` will be used.", "shared_credentials_file": "The path to the shared credentials file. If not set\n" + "this defaults to ~/.aws/credentials.", "token": "session token. A session token is only required if you are\n" + "using temporary security credentials.", "max_retries": "The maximum number of times an AWS API request is\n" + "being executed. If the API request still fails, an error is\n" + "thrown.", "dynamodb_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n" + "It's typically used to connect to dynamodb-local.", "kinesis_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n" + "It's typically used to connect to kinesalite.", "iam_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n", "ec2_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n", "elb_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n", "s3_endpoint": "Use this to override the default endpoint URL constructed from the `region`.\n", "insecure": "Explicitly allow the provider to perform \"insecure\" SSL requests. If omitted," + "default value is `false`", "skip_credentials_validation": "Skip the credentials validation via STS API. " + "Used for AWS API implementations that do not have STS available/implemented.", "skip_requesting_account_id": "Skip requesting the account ID. " + "Used for AWS API implementations that do not have IAM/STS API and/or metadata API.", "skip_medatadata_api_check": "Skip the AWS Metadata API check. " + "Used for AWS API implementations that do not have a metadata api endpoint.", "s3_force_path_style": "Set this to true to force the request to use path-style addressing,\n" + "i.e., http://s3.amazonaws.com/BUCKET/KEY. By default, the S3 client will\n" + "use virtual hosted bucket addressing when possible\n" + "(http://BUCKET.s3.amazonaws.com/KEY). Specific to the Amazon S3 service.", "assume_role_role_arn": "The ARN of an IAM role to assume prior to making API calls.", "assume_role_session_name": "The session name to use when assuming the role. If ommitted," + " no session name is passed to the AssumeRole call.", "assume_role_external_id": "The external ID to use when assuming the role. If ommitted," + " no external ID is passed to the AssumeRole call.", } } func providerConfigure(d *schema.ResourceData) (interface{}, error) { config := Config{ AccessKey: d.Get("access_key").(string), SecretKey: d.Get("secret_key").(string), Profile: d.Get("profile").(string), CredsFilename: d.Get("shared_credentials_file").(string), Token: d.Get("token").(string), Region: d.Get("region").(string), MaxRetries: d.Get("max_retries").(int), DynamoDBEndpoint: d.Get("dynamodb_endpoint").(string), KinesisEndpoint: d.Get("kinesis_endpoint").(string), Insecure: d.Get("insecure").(bool), SkipCredsValidation: d.Get("skip_credentials_validation").(bool), SkipRequestingAccountId: d.Get("skip_requesting_account_id").(bool), SkipMetadataApiCheck: d.Get("skip_metadata_api_check").(bool), S3ForcePathStyle: d.Get("s3_force_path_style").(bool), } assumeRoleList := d.Get("assume_role").(*schema.Set).List() if len(assumeRoleList) == 1 { assumeRole := assumeRoleList[0].(map[string]interface{}) config.AssumeRoleARN = assumeRole["role_arn"].(string) config.AssumeRoleSessionName = assumeRole["session_name"].(string) config.AssumeRoleExternalID = assumeRole["external_id"].(string) log.Printf("[INFO] assume_role configuration set: (ARN: %q, SessionID: %q, ExternalID: %q)", config.AssumeRoleARN, config.AssumeRoleSessionName, config.AssumeRoleExternalID) } else { log.Printf("[INFO] No assume_role block read from configuration") } endpointsSet := d.Get("endpoints").(*schema.Set) for _, endpointsSetI := range endpointsSet.List() { endpoints := endpointsSetI.(map[string]interface{}) config.IamEndpoint = endpoints["iam"].(string) config.Ec2Endpoint = endpoints["ec2"].(string) config.ElbEndpoint = endpoints["elb"].(string) config.S3Endpoint = endpoints["s3"].(string) } if v, ok := d.GetOk("allowed_account_ids"); ok { config.AllowedAccountIds = v.(*schema.Set).List() } if v, ok := d.GetOk("forbidden_account_ids"); ok { config.ForbiddenAccountIds = v.(*schema.Set).List() } return config.Client() } // This is a global MutexKV for use within this plugin. var awsMutexKV = mutexkv.NewMutexKV() func assumeRoleSchema() *schema.Schema { return &schema.Schema{ Type: schema.TypeSet, Optional: true, MaxItems: 1, Elem: &schema.Resource{ Schema: map[string]*schema.Schema{ "role_arn": { Type: schema.TypeString, Optional: true, Description: descriptions["assume_role_role_arn"], }, "session_name": { Type: schema.TypeString, Optional: true, Description: descriptions["assume_role_session_name"], }, "external_id": { Type: schema.TypeString, Optional: true, Description: descriptions["assume_role_external_id"], }, }, }, Set: assumeRoleToHash, } } func assumeRoleToHash(v interface{}) int { var buf bytes.Buffer m := v.(map[string]interface{}) buf.WriteString(fmt.Sprintf("%s-", m["role_arn"].(string))) buf.WriteString(fmt.Sprintf("%s-", m["session_name"].(string))) buf.WriteString(fmt.Sprintf("%s-", m["external_id"].(string))) return hashcode.String(buf.String()) } func endpointsSchema() *schema.Schema { return &schema.Schema{ Type: schema.TypeSet, Optional: true, Elem: &schema.Resource{ Schema: map[string]*schema.Schema{ "iam": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["iam_endpoint"], }, "ec2": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["ec2_endpoint"], }, "elb": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["elb_endpoint"], }, "s3": { Type: schema.TypeString, Optional: true, Default: "", Description: descriptions["s3_endpoint"], }, }, }, Set: endpointsToHash, } } func endpointsToHash(v interface{}) int { var buf bytes.Buffer m := v.(map[string]interface{}) buf.WriteString(fmt.Sprintf("%s-", m["iam"].(string))) buf.WriteString(fmt.Sprintf("%s-", m["ec2"].(string))) buf.WriteString(fmt.Sprintf("%s-", m["elb"].(string))) buf.WriteString(fmt.Sprintf("%s-", m["s3"].(string))) return hashcode.String(buf.String()) }