From e3f084370f669f28ccbb348dc94d6c36de339ee4 Mon Sep 17 00:00:00 2001 From: Michael Leong Date: Thu, 7 Mar 2019 22:04:58 +0000 Subject: [PATCH 1/4] removed conflicts between inline policy and policy_arns, updated tests --- vault/resource_aws_secret_backend_role.go | 4 ++-- .../resource_aws_secret_backend_role_test.go | 20 +++++++++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/vault/resource_aws_secret_backend_role.go b/vault/resource_aws_secret_backend_role.go index dd6839f4c..659accbc0 100644 --- a/vault/resource_aws_secret_backend_role.go +++ b/vault/resource_aws_secret_backend_role.go @@ -37,7 +37,7 @@ func awsSecretBackendRoleResource() *schema.Resource { "policy_arns": { Type: schema.TypeList, Optional: true, - ConflictsWith: []string{"policy_document", "policy", "policy_arn"}, + ConflictsWith: []string{"policy", "policy_arn"}, Description: "ARN for an existing IAM policy the role should use.", Elem: &schema.Schema{ Type: schema.TypeString, @@ -53,7 +53,7 @@ func awsSecretBackendRoleResource() *schema.Resource { "policy_document": { Type: schema.TypeString, Optional: true, - ConflictsWith: []string{"policy_arns", "policy_arn", "policy"}, + ConflictsWith: []string{"policy_arn", "policy"}, Description: "IAM policy the role should use in JSON format.", DiffSuppressFunc: util.JsonDiffSuppress, }, diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go index f49fb8683..ed929391c 100644 --- a/vault/resource_aws_secret_backend_role_test.go +++ b/vault/resource_aws_secret_backend_role_test.go @@ -159,7 +159,15 @@ resource "vault_aws_secret_backend_role" "test_policy_arns" { credential_type = "iam_user" backend = "${vault_aws_secret_backend.test.path}" } -`, path, accessKey, secretKey, name, testAccAWSSecretBackendRolePolicyInline_basic, name, testAccAWSSecretBackendRolePolicyArn_basic) + +resource "vault_aws_secret_backend_role" "test_policy_inline_and_arns" { + name = "%s-policy-inline-and-arn" + policy_arns = ["%s"] + policy_document = %q + credential_type = "iam_user" + backend = "${vault_aws_secret_backend.test.path}" +} +`, path, accessKey, secretKey, name, testAccAWSSecretBackendRolePolicyInline_basic, name, testAccAWSSecretBackendRolePolicyArn_basic, name, testAccAWSSecretBackendRolePolicyInline_basic, testAccAWSSecretBackendRolePolicyArn_basic) } func testAccAWSSecretBackendRoleConfig_updated(name, path, accessKey, secretKey string) string { @@ -183,5 +191,13 @@ resource "vault_aws_secret_backend_role" "test_policy_arns" { credential_type = "iam_user" backend = "${vault_aws_secret_backend.test.path}" } -`, path, accessKey, secretKey, name, testAccAWSSecretBackendRolePolicyInline_updated, name, testAccAWSSecretBackendRolePolicyArn_updated) + +resource "vault_aws_secret_backend_role" "test_policy_inline_and_arns" { + name = "%s-policy-inline-and-arn" + policy_document = %q + policy_arns = ["%s"] + credential_type = "iam_user" + backend = "${vault_aws_secret_backend.test.path}" +} +`, path, accessKey, secretKey, name, testAccAWSSecretBackendRolePolicyInline_updated, name, testAccAWSSecretBackendRolePolicyArn_updated, name, testAccAWSSecretBackendRolePolicyInline_updated, testAccAWSSecretBackendRolePolicyArn_updated) } From 52a1a7429574820db9c3610798d9de5da2422a47 Mon Sep 17 00:00:00 2001 From: Michael Leong Date: Thu, 7 Mar 2019 22:59:32 +0000 Subject: [PATCH 2/4] added test suites for inline and arn policy --- .../resource_aws_secret_backend_role_test.go | 29 +++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go index ed929391c..ed38ec5b6 100644 --- a/vault/resource_aws_secret_backend_role_test.go +++ b/vault/resource_aws_secret_backend_role_test.go @@ -34,6 +34,10 @@ func TestAccAWSSecretBackendRole_basic(t *testing.T) { resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "name", fmt.Sprintf("%s-policy-arn", name)), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "backend", backend), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "name", fmt.Sprintf("%s-policy-inline-and-arns", name)), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "backend", backend), + util.TestCheckResourceAttrJSON("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_document", testAccAWSSecretBackendRolePolicyInline_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), ), }, { @@ -45,6 +49,10 @@ func TestAccAWSSecretBackendRole_basic(t *testing.T) { resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "name", fmt.Sprintf("%s-policy-arn", name)), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "backend", backend), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_updated), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "name", fmt.Sprintf("%s-policy-inline-and-arns", name)), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "backend", backend), + util.TestCheckResourceAttrJSON("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_document", testAccAWSSecretBackendRolePolicyInline_updated), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_updated), ), }, }, @@ -69,6 +77,10 @@ func TestAccAWSSecretBackendRole_import(t *testing.T) { resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "name", fmt.Sprintf("%s-policy-arn", name)), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "backend", backend), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "name", fmt.Sprintf("%s-policy-inline-and-arns", name)), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "backend", backend), + util.TestCheckResourceAttrJSON("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_document", testAccAWSSecretBackendRolePolicyInline_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), ), }, { @@ -81,6 +93,11 @@ func TestAccAWSSecretBackendRole_import(t *testing.T) { ImportState: true, ImportStateVerify: true, }, + { + ResourceName: "vault_aws_secret_backend_role.test_policy_inline_and_arns", + ImportState: true, + ImportStateVerify: true, + }, }, }) } @@ -103,6 +120,10 @@ func TestAccAWSSecretBackendRole_nested(t *testing.T) { resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "name", fmt.Sprintf("%s-policy-arn", name)), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "backend", backend), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "name", fmt.Sprintf("%s-policy-inline-and-arns", name)), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "backend", backend), + util.TestCheckResourceAttrJSON("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_document", testAccAWSSecretBackendRolePolicyInline_basic), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_basic), ), }, { @@ -114,6 +135,10 @@ func TestAccAWSSecretBackendRole_nested(t *testing.T) { resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "name", fmt.Sprintf("%s-policy-arn", name)), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "backend", backend), resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_updated), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "name", fmt.Sprintf("%s-policy-inline-and-arns", name)), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "backend", backend), + util.TestCheckResourceAttrJSON("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_document", testAccAWSSecretBackendRolePolicyInline_updated), + resource.TestCheckResourceAttr("vault_aws_secret_backend_role.test_policy_inline_and_arns", "policy_arns.0", testAccAWSSecretBackendRolePolicyArn_updated), ), }, }, @@ -161,7 +186,7 @@ resource "vault_aws_secret_backend_role" "test_policy_arns" { } resource "vault_aws_secret_backend_role" "test_policy_inline_and_arns" { - name = "%s-policy-inline-and-arn" + name = "%s-policy-inline-and-arns" policy_arns = ["%s"] policy_document = %q credential_type = "iam_user" @@ -193,7 +218,7 @@ resource "vault_aws_secret_backend_role" "test_policy_arns" { } resource "vault_aws_secret_backend_role" "test_policy_inline_and_arns" { - name = "%s-policy-inline-and-arn" + name = "%s-policy-inline-and-arns" policy_document = %q policy_arns = ["%s"] credential_type = "iam_user" From d8d0b81bf75f7b415403050f0097bb8c91c0d851 Mon Sep 17 00:00:00 2001 From: Michael Leong Date: Tue, 2 Apr 2019 23:24:19 +0000 Subject: [PATCH 3/4] fixed sprintf error due to wrong order placement --- vault/resource_aws_secret_backend_role_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go index ed38ec5b6..0a7eec342 100644 --- a/vault/resource_aws_secret_backend_role_test.go +++ b/vault/resource_aws_secret_backend_role_test.go @@ -187,8 +187,8 @@ resource "vault_aws_secret_backend_role" "test_policy_arns" { resource "vault_aws_secret_backend_role" "test_policy_inline_and_arns" { name = "%s-policy-inline-and-arns" - policy_arns = ["%s"] policy_document = %q + policy_arns = ["%s"] credential_type = "iam_user" backend = "${vault_aws_secret_backend.test.path}" } From d9e5a133a533eea5f92109948fce01570f8dfb35 Mon Sep 17 00:00:00 2001 From: Michael Leong Date: Wed, 3 Apr 2019 06:10:46 +0000 Subject: [PATCH 4/4] Build trigger