r/ssoadmin_account_assignment: new resource; d/identitystore: new data sources

aws/data_source_aws_identitystore_group.go

@@ -0,0 +1,139 @@
+package aws
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/identitystore"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func dataSourceAwsIdentityStoreGroup() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceAwsIdentityStoreGroupRead,
+
+		Schema: map[string]*schema.Schema{
+			"display_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"filter": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"attribute_path": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"attribute_value": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+
+			"group_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 47),
+					validation.StringMatch(regexp.MustCompile(`^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$`), "must match ([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}"),
+				),
+			},
+
+			"identity_store_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 64),
+					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]*$`), "must match [a-zA-Z0-9-]"),
+				),
+			},
+		},
+	}
+}
+
+func dataSourceAwsIdentityStoreGroupRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).identitystoreconn
+
+	input := &identitystore.ListGroupsInput{
+		IdentityStoreId: aws.String(d.Get("identity_store_id").(string)),
+		Filters:         expandIdentityStoreFilters(d.Get("filter").(*schema.Set).List()),
+	}
+
+	var results []*identitystore.Group
+
+	err := conn.ListGroupsPages(input, func(page *identitystore.ListGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, group := range page.Groups {
+			if group == nil {
+				continue
+			}
+
+			if v, ok := d.GetOk("group_id"); ok && v.(string) != aws.StringValue(group.GroupId) {
+				continue
+			}
+
+			results = append(results, group)
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return fmt.Errorf("error listing Identity Store Groups: %w", err)
+	}
+
+	if len(results) == 0 {
+		return fmt.Errorf("no Identity Store Group found matching criteria; try different search")
+	}
+
+	if len(results) > 1 {
+		return fmt.Errorf("multiple Identity Store Groups found matching criteria; try different search")
+	}
+
+	group := results[0]
+
+	d.SetId(aws.StringValue(group.GroupId))
+	d.Set("display_name", group.DisplayName)
+	d.Set("group_id", group.GroupId)
+
+	return nil
+}
+
+func expandIdentityStoreFilters(l []interface{}) []*identitystore.Filter {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	filters := make([]*identitystore.Filter, 0, len(l))
+	for _, v := range l {
+		tfMap, ok := v.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		filter := &identitystore.Filter{}
+
+		if v, ok := tfMap["attribute_path"].(string); ok && v != "" {
+			filter.AttributePath = aws.String(v)
+		}
+
+		if v, ok := tfMap["attribute_value"].(string); ok && v != "" {
+			filter.AttributeValue = aws.String(v)
+		}
+
+		filters = append(filters, filter)
+	}
+
+	return filters
+}

aws/data_source_aws_identitystore_group_test.go

@@ -0,0 +1,131 @@
+package aws
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccAWSIdentityStoreGroupDataSource_DisplayName(t *testing.T) {
+	dataSourceName := "data.aws_identitystore_group.test"
+	name := os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+			testAccPreCheckAWSSSOAdminInstances(t)
+			testAccPreCheckAWSIdentityStoreGroupName(t)
+		},
+		Providers:    testAccProviders,
+		CheckDestroy: nil,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSIdentityStoreGroupDataSourceConfigDisplayName(name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, "group_id"),
+					resource.TestCheckResourceAttr(dataSourceName, "display_name", name),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSIdentityStoreGroupDataSource_GroupID(t *testing.T) {
+	dataSourceName := "data.aws_identitystore_group.test"
+	name := os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME")
+	groupID := os.Getenv("AWS_IDENTITY_STORE_GROUP_ID")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+			testAccPreCheckAWSSSOAdminInstances(t)
+			testAccPreCheckAWSIdentityStoreGroupName(t)
+			testAccPreCheckAWSIdentityStoreGroupID(t)
+		},
+		Providers:    testAccProviders,
+		CheckDestroy: nil,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSIdentityStoreGroupDataSourceConfigGroupID(name, groupID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "group_id", groupID),
+					resource.TestCheckResourceAttrSet(dataSourceName, "display_name"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSIdentityStoreGroupDataSource_NonExistent(t *testing.T) {
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccPreCheckAWSSSOAdminInstances(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: nil,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSIdentityStoreGroupDataSourceConfigNonExistent,
+				ExpectError: regexp.MustCompile(`no Identity Store Group found matching criteria`),
+			},
+		},
+	})
+}
+
+func testAccPreCheckAWSIdentityStoreGroupName(t *testing.T) {
+	if os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME") == "" {
+		t.Skip("AWS_IDENTITY_STORE_GROUP_NAME env var must be set for AWS Identity Store Group acceptance test. " +
+			"This is required until ListGroups API returns results without filtering by name.")
+	}
+}
+
+func testAccPreCheckAWSIdentityStoreGroupID(t *testing.T) {
+	if os.Getenv("AWS_IDENTITY_STORE_GROUP_ID") == "" {
+		t.Skip("AWS_IDENTITY_STORE_GROUP_ID env var must be set for AWS Identity Store Group acceptance test. " +
+			"This is required until ListGroups API returns results without filtering by name.")
+	}
+}
+
+func testAccAWSIdentityStoreGroupDataSourceConfigDisplayName(name string) string {
+	return fmt.Sprintf(`
+data "aws_ssoadmin_instances" "test" {}
+
+data "aws_identitystore_group" "test" {
+  filter {
+    attribute_path  = "DisplayName"
+    attribute_value = %q
+  }
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
+}
+`, name)
+}
+
+func testAccAWSIdentityStoreGroupDataSourceConfigGroupID(name, id string) string {
+	return fmt.Sprintf(`
+data "aws_ssoadmin_instances" "test" {}
+
+data "aws_identitystore_group" "test" {
+  filter {
+    attribute_path  = "DisplayName"
+    attribute_value = %q
+  }
+
+  group_id = %q
+
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
+}
+`, name, id)
+}
+
+const testAccAWSIdentityStoreGroupDataSourceConfigNonExistent = `
+data "aws_ssoadmin_instances" "test" {}
+
+data "aws_identitystore_group" "test" {
+  filter {
+    attribute_path  = "DisplayName"
+    attribute_value = "does-not-exist"
+  }
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
+}
+`

aws/data_source_aws_identitystore_user.go

@@ -0,0 +1,111 @@
+package aws
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/identitystore"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func dataSourceAwsIdentityStoreUser() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceAwsIdentityStoreUserRead,
+
+		Schema: map[string]*schema.Schema{
+			"filter": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"attribute_path": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"attribute_value": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+
+			"identity_store_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 64),
+					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]*$`), "must match [a-zA-Z0-9-]"),
+				),
+			},
+
+			"user_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 47),
+					validation.StringMatch(regexp.MustCompile(`^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$`), "must match ([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}"),
+				),
+			},
+
+			"user_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func dataSourceAwsIdentityStoreUserRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).identitystoreconn
+
+	input := &identitystore.ListUsersInput{
+		IdentityStoreId: aws.String(d.Get("identity_store_id").(string)),
+		Filters:         expandIdentityStoreFilters(d.Get("filter").(*schema.Set).List()),
+	}
+
+	var results []*identitystore.User
+
+	err := conn.ListUsersPages(input, func(page *identitystore.ListUsersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, user := range page.Users {
+			if user == nil {
+				continue
+			}
+
+			if v, ok := d.GetOk("user_id"); ok && v.(string) != aws.StringValue(user.UserId) {
+				continue
+			}
+
+			results = append(results, user)
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return fmt.Errorf("error listing Identity Store Users: %w", err)
+	}
+
+	if len(results) == 0 {
+		return fmt.Errorf("no Identity Store User found matching criteria; try different search")
+	}
+
+	if len(results) > 1 {
+		return fmt.Errorf("multiple Identity Store Users found matching criteria; try different search")
+	}
+
+	user := results[0]
+
+	d.SetId(aws.StringValue(user.UserId))
+	d.Set("user_id", user.UserId)
+	d.Set("user_name", user.UserName)
+
+	return nil
+}