F/aws ebs snapshot

aws/resource_aws_cloudformation_stack_set.go

@@ -63,6 +63,12 @@ func resourceAwsCloudFormationStackSet() *schema.Resource {
 					},
 				},
 			},
+			"call_as": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      cloudformation.CallAsSelf,
+				ValidateFunc: validation.StringInSlice(cloudformation.CallAs_Values(), false),
+			},
 			"capabilities": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -147,6 +153,10 @@ func resourceAwsCloudFormationStackSetCreate(d *schema.ResourceData, meta interf
 		input.AutoDeployment = expandAutoDeployment(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("call_as"); ok {
+		input.CallAs = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = expandStringSet(v.(*schema.Set))
 	}
@@ -273,6 +283,10 @@ func resourceAwsCloudFormationStackSetUpdate(d *schema.ResourceData, meta interf
 		input.AdministrationRoleARN = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("call_as"); ok {
+		input.CallAs = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = expandStringSet(v.(*schema.Set))
 	}

aws/resource_aws_ebs_snapshot.go

@@ -69,6 +69,10 @@ func resourceAwsEbsSnapshot() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"outpost_arn": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 			"tags":     tagsSchema(),
 			"tags_all": tagsSchemaComputed(),
 		},
@@ -88,6 +92,10 @@ func resourceAwsEbsSnapshotCreate(d *schema.ResourceData, meta interface{}) erro
 		request.Description = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("outpost_arn"); ok {
+		request.OutpostArn = aws.String(v.(string))
+	}
+
 	var res *ec2.Snapshot
 	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
 		var err error
@@ -151,6 +159,7 @@ func resourceAwsEbsSnapshotRead(d *schema.ResourceData, meta interface{}) error
 	d.Set("encrypted", snapshot.Encrypted)
 	d.Set("owner_alias", snapshot.OwnerAlias)
 	d.Set("volume_id", snapshot.VolumeId)
+	d.Set("outpost_arn", snapshot.OutpostArn)
 	d.Set("data_encryption_key_id", snapshot.DataEncryptionKeyId)
 	d.Set("kms_key_id", snapshot.KmsKeyId)
 	d.Set("volume_size", snapshot.VolumeSize)

aws/resource_aws_ebs_snapshot_test.go

@@ -164,6 +164,34 @@ func TestAccAWSEBSSnapshot_disappears(t *testing.T) {
 	})
 }
 
+func TestAccAWSEBSSnapshot_Outpost(t *testing.T) {
+	var v ec2.Snapshot
+	rName := fmt.Sprintf("tf-acc-ebs-snapshot-desc-%s", acctest.RandString(7))
+	outpostDataSourceName := "data.aws_outposts_outpost.test"
+	resourceName := "aws_ebs_snapshot.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccPreCheckAWSOutpostsOutposts(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEbsSnapshotDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsEbsSnapshotConfigOutpost(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotExists(resourceName, &v),
+					testAccMatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`snapshot/snap-.+`)),
+					resource.TestCheckResourceAttrPair(resourceName, "outpost_arn", outpostDataSourceName, "arn"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckSnapshotExists(n string, v *ec2.Snapshot) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -372,3 +400,36 @@ resource "aws_ebs_snapshot" "test" {
 }
 `, rName)
 }
+
+func testAccAwsEbsSnapshotConfigOutpost(rName string) string {
+	return fmt.Sprintf(`
+data "aws_availability_zones" "available" {
+  state = "available"
+
+  filter {
+    name   = "opt-in-status"
+    values = ["opt-in-not-required"]
+  }
+}
+
+data "aws_outposts_outposts" "test" {}
+
+data "aws_outposts_outpost" "test" {
+  id = tolist(data.aws_outposts_outposts.test.ids)[0]
+}
+
+resource "aws_ebs_volume" "description_test" {
+  availability_zone = data.aws_availability_zones.available.names[0]
+  size              = 1
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ebs_snapshot" "test" {
+  volume_id   = aws_ebs_volume.description_test.id
+  outpost_arn = data.aws_outposts_outpost.test.arn
+}
+`, rName)
+}

aws/resource_aws_ebs_volume.go

@@ -418,7 +418,7 @@ func resourceAwsEbsVolumeCustomizeDiff(_ context.Context, diff *schema.ResourceD
 		}
 
 		// MultiAttachEnabled is supported with io1 volumes only.
-		if multiAttachEnabled && volumeType != ec2.VolumeTypeIo1 {
+		if multiAttachEnabled && volumeType != ec2.VolumeTypeIo1 && volumeType != ec2.VolumeTypeIo2 {
 			return fmt.Errorf("'multi_attach_enabled' must not be set when 'type' is '%s'", volumeType)
 		}
 

aws/resource_aws_ebs_volume_test.go

@@ -401,7 +401,7 @@ func TestAccAWSEBSVolume_withTags(t *testing.T) {
 	})
 }
 
-func TestAccAWSEBSVolume_multiAttach(t *testing.T) {
+func TestAccAWSEBSVolume_multiAttachIo1(t *testing.T) {
 	var v ec2.Volume
 	resourceName := "aws_ebs_volume.test"
 	rName := acctest.RandomWithPrefix("tf-acc-test")
@@ -413,7 +413,35 @@ func TestAccAWSEBSVolume_multiAttach(t *testing.T) {
 		CheckDestroy: testAccCheckVolumeDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAwsEbsVolumeConfigMultiAttach(rName),
+				Config: testAccAwsEbsVolumeConfigMultiAttach(rName, "io1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVolumeExists(resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "multi_attach_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "throughput", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccAWSEBSVolume_multiAttachIo2(t *testing.T) {
+	var v ec2.Volume
+	resourceName := "aws_ebs_volume.test"
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheckSkipEBSVolume(t),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckVolumeDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsEbsVolumeConfigMultiAttach(rName, "io2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "multi_attach_enabled", "true"),
@@ -1237,7 +1265,7 @@ resource "aws_ebs_volume" "test" {
 `
 }
 
-func testAccAwsEbsVolumeConfigMultiAttach(rName string) string {
+func testAccAwsEbsVolumeConfigMultiAttach(rName string, volume_type string) string {
 	return fmt.Sprintf(`
 data "aws_availability_zones" "available" {
   state = "available"
@@ -1250,7 +1278,7 @@ data "aws_availability_zones" "available" {
 
 resource "aws_ebs_volume" "test" {
   availability_zone    = data.aws_availability_zones.available.names[0]
-  type                 = "io1"
+  type                 = %[2]q
   multi_attach_enabled = true
   size                 = 4
   iops                 = 100
@@ -1259,7 +1287,7 @@ resource "aws_ebs_volume" "test" {
     Name = %[1]q
   }
 }
-`, rName)
+`, rName, volume_type)
 }
 
 func testAccAwsEbsVolumeConfigSizeTypeIopsThroughput(rName, size, volumeType, iops, throughput string) string {

aws/resource_aws_securityhub_member_test.go

@@ -23,7 +23,7 @@ func testAccAWSSecurityHubMember_basic(t *testing.T) {
 		CheckDestroy: testAccCheckAWSSecurityHubMemberDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSSecurityHubMemberConfig_basic("111111111111", testAccDefaultEmailAddress),
+				Config: testAccAWSSecurityHubMemberConfig_basic("111111111111", "[email protected]"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSecurityHubMemberExists(resourceName, &member),
 				),
@@ -48,7 +48,7 @@ func testAccAWSSecurityHubMember_invite(t *testing.T) {
 		CheckDestroy: testAccCheckAWSSecurityHubMemberDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSSecurityHubMemberConfig_invite("111111111111", testAccDefaultEmailAddress, true),
+				Config: testAccAWSSecurityHubMemberConfig_invite("111111111111", "[email protected]", true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSecurityHubMemberExists(resourceName, &member),
 					resource.TestCheckResourceAttr(resourceName, "member_status", "Invited"),
@@ -131,8 +131,8 @@ resource "aws_securityhub_account" "example" {}
 
 resource "aws_securityhub_member" "example" {
   depends_on = [aws_securityhub_account.example]
-  account_id = %[1]q
-  email      = %[2]q
+  account_id = "%s"
+  email      = "%s"
 }
 `, accountId, email)
 }
@@ -143,9 +143,9 @@ resource "aws_securityhub_account" "example" {}
 
 resource "aws_securityhub_member" "example" {
   depends_on = [aws_securityhub_account.example]
-  account_id = %[1]q
-  email      = %[2]q
-  invite     = %[3]t
+  account_id = "%s"
+  email      = "%s"
+  invite     = %t
 }
 `, accountId, email, invite)
 }

website/docs/r/autoscaling_group.html.markdown

@@ -393,7 +393,7 @@ Note that if you suspend either the `Launch` or `Terminate` process types, it ca
    Auto Scaling Group will not select instances with this setting for termination
    during scale in events.
 * `service_linked_role_arn` (Optional) The ARN of the service-linked role that the ASG will use to call other AWS services
-* `max_instance_lifetime` (Optional) The maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 604800 and 31536000 seconds.
+* `max_instance_lifetime` (Optional) The maximum amount of time, in seconds, that an instance can be in service. Values must be either equal to 0 or between 86400 and 31536000 seconds (inclusive). A value of 0 is used to remove a previously set value.
 * `instance_refresh` - (Optional) If this block is configured, start an
    [Instance Refresh](https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html)
    when this Auto Scaling Group is updated. Defined [below](#instance_refresh).

website/docs/r/cloudformation_stack_set.html.markdown

@@ -90,6 +90,7 @@ The following arguments are supported:
     * `enabled` - (Optional) Whether or not auto-deployment is enabled.
     * `retain_stacks_on_account_removal` - (Optional) Whether or not to retain stacks when the account is removed.
 * `name` - (Required) Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
+* `call_as` - (Optional) Describes whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF`, `DELEGATED_ADMIN`. Default: `SELF`.
 * `capabilities` - (Optional) A list of capabilities. Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_AUTO_EXPAND`.
 * `description` - (Optional) Description of the StackSet.
 * `execution_role_name` - (Optional) Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.

website/docs/r/ebs_volume.html.markdown

@@ -32,7 +32,7 @@ The following arguments are supported:
 * `availability_zone` - (Required) The AZ where the EBS volume will exist.
 * `encrypted` - (Optional) If true, the disk will be encrypted.
 * `iops` - (Optional) The amount of IOPS to provision for the disk. Only valid for `type` of `io1`, `io2` or `gp3`.
-* `multi_attach_enabled` - (Optional) Specifies whether to enable Amazon EBS Multi-Attach. Multi-Attach is supported exclusively on `io1` volumes.
+* `multi_attach_enabled` - (Optional) Specifies whether to enable Amazon EBS Multi-Attach. Multi-Attach is supported exclusively on `io1` & `io2` volumes.
 * `size` - (Optional) The size of the drive in GiBs.
 * `snapshot_id` (Optional) A snapshot to base the EBS volume off of.
 * `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the Outpost.

website/docs/r/launch_template.html.markdown

@@ -271,7 +271,7 @@ The metadata options for the instances.
 
 The `metadata_options` block supports the following:
 
-* `http_endpoint` - (Optional) Whether the metadata service is available. Can be `"enabled"` or `"disabled"`. (Default: `"enabled"`).
+* `http_endpoint` - (Required) Whether the metadata service is available. Can be `"enabled"` or `"disabled"`.
 * `http_tokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Can be `"optional"` or `"required"`. (Default: `"optional"`).
 * `http_put_response_hop_limit` - (Optional) The desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Can be an integer from `1` to `64`. (Default: `1`).