r/sagemaker_model_package_group_policy - new resource

.changelog/21250.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_sagemaker_model_package_group_policy
+```

aws/internal/service/sagemaker/finder/finder.go

@@ -49,6 +49,32 @@ func ModelPackageGroupByName(conn *sagemaker.SageMaker, name string) (*sagemaker
 	return output, nil
 }
 
+func ModelPackageGroupPolicyByName(conn *sagemaker.SageMaker, name string) (*sagemaker.GetModelPackageGroupPolicyOutput, error) {
+	input := &sagemaker.GetModelPackageGroupPolicyInput{
+		ModelPackageGroupName: aws.String(name),
+	}
+
+	output, err := conn.GetModelPackageGroupPolicy(input)
+
+	if tfawserr.ErrMessageContains(err, tfsagemaker.ErrCodeValidationException, "Cannot find Model Package Group") ||
+		tfawserr.ErrMessageContains(err, tfsagemaker.ErrCodeValidationException, "Cannot find resource policy") {
+		return nil, &resource.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 // ImageByName returns the Image corresponding to the specified name.
 // Returns nil if no Image is found.
 func ImageByName(conn *sagemaker.SageMaker, name string) (*sagemaker.DescribeImageOutput, error) {

aws/provider.go

@@ -1072,6 +1072,7 @@ func Provider() *schema.Provider {
 			"aws_sagemaker_human_task_ui":                             resourceAwsSagemakerHumanTaskUi(),
 			"aws_sagemaker_model":                                     resourceAwsSagemakerModel(),
 			"aws_sagemaker_model_package_group":                       resourceAwsSagemakerModelPackageGroup(),
+			"aws_sagemaker_model_package_group_policy":                resourceAwsSagemakerModelPackageGroupPolicy(),
 			"aws_sagemaker_notebook_instance_lifecycle_configuration": resourceAwsSagemakerNotebookInstanceLifeCycleConfiguration(),
 			"aws_sagemaker_notebook_instance":                         resourceAwsSagemakerNotebookInstance(),
 			"aws_sagemaker_studio_lifecycle_config":                   resourceAwsSagemakerStudioLifecycleConfig(),

aws/resource_aws_sagemaker_model_package_group_policy.go

@@ -0,0 +1,98 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	tfsagemaker "github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/tfresource"
+)
+
+func resourceAwsSagemakerModelPackageGroupPolicy() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSagemakerModelPackageGroupPolicyPut,
+		Read:   resourceAwsSagemakerModelPackageGroupPolicyRead,
+		Update: resourceAwsSagemakerModelPackageGroupPolicyPut,
+		Delete: resourceAwsSagemakerModelPackageGroupPolicyDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"model_package_group_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"resource_policy": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateFunc:     validation.StringIsJSON,
+				DiffSuppressFunc: suppressEquivalentAwsPolicyDiffs,
+			},
+		},
+	}
+}
+
+func resourceAwsSagemakerModelPackageGroupPolicyPut(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	name := d.Get("model_package_group_name").(string)
+	input := &sagemaker.PutModelPackageGroupPolicyInput{
+		ModelPackageGroupName: aws.String(name),
+		ResourcePolicy:        aws.String(d.Get("resource_policy").(string)),
+	}
+
+	_, err := conn.PutModelPackageGroupPolicy(input)
+	if err != nil {
+		return fmt.Errorf("error creating SageMaker Model Package Group Policy %s: %w", name, err)
+	}
+
+	d.SetId(name)
+
+	return resourceAwsSagemakerModelPackageGroupPolicyRead(d, meta)
+}
+
+func resourceAwsSagemakerModelPackageGroupPolicyRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	mpg, err := finder.ModelPackageGroupPolicyByName(conn, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Unable to find SageMaker Model Package Group Policy (%s); removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error reading SageMaker Model Package Group Policy (%s): %w", d.Id(), err)
+	}
+
+	d.Set("model_package_group_name", d.Id())
+	d.Set("resource_policy", mpg.ResourcePolicy)
+
+	return nil
+}
+
+func resourceAwsSagemakerModelPackageGroupPolicyDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	input := &sagemaker.DeleteModelPackageGroupPolicyInput{
+		ModelPackageGroupName: aws.String(d.Id()),
+	}
+
+	if _, err := conn.DeleteModelPackageGroupPolicy(input); err != nil {
+		if tfawserr.ErrMessageContains(err, tfsagemaker.ErrCodeValidationException, "Cannot find Model Package Group") ||
+			tfawserr.ErrMessageContains(err, tfsagemaker.ErrCodeValidationException, "Cannot find resource policy") {
+			return nil
+		}
+		return fmt.Errorf("error deleting SageMaker Model Package Group Policy (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}

aws/resource_aws_sagemaker_model_package_group_policy_test.go

@@ -0,0 +1,159 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/tfresource"
+)
+
+func TestAccAWSSagemakerModelPackageGroupPolicy_basic(t *testing.T) {
+	var mpg sagemaker.GetModelPackageGroupPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_model_package_group_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerModelPackageGroupPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerModelPackageGroupPolicyBasicConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerModelPackageGroupPolicyExists(resourceName, &mpg),
+					resource.TestCheckResourceAttr(resourceName, "model_package_group_name", rName),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccAWSSagemakerModelPackageGroupPolicy_disappears(t *testing.T) {
+	var mpg sagemaker.GetModelPackageGroupPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_model_package_group_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerModelPackageGroupPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerModelPackageGroupPolicyBasicConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerModelPackageGroupPolicyExists(resourceName, &mpg),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerModelPackageGroupPolicy(), resourceName),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerModelPackageGroupPolicy(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccAWSSagemakerModelPackageGroupPolicy_disappears_modelPackageGroup(t *testing.T) {
+	var mpg sagemaker.GetModelPackageGroupPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_model_package_group_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerModelPackageGroupPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerModelPackageGroupPolicyBasicConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerModelPackageGroupPolicyExists(resourceName, &mpg),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerModelPackageGroup(), "aws_sagemaker_model_package_group.test"),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerModelPackageGroupPolicy(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSagemakerModelPackageGroupPolicyDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).sagemakerconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sagemaker_model_package_group_policy" {
+			continue
+		}
+
+		_, err := finder.ModelPackageGroupPolicyByName(conn, rs.Primary.ID)
+		if tfresource.NotFound(err) {
+			continue
+		}
+
+		if err != nil {
+			return fmt.Errorf("error reading Sagemaker Model Package Group Policy (%s): %w", rs.Primary.ID, err)
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSagemakerModelPackageGroupPolicyExists(n string, mpg *sagemaker.GetModelPackageGroupPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No sagmaker Model Package Group ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).sagemakerconn
+		resp, err := finder.ModelPackageGroupPolicyByName(conn, rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		*mpg = *resp
+
+		return nil
+	}
+}
+
+func testAccAWSSagemakerModelPackageGroupPolicyBasicConfig(rName string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    sid       = "AddPermModelPackageGroup"
+    actions   = ["sagemaker:DescribeModelPackage", "sagemaker:ListModelPackages"]
+    resources = [aws_sagemaker_model_package_group.test.arn]
+    principals {
+      identifiers = [data.aws_caller_identity.current.account_id]
+      type        = "AWS"
+    }
+  }
+}
+
+resource "aws_sagemaker_model_package_group" "test" {
+  model_package_group_name = %[1]q
+}
+
+resource "aws_sagemaker_model_package_group_policy" "test" {
+  model_package_group_name = aws_sagemaker_model_package_group.test.model_package_group_name
+  resource_policy          = jsonencode(jsondecode(data.aws_iam_policy_document.test.json))
+}
+`, rName)
+}

website/docs/r/sagemaker_model_package_group_policy.html.markdown

@@ -0,0 +1,61 @@
+---
+subcategory: "Sagemaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model_package_group_policy"
+description: |-
+  Provides a Sagemaker Model Package Group Policy resource.
+---
+
+# Resource: aws_sagemaker_model_package_group_policy
+
+Provides a Sagemaker Model Package Group Policy resource.
+
+## Example Usage
+
+### Basic usage
+
+```terraform
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_policy_document" "example" {
+  statement {
+    sid       = "AddPermModelPackageGroup"
+    actions   = ["sagemaker:DescribeModelPackage", "sagemaker:ListModelPackages"]
+    resources = [aws_sagemaker_model_package_group.example.arn]
+    principals {
+      identifiers = [data.aws_caller_identity.current.account_id]
+      type        = "AWS"
+    }
+  }
+}
+
+resource "aws_sagemaker_model_package_group" "example" {
+  model_package_group_name = "example"
+}
+
+resource "aws_sagemaker_model_package_group_policy" "example" {
+  model_package_group_name = aws_sagemaker_model_package_group.example.model_package_group_name
+  resource_policy          = jsonencode(jsondecode(data.aws_iam_policy_document.example.json))
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `model_package_group_name` - (Required) The name of the model package group.
+
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The name of the Model Package Package Group.
+
+## Import
+
+Sagemaker Code Model Package Groups can be imported using the `name`, e.g.
+
+```
+$ terraform import aws_sagemaker_model_package_group_policy.example example
+```