f-aws_directconnect_connection_macsec

.changelog/26274.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_dx_macsec_key
+```
+
+```release-note:enhancement
+resource/aws_dx_connection: Add arguments to enable MACsec support
+```

internal/provider/provider.go

@@ -1265,6 +1265,7 @@ func New(_ context.Context) (*schema.Provider, error) {
 			"aws_dx_hosted_transit_virtual_interface":          directconnect.ResourceHostedTransitVirtualInterface(),
 			"aws_dx_hosted_transit_virtual_interface_accepter": directconnect.ResourceHostedTransitVirtualInterfaceAccepter(),
 			"aws_dx_lag":                       directconnect.ResourceLag(),
+			"aws_dx_macsec_key":                directconnect.ResourceMacSecKey(),
 			"aws_dx_private_virtual_interface": directconnect.ResourcePrivateVirtualInterface(),
 			"aws_dx_public_virtual_interface":  directconnect.ResourcePublicVirtualInterface(),
 			"aws_dx_transit_virtual_interface": directconnect.ResourceTransitVirtualInterface(),

internal/service/directconnect/connection.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -40,6 +41,13 @@ func ResourceConnection() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: validConnectionBandWidth(),
 			},
+			// The MAC Security (MACsec) connection encryption mode.
+			"encryption_mode": {
+				Type:         schema.TypeString,
+				Computed:     true,
+				Optional:     true,
+				ValidateFunc: validation.StringInSlice([]string{"no_encrypt", "should_encrypt", "must_encrypt"}, false),
+			},
 			"has_logical_redundancy": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -53,6 +61,18 @@ func ResourceConnection() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
+			// Indicates whether the connection supports MAC Security (MACsec).
+			"macsec_capable": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+			// Enable or disable MAC Security (MACsec) on this connection.
+			"macsec_requested": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				ForceNew: true,
+			},
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -62,6 +82,11 @@ func ResourceConnection() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			// The MAC Security (MACsec) port link status of the connection.
+			"port_encryption_status": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"provider_name": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -86,6 +111,7 @@ func resourceConnectionCreate(d *schema.ResourceData, meta interface{}) error {
 		Bandwidth:      aws.String(d.Get("bandwidth").(string)),
 		ConnectionName: aws.String(name),
 		Location:       aws.String(d.Get("location").(string)),
+		RequestMACSec:  aws.Bool(d.Get("macsec_requested").(bool)),
 	}
 
 	if v, ok := d.GetOk("provider_name"); ok {
@@ -104,6 +130,7 @@ func resourceConnectionCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	d.SetId(aws.StringValue(output.ConnectionId))
+	d.Set("macsec_requested", d.Get("macsec_requested").(bool))
 
 	return resourceConnectionRead(d, meta)
 }
@@ -135,11 +162,14 @@ func resourceConnectionRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("arn", arn)
 	d.Set("aws_device", connection.AwsDeviceV2)
 	d.Set("bandwidth", connection.Bandwidth)
+	d.Set("encryption_mode", connection.EncryptionMode)
 	d.Set("has_logical_redundancy", connection.HasLogicalRedundancy)
 	d.Set("jumbo_frame_capable", connection.JumboFrameCapable)
 	d.Set("location", connection.Location)
+	d.Set("macsec_capable", connection.MacSecCapable)
 	d.Set("name", connection.ConnectionName)
 	d.Set("owner_account_id", connection.OwnerAccount)
+	d.Set("port_encryption_status", connection.PortEncryptionStatus)
 	d.Set("provider_name", connection.ProviderName)
 
 	tags, err := ListTags(conn, arn)
@@ -165,6 +195,19 @@ func resourceConnectionRead(d *schema.ResourceData, meta interface{}) error {
 func resourceConnectionUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).DirectConnectConn
 
+	// Update encryption mode
+	if d.HasChange("encryption_mode") {
+		input := &directconnect.UpdateConnectionInput{
+			ConnectionId:   aws.String(d.Id()),
+			EncryptionMode: aws.String(d.Get("encryption_mode").(string)),
+		}
+		log.Printf("[DEBUG] Modifying Direct Connect connection attributes: %s", input)
+		_, err := conn.UpdateConnection(input)
+		if err != nil {
+			return fmt.Errorf("error modifying Direct Connect connection (%s) attributes: %s", d.Id(), err)
+		}
+	}
+
 	arn := d.Get("arn").(string)
 	if d.HasChange("tags_all") {
 		o, n := d.GetChange("tags_all")

internal/service/directconnect/connection_test.go

@@ -72,6 +72,44 @@ func TestAccDirectConnectConnection_disappears(t *testing.T) {
 	})
 }
 
+func TestAccDirectConnectConnection_macsecRequested(t *testing.T) {
+	var connection directconnect.Connection
+	resourceName := "aws_dx_connection.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(t) },
+		ErrorCheck:               acctest.ErrorCheck(t, directconnect.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectionConfig_macsecEnabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionExists(resourceName, &connection),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "bandwidth", "100Gbps"),
+					resource.TestCheckResourceAttrSet(resourceName, "location"),
+					// macsec_capable will not return "true" while connection is in "Requesting" state
+					resource.TestCheckResourceAttr(resourceName, "macsec_capable", "false"),
+					resource.TestCheckResourceAttr(resourceName, "macsec_requested", "true"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "provider_name"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				// Ignore the "macsec_requested" attribute as isn't returned by the API during read/refresh
+				ImportStateVerifyIgnore: []string{"macsec_requested"},
+			},
+		},
+	})
+}
+
 func TestAccDirectConnectConnection_providerName(t *testing.T) {
 	var connection directconnect.Connection
 	resourceName := "aws_dx_connection.test"
@@ -221,6 +259,30 @@ resource "aws_dx_connection" "test" {
 `, rName)
 }
 
+func testAccConnectionConfig_macsecEnabled(rName string) string {
+	return fmt.Sprintf(`
+data "aws_dx_locations" "test" {}
+
+locals {
+  location_codes = tolist(data.aws_dx_locations.test.location_codes)
+  idx            = min(2, length(local.location_codes) - 1)
+}
+
+data "aws_dx_location" "test" {
+  location_code = local.location_codes[local.idx]
+}
+
+resource "aws_dx_connection" "test" {
+  name             = %[1]q
+  bandwidth        = "100Gbps"
+  location         = data.aws_dx_location.test.location_code
+  macsec_requested = true
+
+  provider_name = data.aws_dx_location.test.available_providers[0]
+}
+`, rName)
+}
+
 func testAccConnectionConfig_providerName(rName string) string {
 	return fmt.Sprintf(`
 data "aws_dx_locations" "test" {}

internal/service/directconnect/macsec_key.go

@@ -0,0 +1,173 @@
+package directconnect
+
+import (
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/directconnect"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+)
+
+func ResourceMacSecKey() *schema.Resource {
+	return &schema.Resource{
+		// MacSecKey resource only supports create (Associate), read (Describe) and delete (Disassociate)
+		Create: resourceMacSecKeyCreate,
+		Read:   resourceMacSecKeyRead,
+		// You cannot modify a MACsec secret key after you associate it with a connection.
+		// To modify the key, disassociate the key from the connection, and then associate
+		// a new key with the connection
+		Update: schema.Noop,
+		Delete: resourceMacSecKeyDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"cak": {
+				Type:     schema.TypeString,
+				Optional: true,
+				// CAK requires CKN
+				RequiredWith: []string{"ckn"},
+				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-fA-F0-9]{64}$`), "Must be 64-character hex code string"),
+			},
+			"ckn": {
+				Type:         schema.TypeString,
+				Computed:     true,
+				Optional:     true,
+				AtLeastOneOf: []string{"ckn", "secret_arn"},
+				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-fA-F0-9]{64}$`), "Must be 64-character hex code string"),
+			},
+			"connection_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"secret_arn": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				AtLeastOneOf: []string{"ckn", "secret_arn"},
+			},
+			"start_on": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"state": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceMacSecKeyCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).DirectConnectConn
+
+	input := &directconnect.AssociateMacSecKeyInput{
+		ConnectionId: aws.String(d.Get("connection_id").(string)),
+	}
+
+	if d.Get("ckn").(string) != "" {
+		input.Cak = aws.String(d.Get("cak").(string))
+		input.Ckn = aws.String(d.Get("ckn").(string))
+	}
+
+	if d.Get("secret_arn").(string) != "" {
+		input.SecretARN = aws.String(d.Get("secret_arn").(string))
+	}
+
+	log.Printf("[DEBUG] Creating MACSec secret key on Direct Connect Connection: %s", *input.ConnectionId)
+	output, err := conn.AssociateMacSecKey(input)
+
+	if err != nil {
+		return fmt.Errorf("error creating MACSec secret key on Direct Connect Connection (%s): %w", *input.ConnectionId, err)
+	}
+
+	secret_arn := MacSecKeyParseSecretARN(output)
+
+	// Create a composite ID based on connection ID and secret ARN
+	d.SetId(fmt.Sprintf("%s_%s", secret_arn, aws.StringValue(output.ConnectionId)))
+
+	d.Set("secret_arn", secret_arn)
+
+	return resourceMacSecKeyRead(d, meta)
+}
+
+func resourceMacSecKeyRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).DirectConnectConn
+
+	secretArn, connId, err := MacSecKeyParseID(d.Id())
+	if err != nil {
+		return fmt.Errorf("unexpected format of ID (%s), expected secretArn_connectionId", d.Id())
+	}
+
+	connection, err := FindConnectionByID(conn, connId)
+	if err != nil {
+		return fmt.Errorf("error reading Direct Connect Connection (%s): %w", d.Id(), err)
+	}
+
+	if connection.MacSecKeys == nil {
+		return fmt.Errorf("no MACSec keys found on Direct Connect Connection (%s)", d.Id())
+	}
+
+	for _, key := range connection.MacSecKeys {
+		if aws.StringValue(key.SecretARN) == aws.StringValue(&secretArn) {
+			d.Set("ckn", key.Ckn)
+			d.Set("connection_id", connId)
+			d.Set("secret_arn", key.SecretARN)
+			d.Set("start_on", key.StartOn)
+			d.Set("state", key.State)
+		}
+	}
+
+	return nil
+}
+
+func resourceMacSecKeyDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).DirectConnectConn
+
+	input := &directconnect.DisassociateMacSecKeyInput{
+		ConnectionId: aws.String(d.Get("connection_id").(string)),
+		SecretARN:    aws.String(d.Get("secret_arn").(string)),
+	}
+
+	log.Printf("[DEBUG] Disassociating MACSec secret key on Direct Connect Connection: %s", *input.ConnectionId)
+	_, err := conn.DisassociateMacSecKey(input)
+
+	if err != nil {
+		return fmt.Errorf("Unable to disassociate MACSec secret key on Direct Connect Connection (%s): %w", *input.ConnectionId, err)
+	}
+
+	return nil
+}
+
+// MacSecKeyParseSecretARN parses the secret ARN returned from a CMK or secret_arn
+func MacSecKeyParseSecretARN(output *directconnect.AssociateMacSecKeyOutput) string {
+	var result string
+
+	for _, key := range output.MacSecKeys {
+		if key == nil {
+			continue
+		}
+		if key != nil {
+			result = aws.StringValue(key.SecretARN)
+		}
+	}
+	return result
+}
+
+// MacSecKeyParseID parses the resource ID and returns the secret ARN and connection ID
+func MacSecKeyParseID(id string) (string, string, error) {
+	parts := strings.SplitN(id, "_", 2)
+
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", &resource.NotFoundError{}
+	}
+
+	return parts[0], parts[1], nil
+}