Add support to import terraform aws_iam_group_policy resources

aws/resource_aws_iam_group_policy.go

@@ -22,6 +22,10 @@ func resourceAwsIamGroupPolicy() *schema.Resource {
 		Read:   resourceAwsIamGroupPolicyRead,
 		Delete: resourceAwsIamGroupPolicyDelete,
 
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"policy": {
 				Type:     schema.TypeString,
@@ -78,14 +82,16 @@ func resourceAwsIamGroupPolicyPut(d *schema.ResourceData, meta interface{}) erro
 func resourceAwsIamGroupPolicyRead(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
-	group, name := resourceAwsIamGroupPolicyParseId(d.Id())
+	group, name, err := resourceAwsIamGroupPolicyParseId(d.Id())
+	if err != nil {
+		return err
+	}
 
 	request := &iam.GetGroupPolicyInput{
 		PolicyName: aws.String(name),
 		GroupName:  aws.String(group),
 	}
 
-	var err error
 	getResp, err := iamconn.GetGroupPolicy(request)
 	if err != nil {
 		if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
@@ -105,17 +111,28 @@ func resourceAwsIamGroupPolicyRead(d *schema.ResourceData, meta interface{}) err
 		return err
 	}
 
-	d.Set("group", group)
-	d.Set("name", name)
-	d.Set("policy", policy)
+	if err := d.Set("policy", policy); err != nil {
+		return fmt.Errorf("error setting policy: %s", err)
+	}
+
+	if err := d.Set("name", name); err != nil {
+		return fmt.Errorf("error setting name: %s", err)
+	}
+
+	if err := d.Set("group", group); err != nil {
+		return fmt.Errorf("error setting group: %s", err)
+	}
 
 	return nil
 }
 
 func resourceAwsIamGroupPolicyDelete(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
-	group, name := resourceAwsIamGroupPolicyParseId(d.Id())
+	group, name, err := resourceAwsIamGroupPolicyParseId(d.Id())
+	if err != nil {
+		return err
+	}
 
 	request := &iam.DeleteGroupPolicyInput{
 		PolicyName: aws.String(name),
@@ -131,8 +148,13 @@ func resourceAwsIamGroupPolicyDelete(d *schema.ResourceData, meta interface{}) e
 	return nil
 }
 
-func resourceAwsIamGroupPolicyParseId(id string) (groupName, policyName string) {
+func resourceAwsIamGroupPolicyParseId(id string) (groupName, policyName string, err error) {
 	parts := strings.SplitN(id, ":", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		err = fmt.Errorf("group_policy id must be of the form <group name>:<policy name>")
+		return
+	}
+
 	groupName = parts[0]
 	policyName = parts[1]
 	return

aws/resource_aws_iam_group_policy_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform/helper/acctest"
 	"github.com/hashicorp/terraform/helper/resource"
@@ -31,6 +30,11 @@ func TestAccAWSIAMGroupPolicy_basic(t *testing.T) {
 					),
 				),
 			},
+			{
+				ResourceName:      "aws_iam_group_policy.foo",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 			{
 				Config: testAccIAMGroupPolicyConfigUpdate(rInt),
 				Check: resource.ComposeTestCheckFunc(
@@ -42,6 +46,11 @@ func TestAccAWSIAMGroupPolicy_basic(t *testing.T) {
 					testAccCheckAWSIAMGroupPolicyNameChanged(&groupPolicy1, &groupPolicy2),
 				),
 			},
+			{
+				ResourceName:      "aws_iam_group_policy.bar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -101,6 +110,11 @@ func TestAccAWSIAMGroupPolicy_namePrefix(t *testing.T) {
 					testAccCheckAWSIAMGroupPolicyNameMatches(&groupPolicy1, &groupPolicy2),
 				),
 			},
+			{
+				ResourceName:      "aws_iam_group_policy.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -135,6 +149,11 @@ func TestAccAWSIAMGroupPolicy_generatedName(t *testing.T) {
 					testAccCheckAWSIAMGroupPolicyNameMatches(&groupPolicy1, &groupPolicy2),
 				),
 			},
+			{
+				ResourceName:      "aws_iam_group_policy.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -147,23 +166,28 @@ func testAccCheckIAMGroupPolicyDestroy(s *terraform.State) error {
 			continue
 		}
 
-		group, name := resourceAwsIamGroupPolicyParseId(rs.Primary.ID)
+		group, name, err := resourceAwsIamGroupPolicyParseId(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
 
 		request := &iam.GetGroupPolicyInput{
 			PolicyName: aws.String(name),
 			GroupName:  aws.String(group),
 		}
 
-		_, err := conn.GetGroupPolicy(request)
+		getResp, err := conn.GetGroupPolicy(request)
 		if err != nil {
-			// Verify the error is what we want
-			if ae, ok := err.(awserr.Error); ok && ae.Code() == "NoSuchEntity" {
+			if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+				// none found, that's good
 				continue
 			}
-			return err
+			return fmt.Errorf("Error reading IAM policy %s from group %s: %s", name, group, err)
 		}
 
-		return fmt.Errorf("still exists")
+		if getResp != nil {
+			return fmt.Errorf("Found IAM group policy, expected none: %s", getResp)
+		}
 	}
 
 	return nil
@@ -203,7 +227,11 @@ func testAccCheckIAMGroupPolicyExists(
 		}
 
 		iamconn := testAccProvider.Meta().(*AWSClient).iamconn
-		group, name := resourceAwsIamGroupPolicyParseId(policy.Primary.ID)
+		group, name, err := resourceAwsIamGroupPolicyParseId(policy.Primary.ID)
+		if err != nil {
+			return err
+		}
+
 		output, err := iamconn.GetGroupPolicy(&iam.GetGroupPolicyInput{
 			GroupName:  aws.String(group),
 			PolicyName: aws.String(name),

website/docs/r/iam_group_policy.html.markdown

@@ -56,3 +56,11 @@ assign a random, unique name.
 * `group` - The group to which this policy applies.
 * `name` - The name of the policy.
 * `policy` - The policy document attached to the group.
+
+## Import
+
+IAM Group Policies can be imported using the `group_name:group_policy_name`, e.g.
+
+```
+$ terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
+```