Fix panic when trying to write an entity alias that already exists (#573

)

vault/resource_identity_entity_alias.go

@@ -63,6 +63,17 @@ func identityEntityAliasCreate(d *schema.ResourceData, meta interface{}) error {
 	if err != nil {
 		return fmt.Errorf("error writing IdentityEntityAlias to %q: %s", name, err)
 	}
+
+	if resp == nil {
+		aliasIDMsg := "Unable to determine alias id."
+
+		if aliasID, err := findAliasID(client, canonicalID, name, mountAccessor); err == nil {
+			aliasIDMsg = fmt.Sprintf("Alias resource ID %q may be imported.", aliasID)
+		}
+
+		return fmt.Errorf("IdentityEntityAlias %q already exists. %s", name, aliasIDMsg)
+	}
+
 	log.Printf("[DEBUG] Wrote IdentityEntityAlias %q", name)
 
 	d.SetId(resp.Data["id"].(string))
@@ -178,3 +189,24 @@ func identityEntityAliasNamePath(name string) string {
 func identityEntityAliasIDPath(id string) string {
 	return fmt.Sprintf("%s/id/%s", identityEntityAliasPath, id)
 }
+
+func findAliasID(client *api.Client, canonicalID, name, mountAccessor string) (string, error) {
+	path := identityEntityIDPath(canonicalID)
+
+	resp, err := client.Logical().Read(path)
+	if err != nil {
+		return "", fmt.Errorf("error reading entity aliases: %s", err)
+	}
+
+	if resp != nil {
+		aliases := resp.Data["aliases"].([]interface{})
+		for _, aliasRaw := range aliases {
+			alias := aliasRaw.(map[string]interface{})
+			if alias["name"] == name && alias["mount_accessor"] == mountAccessor {
+				return alias["id"].(string), nil
+			}
+		}
+	}
+
+	return "", fmt.Errorf("unable to determine alias ID. canonical ID: %q  name: %q  mountAccessor: %q", canonicalID, name, mountAccessor)
+}

vault/resource_identity_entity_alias_test.go

@@ -2,6 +2,7 @@ package vault
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
@@ -23,13 +24,17 @@ func TestAccIdentityEntityAlias(t *testing.T) {
 		CheckDestroy: testAccCheckIdentityEntityAliasDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccIdentityEntityAliasConfig(entity),
+				Config: testAccIdentityEntityAliasConfig(entity, false),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(nameEntityAlias, "name", entity),
 					resource.TestCheckResourceAttrPair(nameEntityAlias, "canonical_id", nameEntity, "id"),
 					resource.TestCheckResourceAttrPair(nameEntityAlias, "mount_accessor", nameGithubA, "accessor"),
 				),
 			},
+			{
+				Config:      testAccIdentityEntityAliasConfig(entity, true),
+				ExpectError: regexp.MustCompile(`IdentityEntityAlias.*already exists.*may be imported`),
+			},
 		},
 	})
 }
@@ -52,8 +57,8 @@ func testAccCheckIdentityEntityAliasDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccIdentityEntityAliasConfig(entityName string) string {
-	return fmt.Sprintf(`
+func testAccIdentityEntityAliasConfig(entityName string, dupeAlias bool) string {
+	ret := fmt.Sprintf(`
 resource "vault_identity_entity" "entity" {
   name = "%s"
   policies = ["test"]
@@ -73,5 +78,20 @@ resource "vault_identity_entity_alias" "entity-alias" {
   name = "%s"
   mount_accessor = "${vault_auth_backend.githubA.accessor}"
   canonical_id = "${vault_identity_entity.entity.id}"
-}`, entityName, entityName, entityName, entityName)
+}
+`, entityName, entityName, entityName, entityName)
+
+	// This duplicate alias tests the provider's handling of aliases that already exist but aren't
+	// known to the provider.
+	if dupeAlias {
+		ret += fmt.Sprintf(`
+resource "vault_identity_entity_alias" "entity-alias-dupe" {
+  name = "%s"
+  mount_accessor = "${vault_auth_backend.githubA.accessor}"
+  canonical_id = "${vault_identity_entity.entity.id}"
+}
+`, entityName)
+	}
+
+	return ret
 }