First draft of resource_tfe_aws_oidc_configuration.go

resource_tfe_aws_oidc_configuration.go and basic test

resource_tfe_gcp_oidc_configuration.go and test

resource_tfe_azure_oidc_configuration.go_oidc_configuration.go and test

resource_tfe_vault_oidc_configuration.go and tests

Add HYOK_ORGANIATION_NAME environment variable to testing.md

Add documentation for resources

Add to CHANGELOG.md

update basic usage in vault_oidc_configuration.html.markdown

Do not require replace for everything

Update documentation and default value of auth_path

skipIfEnterprise

update pricing info

Implement skipUnlessHYOKEnabled function

Author: helenjw

CHANGELOG.md

@@ -1,4 +1,9 @@
 ## Unreleased
+FEATURES:
+* **New resource**: `r/tfe_vault_oidc_configuration` for managing Vault OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835)
+* **New resource**: `r/tfe_aws_oidc_configuration` for managing AWS OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835)
+* **New resource**: `r/tfe_gcp_oidc_configuration` for managing GCP OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835)
+* **New resource**: `r/tfe_azure_oidc_configuration` for managing Azure OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835) 
 
 ## v0.69.0
 

docs/testing.md

@@ -49,6 +49,7 @@ these values with the environment variables specified below:
 1. `RUN_TASKS_HMAC` - The optional HMAC Key that should be used for Run Task operations. The default is no key.
 1. `GITHUB_APP_INSTALLATION_ID` - GitHub App installation internal id in the format `ghain-xxxxxxx`. Required for running any tests that use GitHub App VCS (workspace, policy sets, registry module).
 1. `GITHUB_APP_INSTALLATION_NAME` - GitHub App installation name. Required for running tfe_github_app_installation data source test.
+1. `HYOK_ORGANIZATION_NAME` - Name of an organization entitled to use HYOK. Required to run tests for HYOK resources and data sources.
 
 **Note:** In order to run integration tests for **Paid** features you will need a token `TFE_TOKEN` with HCP Terraform or Terraform Enterprise administrator privileges, otherwise the attempt to upgrade an organization's feature set will fail.
 

internal/provider/helper_test.go

@@ -18,6 +18,7 @@ import (
 
 const RunTasksURLEnvName = "RUN_TASKS_URL"
 const RunTasksHMACKeyEnvName = "RUN_TASKS_HMAC"
+const HYOKOrganizationNameEnvName = "HYOK_ORGANIZATION_NAME"
 
 type testClientOptions struct {
 	defaultOrganization          string
@@ -238,6 +239,14 @@ func skipUnlessBeta(t *testing.T) {
 	}
 }
 
+func skipUnlessHYOKEnabled(t *testing.T) {
+	skipIfEnterprise(t)
+
+	if value, ok := os.LookupEnv(HYOKOrganizationNameEnvName); !ok || value == "" {
+		t.Skipf("Skipping tests for HYOK. Set '%s' to enable tests.", HYOKOrganizationNameEnvName)
+	}
+}
+
 // Temporarily skip a test that may be experiencing API errors. This method
 // purposefully errors after the set date to remind contributors to remove this check
 // and verify that the API errors are no longer occurring.

internal/provider/provider_next.go

@@ -171,6 +171,10 @@ func (p *frameworkProvider) Resources(ctx context.Context) []func() resource.Res
 		NewTerraformVersionResource,
 		NewOPAVersionResource,
 		NewsentinelVersionResource,
+		NewAWSOIDCConfigurationResource,
+		NewGCPOIDCConfigurationResource,
+		NewAzureOIDCConfigurationResource,
+		NewVaultOIDCConfigurationResource,
 	}
 }
 

internal/provider/resource_tfe_aws_oidc_configuration.go

@@ -0,0 +1,203 @@
+// // Copyright (c) HashiCorp, Inc.
+// // SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+
+	tfe "github.com/hashicorp/go-tfe"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+)
+
+var (
+	_ resource.ResourceWithConfigure   = &resourceTFEAWSOIDCConfiguration{}
+	_ resource.ResourceWithImportState = &resourceTFEAWSOIDCConfiguration{}
+)
+
+func NewAWSOIDCConfigurationResource() resource.Resource {
+	return &resourceTFEAWSOIDCConfiguration{}
+}
+
+type resourceTFEAWSOIDCConfiguration struct {
+	config ConfiguredClient
+}
+
+type modelTFEAWSOIDCConfiguration struct {
+	ID           types.String `tfsdk:"id"`
+	RoleARN      types.String `tfsdk:"role_arn"`
+	Organization types.String `tfsdk:"organization"`
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	// Prevent panic if the provider has not been configured.
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(ConfiguredClient)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected resource Configure type",
+			fmt.Sprintf("Expected tfe.ConfiguredClient, got %T. This is a bug in the tfe provider, so please report it on GitHub.", req.ProviderData),
+		)
+	}
+	r.config = client
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_aws_oidc_configuration"
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Description: "The ID of the AWS OIDC configuration.",
+				Computed:    true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"role_arn": schema.StringAttribute{
+				Description: "The AWS ARN of your role.",
+				Required:    true,
+			},
+			"organization": schema.StringAttribute{
+				Description: "Name of the organization to which the TFE AWS OIDC configuration belongs.",
+				Optional:    true,
+				Computed:    true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+		},
+		Description: "Generates a new TFE AWS OIDC Configuration.",
+	}
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	// Read Terraform plan into the model
+	var plan modelTFEAWSOIDCConfiguration
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Get the organization name from resource or provider config
+	var orgName string
+	resp.Diagnostics.Append(r.config.dataOrDefaultOrganization(ctx, req.Config, &orgName)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	options := tfe.AWSOIDCConfigurationCreateOptions{
+		RoleARN: plan.RoleARN.ValueString(),
+	}
+
+	tflog.Debug(ctx, fmt.Sprintf("Create TFE AWS OIDC Configuration for organization %s", orgName))
+	oidc, err := r.config.Client.AWSOIDCConfigurations.Create(ctx, orgName, options)
+	if err != nil {
+		resp.Diagnostics.AddError("Error creating TFE AWS OIDC Configuration", err.Error())
+		return
+	}
+	result := modelFromTFEAWSOIDCConfiguration(oidc)
+	resp.Diagnostics.Append(resp.State.Set(ctx, result)...)
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	// Read Terraform state into the model
+	var state modelTFEAWSOIDCConfiguration
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	oidcID := state.ID.ValueString()
+	tflog.Debug(ctx, fmt.Sprintf("Read AWS OIDC configuration: %s", oidcID))
+	oidc, err := r.config.Client.AWSOIDCConfigurations.Read(ctx, state.ID.ValueString())
+	if err != nil {
+		if errors.Is(err, tfe.ErrResourceNotFound) {
+			tflog.Debug(ctx, fmt.Sprintf("AWS OIDC configuration %s no longer exists", oidcID))
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Error reading AWS OIDC configuration %s", oidcID),
+			err.Error(),
+		)
+		return
+	}
+	result := modelFromTFEAWSOIDCConfiguration(oidc)
+	resp.Diagnostics.Append(resp.State.Set(ctx, result)...)
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan modelTFEAWSOIDCConfiguration
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+
+	var state modelTFEAWSOIDCConfiguration
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	options := tfe.AWSOIDCConfigurationUpdateOptions{
+		RoleARN: plan.RoleARN.ValueString(),
+	}
+
+	oidcID := state.ID.ValueString()
+	tflog.Debug(ctx, fmt.Sprintf("Update TFE AWS OIDC Configuration %s", oidcID))
+	oidc, err := r.config.Client.AWSOIDCConfigurations.Update(ctx, oidcID, options)
+	if err != nil {
+		resp.Diagnostics.AddError("Error updating TFE AWS OIDC Configuration", err.Error())
+		return
+	}
+
+	result := modelFromTFEAWSOIDCConfiguration(oidc)
+	resp.Diagnostics.Append(resp.State.Set(ctx, result)...)
+}
+
+func (r *resourceTFEAWSOIDCConfiguration) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state modelTFEAWSOIDCConfiguration
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	oidcID := state.ID.ValueString()
+	tflog.Debug(ctx, fmt.Sprintf("Delete TFE AWS OIDC configuration: %s", oidcID))
+	err := r.config.Client.AWSOIDCConfigurations.Delete(ctx, oidcID)
+	if err != nil {
+		if errors.Is(err, tfe.ErrResourceNotFound) {
+			tflog.Debug(ctx, fmt.Sprintf("TFE AWS OIDC configuration %s no longer exists", oidcID))
+		}
+
+		resp.Diagnostics.AddError("Error deleting TFE AWS OIDC Configuration", err.Error())
+		return
+	}
+}
+
+func modelFromTFEAWSOIDCConfiguration(p *tfe.AWSOIDCConfiguration) modelTFEAWSOIDCConfiguration {
+	return modelTFEAWSOIDCConfiguration{
+		ID:           types.StringValue(p.ID),
+		RoleARN:      types.StringValue(p.RoleARN),
+		Organization: types.StringValue(p.Organization.Name),
+	}
+}

internal/provider/resource_tfe_aws_oidc_configuration_test.go

@@ -0,0 +1,76 @@
+package provider
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+)
+
+func TestAccTFEAWSOIDCConfiguration_basic(t *testing.T) {
+	skipUnlessHYOKEnabled(t)
+
+	orgName := os.Getenv("HYOK_ORGANIZATION_NAME")
+
+	originalRoleARN := "arn:aws:iam::123456789012:role/terraform-provider-tfe-example-1"
+	newRoleARN := "arn:aws:iam::123456789012:role/terraform-provider-tfe-example-2"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccMuxedProviders,
+		CheckDestroy:             testAccCheckTFEAWSOIDCConfigurationDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTFEAWSOIDCConfigurationConfig(orgName, originalRoleARN),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet("tfe_aws_oidc_configuration.test", "id"),
+					resource.TestCheckResourceAttr("tfe_aws_oidc_configuration.test", "role_arn", originalRoleARN),
+				),
+			},
+			// Import
+			{
+				ResourceName:      "tfe_aws_oidc_configuration.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Update role ARN
+			{
+				Config: testAccTFEAWSOIDCConfigurationConfig(orgName, newRoleARN),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet("tfe_aws_oidc_configuration.test", "id"),
+					resource.TestCheckResourceAttr("tfe_aws_oidc_configuration.test", "role_arn", newRoleARN),
+				),
+			},
+		},
+	})
+}
+
+func testAccTFEAWSOIDCConfigurationConfig(orgName string, roleARN string) string {
+	return fmt.Sprintf(`
+resource "tfe_aws_oidc_configuration" "test" {
+	role_arn    = "%s"
+	organization = "%s"
+}
+`, roleARN, orgName)
+}
+
+func testAccCheckTFEAWSOIDCConfigurationDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "tfe_aws_oidc_configuration" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("no instance ID is set")
+		}
+
+		_, err := testAccConfiguredClient.Client.AWSOIDCConfigurations.Read(ctx, rs.Primary.ID)
+		if err == nil {
+			return fmt.Errorf("TFE AWS OIDC Configuration %s still exists", rs.Primary.ID)
+		}
+	}
+
+	return nil
+}