Skip to content

Commit f192017

Browse files
dominic-retli-hashidominic-retli-hashi
authored
Merge pull request #1842 from hashicorp/dominicretli/TF-28674/hyok-data-objects
[TF-28674] Add HYOK data sources for HYOKCustomerKeyVersion and HYOKEncryptedDataKey
2 parents c83b4ba + 8a2e80c commit f192017

9 files changed

+371
-0
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ FEATURES:
55
* **New resource**: `r/tfe_gcp_oidc_configuration` for managing GCP OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835)
66
* **New resource**: `r/tfe_azure_oidc_configuration` for managing Azure OIDC configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1835)
77
* **New resource**: `r/tfe_hyok_configuration` for managing HYOK configurations. [#1835](https://github.com/hashicorp/terraform-provider-tfe/pull/1841)
8+
* **New Data Source:** `d/hyok_customer_key_version` is a new data source for finding HYOK customer key versions by @dominicretli [#1842](https://github.com/hashicorp/terraform-provider-tfe/pull/1842)
9+
* **New Data Source:** `d/hyok_encrypted_data_key` is a new data source for finding HYOK encrypted data keys by @dominicretli [#1842](https://github.com/hashicorp/terraform-provider-tfe/pull/1842)
810

911
## v0.70.0
1012

‎docs/testing.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ these values with the environment variables specified below:
5151
1. `GITHUB_APP_INSTALLATION_NAME` - GitHub App installation name. Required for running tfe_github_app_installation data source test.
5252
1. `ENABLE_HYOK` - Set `ENABLE_HYOK=1` to enable HYOK-related tests.
5353
1. `HYOK_ORGANIZATION_NAME` - Name of an organization entitled to use HYOK. Required to run tests for HYOK resources and data sources.
54+
1. `HYOK_ENCRYPTED_DATA_KEY_ID` - HYOK encrypted data key id. Required for running hyok_encrypted_data_key data source test.
55+
1. `HYOK_CUSTOMER_KEY_VERSION_ID` - HYOK customer key version id. Required for running hyok_customer_key_version data source test.
5456

5557
**Note:** In order to run integration tests for **Paid** features you will need a token `TFE_TOKEN` with HCP Terraform or Terraform Enterprise administrator privileges, otherwise the attempt to upgrade an organization's feature set will fail.
5658

‎internal/provider/data_source_hyok_customer_key_version.go‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
// Copyright (c) HashiCorp, Inc.
2+
// SPDX-License-Identifier: MPL-2.0
3+
4+
package provider
5+
6+
import (
7+
"context"
8+
"fmt"
9+
"github.com/hashicorp/terraform-plugin-framework/datasource"
10+
"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
11+
"github.com/hashicorp/terraform-plugin-framework/types"
12+
"time"
13+
)
14+
15+
var (
16+
_ datasource.DataSource = &dataSourceHYOKCustomerKeyVersion{}
17+
_ datasource.DataSourceWithConfigure = &dataSourceHYOKCustomerKeyVersion{}
18+
)
19+
20+
func NewHYOKCustomerKeyVersionDataSource() datasource.DataSource {
21+
return &dataSourceHYOKCustomerKeyVersion{}
22+
}
23+
24+
type dataSourceHYOKCustomerKeyVersion struct {
25+
config ConfiguredClient
26+
}
27+
28+
type HYOKCustomerKeyVersionDataSourceModel struct {
29+
ID types.String `tfsdk:"id"`
30+
Status types.String `tfsdk:"status"`
31+
Error types.String `tfsdk:"error"`
32+
KeyVersion types.String `tfsdk:"key_version"`
33+
CreatedAt types.String `tfsdk:"created_at"`
34+
WorkspacesSecured types.Int64 `tfsdk:"workspaces_secured"`
35+
}
36+
37+
func (d *dataSourceHYOKCustomerKeyVersion) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
38+
if req.ProviderData == nil {
39+
return
40+
}
41+
42+
client, ok := req.ProviderData.(ConfiguredClient)
43+
if !ok {
44+
resp.Diagnostics.AddError(
45+
"Unexpected Data Source Configure Type",
46+
fmt.Sprintf("Expected tfe.ConfiguredClient, got %T. This is a bug in the tfe provider, so please report it on GitHub.", req.ProviderData),
47+
)
48+
49+
return
50+
}
51+
d.config = client
52+
}
53+
54+
func (d *dataSourceHYOKCustomerKeyVersion) Metadata(ctx context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
55+
resp.TypeName = req.ProviderTypeName + "_hyok_customer_key_version"
56+
}
57+
58+
func (d *dataSourceHYOKCustomerKeyVersion) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
59+
resp.Schema = schema.Schema{
60+
Description: "This data source can be used to retrieve a HYOK customer key version.",
61+
Attributes: map[string]schema.Attribute{
62+
"id": schema.StringAttribute{
63+
Description: "The ID of the HYOK customer key version.",
64+
Required: true,
65+
},
66+
"status": schema.StringAttribute{
67+
Description: "The status of the HYOK customer key version.",
68+
Computed: true,
69+
},
70+
"error": schema.StringAttribute{
71+
Description: "Any error message associated with the HYOK customer key version.",
72+
Computed: true,
73+
},
74+
"key_version": schema.StringAttribute{
75+
Description: "The version number of the customer key version.",
76+
Computed: true,
77+
},
78+
"workspaces_secured": schema.Int64Attribute{
79+
Description: "The number workspaces secured by this customer key version.",
80+
Computed: true,
81+
},
82+
"created_at": schema.StringAttribute{
83+
Description: "The timestamp when the key version was created.",
84+
Computed: true,
85+
},
86+
},
87+
}
88+
}
89+
90+
func (d *dataSourceHYOKCustomerKeyVersion) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
91+
var data HYOKCustomerKeyVersionDataSourceModel
92+
93+
// Read Terraform configuration data into the model
94+
resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
95+
if resp.Diagnostics.HasError() {
96+
return
97+
}
98+
99+
// Make API call to fetch the HYOK customer key version
100+
keyVersion, err := d.config.Client.HYOKCustomerKeyVersions.Read(ctx, data.ID.ValueString())
101+
if err != nil {
102+
resp.Diagnostics.AddError("Unable to read HYOK customer key version", err.Error())
103+
return
104+
}
105+
106+
// Set the computed attributes from the API response
107+
data.Status = types.StringValue(string(keyVersion.Status))
108+
data.KeyVersion = types.StringValue(keyVersion.KeyVersion)
109+
data.CreatedAt = types.StringValue(keyVersion.CreatedAt.Format(time.RFC3339))
110+
data.WorkspacesSecured = types.Int64Value(int64(keyVersion.WorkspacesSecured))
111+
data.Error = types.StringValue(keyVersion.Error)
112+
113+
// Save data into Terraform state
114+
resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
115+
}

‎internal/provider/data_source_hyok_customer_key_version_test.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package provider
2+
3+
import (
4+
"os"
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
)
9+
10+
func TestAccTFEHYOKCustomerKeyVersionDataSource_basic(t *testing.T) {
11+
hyokCustomerKeyVersionID := os.Getenv("HYOK_CUSTOMER_KEY_VERSION_ID")
12+
if hyokCustomerKeyVersionID == "" {
13+
t.Skip("HYOK_CUSTOMER_KEY_VERSION_ID environment variable must be set to run this test")
14+
}
15+
16+
resource.Test(t, resource.TestCase{
17+
PreCheck: func() { testAccPreCheck(t) },
18+
ProtoV6ProviderFactories: testAccMuxedProviders,
19+
Steps: []resource.TestStep{
20+
{
21+
Config: testAccTFEHYOKCustomerKeyVersionDataSourceConfig(hyokCustomerKeyVersionID),
22+
Check: resource.ComposeAggregateTestCheckFunc(
23+
resource.TestCheckResourceAttr("data.tfe_hyok_customer_key_version.test", "id", hyokCustomerKeyVersionID),
24+
resource.TestCheckResourceAttrSet("data.tfe_hyok_customer_key_version.test", "status"),
25+
resource.TestCheckResourceAttrSet("data.tfe_hyok_customer_key_version.test", "key_version"),
26+
resource.TestCheckResourceAttrSet("data.tfe_hyok_customer_key_version.test", "created_at"),
27+
resource.TestCheckResourceAttrSet("data.tfe_hyok_customer_key_version.test", "workspaces_secured"),
28+
),
29+
},
30+
},
31+
})
32+
}
33+
34+
func testAccTFEHYOKCustomerKeyVersionDataSourceConfig(id string) string {
35+
return `
36+
data "tfe_hyok_customer_key_version" "test" {
37+
id = "` + id + `"
38+
}
39+
`
40+
}

‎internal/provider/data_source_hyok_encrypted_data_key.go‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
// Copyright (c) HashiCorp, Inc.
2+
// SPDX-License-Identifier: MPL-2.0
3+
4+
package provider
5+
6+
import (
7+
"context"
8+
"fmt"
9+
"github.com/hashicorp/terraform-plugin-framework/datasource"
10+
"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
11+
"github.com/hashicorp/terraform-plugin-framework/types"
12+
"time"
13+
)
14+
15+
var (
16+
_ datasource.DataSource = &dataSourceHYOKEncryptedDataKey{}
17+
_ datasource.DataSourceWithConfigure = &dataSourceHYOKEncryptedDataKey{}
18+
)
19+
20+
func NewHYOKEncryptedDataKeyDataSource() datasource.DataSource {
21+
return &dataSourceHYOKEncryptedDataKey{}
22+
}
23+
24+
type dataSourceHYOKEncryptedDataKey struct {
25+
config ConfiguredClient
26+
}
27+
28+
type HYOKEncryptedDataKeyDataSourceModel struct {
29+
ID types.String `tfsdk:"id"`
30+
EncryptedDEK types.String `tfsdk:"encrypted_dek"`
31+
CustomerKeyName types.String `tfsdk:"customer_key_name"`
32+
CreatedAt types.String `tfsdk:"created_at"`
33+
}
34+
35+
func (d *dataSourceHYOKEncryptedDataKey) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
36+
if req.ProviderData == nil {
37+
return
38+
}
39+
40+
client, ok := req.ProviderData.(ConfiguredClient)
41+
if !ok {
42+
resp.Diagnostics.AddError(
43+
"Unexpected Data Source Configure Type",
44+
fmt.Sprintf("Expected tfe.ConfiguredClient, got %T. This is a bug in the tfe provider, so please report it on GitHub.", req.ProviderData),
45+
)
46+
47+
return
48+
}
49+
d.config = client
50+
}
51+
52+
func (d *dataSourceHYOKEncryptedDataKey) Metadata(ctx context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
53+
resp.TypeName = req.ProviderTypeName + "_hyok_encrypted_data_key"
54+
}
55+
56+
func (d *dataSourceHYOKEncryptedDataKey) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
57+
resp.Schema = schema.Schema{
58+
Description: "This data source can be used to retrieve a HYOK customer key version.",
59+
Attributes: map[string]schema.Attribute{
60+
"id": schema.StringAttribute{
61+
Description: "The ID of the HYOK encrypted data key.",
62+
Required: true,
63+
},
64+
"encrypted_dek": schema.StringAttribute{
65+
Description: "The encrypted data encryption key of the HYOK encrypted data key.",
66+
Computed: true,
67+
},
68+
"customer_key_name": schema.StringAttribute{
69+
Description: "The customer provided name of the HYOK encrypted data key.",
70+
Computed: true,
71+
},
72+
"created_at": schema.StringAttribute{
73+
Description: "The timestamp when the key version was created.",
74+
Computed: true,
75+
},
76+
},
77+
}
78+
}
79+
80+
func (d *dataSourceHYOKEncryptedDataKey) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
81+
var data HYOKEncryptedDataKeyDataSourceModel
82+
83+
// Read Terraform configuration data into the model
84+
resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
85+
if resp.Diagnostics.HasError() {
86+
return
87+
}
88+
89+
// Make API call to fetch the HYOK customer key version
90+
keyVersion, err := d.config.Client.HYOKEncryptedDataKeys.Read(ctx, data.ID.ValueString())
91+
if err != nil {
92+
resp.Diagnostics.AddError("Unable to read HYOK customer key version", err.Error())
93+
return
94+
}
95+
96+
// Set the computed attributes from the API response
97+
data.EncryptedDEK = types.StringValue(keyVersion.EncryptedDEK)
98+
data.CustomerKeyName = types.StringValue(keyVersion.CustomerKeyName)
99+
data.CreatedAt = types.StringValue(keyVersion.CreatedAt.Format(time.RFC3339))
100+
101+
// Save data into Terraform state
102+
resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
103+
}

‎internal/provider/data_source_hyok_encrypted_data_key_test.go‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package provider
2+
3+
import (
4+
"os"
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
)
9+
10+
func TestAccTFEHYOKEncryptedDataKeyDataSource_basic(t *testing.T) {
11+
hyokEncryptedDataKeyID := os.Getenv("HYOK_ENCRYPTED_DATA_KEY_ID")
12+
if hyokEncryptedDataKeyID == "" {
13+
t.Skip("HYOK_ENCRYPTED_DATA_KEY_ID environment variable must be set to run this test")
14+
}
15+
16+
resource.Test(t, resource.TestCase{
17+
PreCheck: func() { testAccPreCheck(t) },
18+
ProtoV6ProviderFactories: testAccMuxedProviders,
19+
Steps: []resource.TestStep{
20+
{
21+
Config: testAccTFEHYOKEncryptedDataKeyDataSourceConfig(hyokEncryptedDataKeyID),
22+
Check: resource.ComposeAggregateTestCheckFunc(
23+
resource.TestCheckResourceAttr("data.tfe_hyok_encrypted_data_key.test", "id", hyokEncryptedDataKeyID),
24+
resource.TestCheckResourceAttrSet("data.tfe_hyok_encrypted_data_key.test", "encrypted_dek"),
25+
resource.TestCheckResourceAttrSet("data.tfe_hyok_encrypted_data_key.test", "customer_key_name"),
26+
resource.TestCheckResourceAttrSet("data.tfe_hyok_encrypted_data_key.test", "created_at"),
27+
),
28+
},
29+
},
30+
})
31+
}
32+
33+
func testAccTFEHYOKEncryptedDataKeyDataSourceConfig(id string) string {
34+
return `
35+
data "tfe_hyok_encrypted_data_key" "test" {
36+
id = "` + id + `"
37+
}
38+
`
39+
}

‎internal/provider/provider_next.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,8 @@ func (p *frameworkProvider) Configure(ctx context.Context, req provider.Configur
130130

131131
func (p *frameworkProvider) DataSources(ctx context.Context) []func() datasource.DataSource {
132132
return []func() datasource.DataSource{
133+
NewHYOKCustomerKeyVersionDataSource,
134+
NewHYOKEncryptedDataKeyDataSource,
133135
NewNoCodeModuleDataSource,
134136
NewOrganizationRunTaskDataSource,
135137
NewOrganizationRunTaskGlobalSettingsDataSource,

‎website/docs/d/hyok_customer_key_version.markdown‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: "tfe"
3+
page_title: "Terraform Enterprise: tfe_hyok_customer_key_version"
4+
description: |-
5+
Get information on a HYOK customer key version.
6+
---
7+
8+
# Data Source: tfe_hyok_customer_key_version
9+
10+
Use this data source to get information about a Hold Your Own Keys (HYOK) customer key version.
11+
12+
## Example Usage
13+
14+
```hcl
15+
data "tfe_hyok_customer_key_version" "tfe_hyok_customer_key_version1" {
16+
id = "keyv-123"
17+
}
18+
```
19+
20+
## Argument Reference
21+
22+
The following arguments are supported:
23+
24+
* `id` - (Required) The ID of the HYOK customer key version.
25+
26+
## Attributes Reference
27+
28+
In addition to all arguments above, the following attributes are exported:
29+
30+
* `created_at` - The time when the customer key version was created.
31+
* `error` - Any error message associated with the customer key version.
32+
* `id` - The ID of the customer key version.
33+
* `key_version` - The version number of the customer key.
34+
* `status` - The status of the customer key version.
35+
* `workspaces_secured` - The number of workspaces securefd by this customer key version.

‎website/docs/d/hyok_encrypted_data_key.markdown‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
layout: "tfe"
3+
page_title: "Terraform Enterprise: tfe_hyok_encrypted_data_key"
4+
description: |-
5+
Get information on a HYOK encrypted data key.
6+
---
7+
8+
# Data Source: tfe_hyok_encrypted_data_key
9+
10+
Use this data source to get information about a Hold Your Own Keys (HYOK) encrypted data key.
11+
12+
## Example Usage
13+
14+
```hcl
15+
data "tfe_hyok_encrypted_data_key" "tfe_hyok_encrypted_data_key1" {
16+
id = "dek-123"
17+
}
18+
```
19+
20+
## Argument Reference
21+
22+
The following arguments are supported:
23+
24+
* `id` - (Required) The ID of the HYOK encrypted data key.
25+
26+
## Attributes Reference
27+
28+
In addition to all arguments above, the following attributes are exported:
29+
30+
* `created_at` - The time when the encrypted data key was created.
31+
* `customer_key_name` - The name of the customer key used to encrypt the data key.
32+
* `encrypted_dek` - The encrypted data encryption key (DEK).
33+
* `id` - The ID of the encrypted data key.

0 commit comments

Comments
 (0)