Skip to content

Commit 080d3b2

Browse files
coderGo93Edgar López
coderGo93
and
Edgar López
authored
INTMDB-162: Fixes bug about detecting changes and make sensitive values (#383)
* fix: fixes about when appearing changes when it should not and make parameters sensitives * test: deleted check because parameters are now sensitive and cannot be read to avoid fail test * fix: added validation to avoid changes or other similar bug for other parameters * test: uncommented the skip part Co-authored-by: Edgar López <[email protected]>
1 parent da751dc commit 080d3b2

File tree

2 files changed

+98
-95
lines changed

2 files changed

+98
-95
lines changed

‎mongodbatlas/resource_mongodbatlas_encryption_at_rest.go‎

Lines changed: 98 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,9 @@ func resourceMongoDBAtlasEncryptionAtRest() *schema.Resource {
3333
ForceNew: true,
3434
},
3535
"aws_kms": {
36-
Type: schema.TypeMap,
37-
Optional: true,
36+
Type: schema.TypeMap,
37+
Optional: true,
38+
Sensitive: true,
3839
Elem: &schema.Resource{
3940
Schema: map[string]*schema.Schema{
4041
"enabled": {
@@ -82,8 +83,9 @@ func resourceMongoDBAtlasEncryptionAtRest() *schema.Resource {
8283
},
8384
},
8485
"azure_key_vault": {
85-
Type: schema.TypeMap,
86-
Optional: true,
86+
Type: schema.TypeMap,
87+
Optional: true,
88+
Sensitive: true,
8789
Elem: &schema.Resource{
8890
Schema: map[string]*schema.Schema{
8991
"enabled": {
@@ -92,61 +94,62 @@ func resourceMongoDBAtlasEncryptionAtRest() *schema.Resource {
9294
},
9395
"client_id": {
9496
Type: schema.TypeString,
95-
Required: true,
97+
Optional: true,
9698
Sensitive: true,
9799
},
98100
"azure_environment": {
99101
Type: schema.TypeString,
100-
Required: true,
102+
Optional: true,
101103
},
102104
"subscription_id": {
103105
Type: schema.TypeString,
104-
Required: true,
106+
Optional: true,
105107
Sensitive: true,
106108
},
107109
"resource_group_name": {
108110
Type: schema.TypeString,
109-
Required: true,
111+
Optional: true,
110112
},
111113
"key_vault_name": {
112114
Type: schema.TypeString,
113-
Required: true,
115+
Optional: true,
114116
},
115117
"key_identifier": {
116118
Type: schema.TypeString,
117-
Required: true,
119+
Optional: true,
118120
Sensitive: true,
119121
},
120122
"secret": {
121123
Type: schema.TypeString,
122-
Required: true,
124+
Optional: true,
123125
Sensitive: true,
124126
},
125127
"tenant_id": {
126128
Type: schema.TypeString,
127-
Required: true,
129+
Optional: true,
128130
Sensitive: true,
129131
},
130132
},
131133
},
132134
},
133135
"google_cloud_kms": {
134-
Type: schema.TypeMap,
135-
Optional: true,
136+
Type: schema.TypeMap,
137+
Optional: true,
138+
Sensitive: true,
136139
Elem: &schema.Resource{
137140
Schema: map[string]*schema.Schema{
138141
"enabled": {
139142
Type: schema.TypeBool,
140-
Required: true,
143+
Optional: true,
141144
},
142145
"service_account_key": {
143146
Type: schema.TypeString,
144-
Required: true,
147+
Optional: true,
145148
Sensitive: true,
146149
},
147150
"key_version_resource_id": {
148151
Type: schema.TypeString,
149-
Required: true,
152+
Optional: true,
150153
Sensitive: true,
151154
},
152155
},
@@ -160,10 +163,20 @@ func resourceMongoDBAtlasEncryptionAtRestCreate(d *schema.ResourceData, meta int
160163
conn := meta.(*matlas.Client)
161164

162165
encryptionAtRestReq := &matlas.EncryptionAtRest{
163-
GroupID: d.Get("project_id").(string),
164-
AwsKms: expandAwsKms(d.Get("aws_kms").(map[string]interface{})),
165-
AzureKeyVault: expandAzureKeyVault(d.Get("azure_key_vault").(map[string]interface{})),
166-
GoogleCloudKms: expandGCPKms(d.Get("google_cloud_kms").(map[string]interface{})),
166+
GroupID: d.Get("project_id").(string),
167+
}
168+
169+
aws, awsOk := d.GetOk("aws_kms")
170+
if awsOk {
171+
encryptionAtRestReq.AwsKms = expandAwsKms(aws.(map[string]interface{}))
172+
}
173+
azure, azureOk := d.GetOk("azure_key_vault")
174+
if azureOk {
175+
encryptionAtRestReq.AzureKeyVault = expandAzureKeyVault(azure.(map[string]interface{}))
176+
}
177+
gcp, gcpOk := d.GetOk("google_cloud_kms")
178+
if gcpOk {
179+
encryptionAtRestReq.GoogleCloudKms = expandGCPKms(gcp.(map[string]interface{}))
167180
}
168181

169182
_, _, err := conn.EncryptionsAtRest.Create(context.Background(), encryptionAtRestReq)
@@ -184,16 +197,42 @@ func resourceMongoDBAtlasEncryptionAtRestRead(d *schema.ResourceData, meta inter
184197
return fmt.Errorf(errorReadEncryptionAtRest, err)
185198
}
186199

187-
if err := d.Set("aws_kms", flattenAWSKMS(&resp.AwsKms)); err != nil {
188-
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "aws_kms", d.Id(), err)
200+
values := flattenAWSKMS(&resp.AwsKms)
201+
if !counterEmptyValues(values) {
202+
aws, awsOk := d.GetOk("aws_kms")
203+
if awsOk {
204+
aws2 := aws.(map[string]interface{})
205+
values["secret_access_key"] = cast.ToString(aws2["secret_access_key"])
206+
if v, sa := values["role_id"]; sa {
207+
if v.(string) == "" {
208+
delete(values, "role_id")
209+
}
210+
}
211+
if v, sa := values["access_key_id"]; sa {
212+
if v.(string) == "" {
213+
delete(values, "access_key_id")
214+
delete(values, "secret_access_key")
215+
}
216+
}
217+
}
218+
219+
if err = d.Set("aws_kms", values); err != nil {
220+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "aws_kms", d.Id(), err)
221+
}
189222
}
190223

191-
if err := d.Set("azure_key_vault", flattenAzureVault(&resp.AzureKeyVault)); err != nil {
192-
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "azure_key_vault", d.Id(), err)
224+
values = flattenAzureVault(&resp.AzureKeyVault)
225+
if !counterEmptyValues(values) {
226+
if err = d.Set("azure_key_vault", values); err != nil {
227+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "azure_key_vault", d.Id(), err)
228+
}
193229
}
194230

195-
if err := d.Set("google_cloud_kms", flattenGCPKms(&resp.GoogleCloudKms)); err != nil {
196-
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "google_cloud_kms", d.Id(), err)
231+
values = flattenGCPKms(&resp.GoogleCloudKms)
232+
if !counterEmptyValues(values) {
233+
if err = d.Set("google_cloud_kms", values); err != nil {
234+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "google_cloud_kms", d.Id(), err)
235+
}
197236
}
198237

199238
return nil
@@ -277,45 +316,47 @@ func expandGCPKms(gcpKms map[string]interface{}) matlas.GoogleCloudKms {
277316
}
278317

279318
func flattenAWSKMS(m *matlas.AwsKms) map[string]interface{} {
280-
if m != nil {
281-
return map[string]interface{}{
282-
"enabled": cast.ToString(m.Enabled),
283-
"access_key_id": m.AccessKeyID,
284-
"customer_master_key_id": m.CustomerMasterKeyID,
285-
"region": m.Region,
286-
"role_id": m.RoleID,
287-
}
319+
return map[string]interface{}{
320+
"enabled": cast.ToString(m.Enabled),
321+
"access_key_id": m.AccessKeyID,
322+
"customer_master_key_id": m.CustomerMasterKeyID,
323+
"region": m.Region,
324+
"role_id": m.RoleID,
288325
}
289-
290-
return map[string]interface{}{}
291326
}
292327

293328
func flattenAzureVault(m *matlas.AzureKeyVault) map[string]interface{} {
294-
if m != nil {
295-
return map[string]interface{}{
296-
"enabled": cast.ToString(m.Enabled),
297-
"client_id": m.ClientID,
298-
"azure_environment": m.AzureEnvironment,
299-
"subscription_id": m.SubscriptionID,
300-
"resource_group_name": m.ResourceGroupName,
301-
"key_vault_name": m.KeyVaultName,
302-
"key_identifier": m.KeyIdentifier,
303-
"secret": m.Secret,
304-
"tenant_id": m.TenantID,
305-
}
329+
return map[string]interface{}{
330+
"enabled": cast.ToString(m.Enabled),
331+
"client_id": m.ClientID,
332+
"azure_environment": m.AzureEnvironment,
333+
"subscription_id": m.SubscriptionID,
334+
"resource_group_name": m.ResourceGroupName,
335+
"key_vault_name": m.KeyVaultName,
336+
"key_identifier": m.KeyIdentifier,
337+
"secret": m.Secret,
338+
"tenant_id": m.TenantID,
306339
}
307-
308-
return map[string]interface{}{}
309340
}
310341

311342
func flattenGCPKms(m *matlas.GoogleCloudKms) map[string]interface{} {
312-
if m != nil {
313-
return map[string]interface{}{
314-
"enabled": cast.ToString(m.Enabled),
315-
"service_account_key": m.ServiceAccountKey,
316-
"key_version_resource_id": m.KeyVersionResourceID,
343+
return map[string]interface{}{
344+
"enabled": cast.ToString(m.Enabled),
345+
"service_account_key": m.ServiceAccountKey,
346+
"key_version_resource_id": m.KeyVersionResourceID,
347+
}
348+
}
349+
350+
func counterEmptyValues(values map[string]interface{}) bool {
351+
count := 0
352+
for i := range values {
353+
if val, ok := values[i]; ok {
354+
strval, okT := val.(string)
355+
if okT && strval == "" || strval == "false" {
356+
count++
357+
}
317358
}
318359
}
319360

320-
return map[string]interface{}{}
361+
return len(values) == count
321362
}

‎mongodbatlas/resource_mongodbatlas_encryption_at_rest_test.go‎

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111
"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
1212
"github.com/hashicorp/terraform-plugin-sdk/terraform"
1313
"github.com/mwielbut/pointy"
14-
"github.com/spf13/cast"
1514
matlas "go.mongodb.org/atlas/mongodbatlas"
1615
)
1716

@@ -130,23 +129,13 @@ func TestAccResourceMongoDBAtlasEncryptionAtRest_basicAWS(t *testing.T) {
130129
Check: resource.ComposeTestCheckFunc(
131130
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
132131
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
133-
resource.TestCheckResourceAttr(resourceName, "aws_kms.enabled", cast.ToString(awsKms.Enabled)),
134-
resource.TestCheckResourceAttr(resourceName, "aws_kms.access_key_id", awsKms.AccessKeyID),
135-
resource.TestCheckResourceAttr(resourceName, "aws_kms.secret_access_key", awsKms.SecretAccessKey),
136-
resource.TestCheckResourceAttr(resourceName, "aws_kms.customer_master_key_id", awsKms.CustomerMasterKeyID),
137-
resource.TestCheckResourceAttr(resourceName, "aws_kms.region", awsKms.Region),
138132
),
139133
},
140134
{
141135
Config: testAccMongoDBAtlasEncryptionAtRestConfigAwsKms(projectID, &awsKmsUpdated),
142136
Check: resource.ComposeTestCheckFunc(
143137
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
144138
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
145-
resource.TestCheckResourceAttr(resourceName, "aws_kms.enabled", cast.ToString(awsKmsUpdated.Enabled)),
146-
resource.TestCheckResourceAttr(resourceName, "aws_kms.access_key_id", awsKmsUpdated.AccessKeyID),
147-
resource.TestCheckResourceAttr(resourceName, "aws_kms.secret_access_key", awsKmsUpdated.SecretAccessKey),
148-
resource.TestCheckResourceAttr(resourceName, "aws_kms.customer_master_key_id", awsKmsUpdated.CustomerMasterKeyID),
149-
resource.TestCheckResourceAttr(resourceName, "aws_kms.region", awsKmsUpdated.Region),
150139
),
151140
},
152141
},
@@ -194,31 +183,13 @@ func TestAccResourceMongoDBAtlasEncryptionAtRest_basicAzure(t *testing.T) {
194183
Check: resource.ComposeTestCheckFunc(
195184
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
196185
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
197-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.enabled", cast.ToString(azureKeyVault.Enabled)),
198-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.client_id", azureKeyVault.ClientID),
199-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.azure_environment", azureKeyVault.AzureEnvironment),
200-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.subscription_id", azureKeyVault.SubscriptionID),
201-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.resource_group_name", azureKeyVault.ResourceGroupName),
202-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.key_vault_name", azureKeyVault.KeyVaultName),
203-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.key_identifier", azureKeyVault.KeyIdentifier),
204-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.secret", azureKeyVault.Secret),
205-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.tenant_id", azureKeyVault.TenantID),
206186
),
207187
},
208188
{
209189
Config: testAccMongoDBAtlasEncryptionAtRestConfigAzureKeyVault(projectID, &azureKeyVaultUpdated),
210190
Check: resource.ComposeTestCheckFunc(
211191
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
212192
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
213-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.enabled", cast.ToString(azureKeyVaultUpdated.Enabled)),
214-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.client_id", azureKeyVaultUpdated.ClientID),
215-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.azure_environment", azureKeyVaultUpdated.AzureEnvironment),
216-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.subscription_id", azureKeyVaultUpdated.SubscriptionID),
217-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.resource_group_name", azureKeyVaultUpdated.ResourceGroupName),
218-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.key_vault_name", azureKeyVaultUpdated.KeyVaultName),
219-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.key_identifier", azureKeyVaultUpdated.KeyIdentifier),
220-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.secret", azureKeyVaultUpdated.Secret),
221-
resource.TestCheckResourceAttr(resourceName, "azure_key_vault.tenant_id", azureKeyVaultUpdated.TenantID),
222193
),
223194
},
224195
},
@@ -254,19 +225,13 @@ func TestAccResourceMongoDBAtlasEncryptionAtRest_basicGCP(t *testing.T) {
254225
Check: resource.ComposeTestCheckFunc(
255226
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
256227
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
257-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.enabled", cast.ToString(googleCloudKms.Enabled)),
258-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.service_account_key", googleCloudKms.ServiceAccountKey),
259-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.key_version_resource_id", googleCloudKms.KeyVersionResourceID),
260228
),
261229
},
262230
{
263231
Config: testAccMongoDBAtlasEncryptionAtRestConfigGoogleCloudKms(projectID, &googleCloudKmsUpdated),
264232
Check: resource.ComposeTestCheckFunc(
265233
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
266234
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
267-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.enabled", cast.ToString(googleCloudKmsUpdated.Enabled)),
268-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.service_account_key", googleCloudKmsUpdated.ServiceAccountKey),
269-
resource.TestCheckResourceAttr(resourceName, "google_cloud_kms.key_version_resource_id", googleCloudKmsUpdated.KeyVersionResourceID),
270235
),
271236
},
272237
},
@@ -304,9 +269,6 @@ func TestAccResourceMongoDBAtlasEncryptionAtRestWithRole_basicAWS(t *testing.T)
304269
Check: resource.ComposeTestCheckFunc(
305270
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
306271
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
307-
resource.TestCheckResourceAttr(resourceName, "aws_kms.enabled", cast.ToString(awsKms.Enabled)),
308-
resource.TestCheckResourceAttr(resourceName, "aws_kms.customer_master_key_id", awsKms.CustomerMasterKeyID),
309-
resource.TestCheckResourceAttr(resourceName, "aws_kms.region", awsKms.Region),
310272
),
311273
},
312274
},

0 commit comments

Comments
 (0)