Skip to content

Commit 733570c

Browse files
leofigyleofigy
authored
INTMDB 186 - Added authorization resource to split the cloud access provider config (#420)
* splitting schema into two resources * added read for second resource * auth resource * fixing linter * added placeholder foos * importer for CloudProviderAccessSetup * example single apply terraform * clean up * documentation update and description * terratest single apply * datasource for setup * adding test case for datasource :) * update in authorization resource * testing for setup resource and import * import test * document for cloud provider access setup datasource * documentation update * pr comments :) * Update cloud_provider_access.markdown * pr comment :) * pr comment typo
1 parent 1292d7d commit 733570c

19 files changed

+1100
-44
lines changed

‎README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,3 +205,12 @@ $ make testacc
205205
Thanks
206206
---------------------------
207207
We'd like to thank [Akshay Karle](https://github.com/akshaykarle) for writing the first version of a Terraform Provider for MongoDB Atlas and paving the way for the creation of this one.
208+
209+
# Running the integration tests
210+
211+
The integration tests helps the validation for resources interacting with third party providers (aws, azure or gcp) using terratest [environment setup details](integration-testing/README.md)
212+
213+
```
214+
cd integration-testing
215+
go test -tags=integration
216+
```

‎examples/atlas-cloud-provider-access/aws/aws-roles.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
resource "aws_iam_role_policy" "test_policy" {
2+
name = "mongo_setup_policy"
3+
role = aws_iam_role.test_role.id
4+
5+
policy = <<-EOF
6+
{
7+
"Version": "2012-10-17",
8+
"Statement": [
9+
{
10+
"Effect": "Allow",
11+
"Action": "*",
12+
"Resource": "*"
13+
}
14+
]
15+
}
16+
EOF
17+
}
18+
19+
resource "aws_iam_role" "test_role" {
20+
name = "mongo_setup_test_role"
21+
22+
assume_role_policy = <<EOF
23+
{
24+
"Version": "2012-10-17",
25+
"Statement": [
26+
{
27+
"Effect": "Allow",
28+
"Principal": {
29+
"AWS": "${mongodbatlas_cloud_provider_access_setup.setup_only.aws.atlas_aws_account_arn}"
30+
},
31+
"Action": "sts:AssumeRole",
32+
"Condition": {
33+
"StringEquals": {
34+
"sts:ExternalId": "${mongodbatlas_cloud_provider_access_setup.setup_only.aws.atlas_assumed_role_external_id}"
35+
}
36+
}
37+
}
38+
]
39+
}
40+
EOF
41+
}

‎examples/atlas-cloud-provider-access/aws/main.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "mongodbatlas_cloud_provider_access_setup" "setup_only" {
2+
project_id = var.project_id
3+
provider_name = var.cloud_provider_access_name
4+
}
5+
6+
resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
7+
project_id = var.project_id
8+
role_id = mongodbatlas_cloud_provider_access_setup.setup_only.role_id
9+
10+
aws = {
11+
iam_assumed_role_arn = aws_iam_role.test_role.arn
12+
}
13+
}

‎examples/atlas-cloud-provider-access/aws/providers.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
provider "mongodbatlas" {
2+
public_key = var.public_key
3+
private_key = var.private_key
4+
}
5+
provider "aws" {
6+
access_key = var.access_key
7+
secret_key = var.secret_key
8+
region = var.aws_region
9+
}

‎examples/atlas-cloud-provider-access/aws/variables.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// mongo
2+
variable project_id {
3+
type = string
4+
}
5+
variable cloud_provider_access_name {
6+
type = string
7+
default = "AWS"
8+
}
9+
variable public_key {
10+
type = string
11+
}
12+
variable private_key {
13+
type = string
14+
}
15+
16+
// aws
17+
variable access_key {
18+
type = string
19+
}
20+
variable secret_key {
21+
type = string
22+
}
23+
variable aws_region {
24+
type = string
25+
}

‎examples/atlas-cloud-provider-access/aws/versions.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_providers {
3+
mongodbatlas = {
4+
source = "mongodb/mongodbatlas"
5+
}
6+
}
7+
required_version = ">= 0.13"
8+
}

‎integration-testing/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
### Integration tests
2+
3+
Integration tests required extra credentials, such as for aws and azure,
4+
in order to execute the complete terraform cycle (init, apply, destroy)
5+
6+
For all the testing it needs the common environment variables
7+
```
8+
MONGODB_ATLAS_PROJECT_ID
9+
MONGODB_ATLAS_PUBLIC_KEY
10+
MONGODB_ATLAS_PRIVATE_KEY
11+
```
12+
13+
For specific aws related interactions
14+
```
15+
AWS_ACCESS_KEY_ID
16+
AWS_SECRET_ACCESS_KEY
17+
AWS_REGION
18+
19+
AWS_CUSTOMER_MASTER_KEY_ID (only required for encryption at rest with customer managed key)
20+
21+
```

‎integration-testing/common.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package integration_testing
2+
3+
import "os"
4+
5+
type MongoDBCredentials struct {
6+
ProjectID string
7+
PublicKey string
8+
PrivateKey string
9+
}
10+
11+
type AWSCredentials struct {
12+
AccessKey string
13+
SecretKey string
14+
CustomerMasterKey string
15+
AwsRegion string
16+
}
17+
18+
func GetCredentialsFromEnv() MongoDBCredentials {
19+
return MongoDBCredentials{
20+
ProjectID: os.Getenv("MONGODB_ATLAS_PROJECT_ID"),
21+
PublicKey: os.Getenv("MONGODB_ATLAS_PUBLIC_KEY"),
22+
PrivateKey: os.Getenv("MONGODB_ATLAS_PRIVATE_KEY"),
23+
}
24+
}
25+
26+
func GetAWSCredentialsFromEnv() AWSCredentials {
27+
return AWSCredentials{
28+
AccessKey: os.Getenv("AWS_ACCESS_KEY_ID"),
29+
SecretKey: os.Getenv("AWS_SECRET_ACCESS_KEY"),
30+
CustomerMasterKey: os.Getenv("AWS_CUSTOMER_MASTER_KEY_ID"),
31+
AwsRegion: os.Getenv("AWS_REGION"),
32+
}
33+
}

‎integration-testing/resource_mongodbatlas_cloud_provider_access_test.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// +build integration
2+
3+
package integration_testing
4+
5+
import (
6+
"os"
7+
"testing"
8+
9+
"github.com/gruntwork-io/terratest/modules/terraform"
10+
)
11+
12+
const (
13+
defaultTerratestFilesCPA = "../examples/atlas-cloud-provider-access/aws/"
14+
)
15+
16+
func TestTerraformResourceMongoDBAtlasCloudProviderAccess_basicAWS(t *testing.T) {
17+
t.Parallel()
18+
19+
mongoSecrets := GetCredentialsFromEnv()
20+
awsSecrets := GetAWSCredentialsFromEnv()
21+
22+
testFiles := os.Getenv("TERRATEST_CLOUD_PROVIDER_ACCESS_AWS")
23+
if testFiles == "" {
24+
testFiles = defaultTerratestFilesCPA
25+
}
26+
27+
terraformOptions := &terraform.Options{
28+
TerraformDir: testFiles,
29+
Vars: map[string]interface{}{
30+
"project_id": mongoSecrets.ProjectID,
31+
"cloud_provider_access_name": "AWS",
32+
"public_key": mongoSecrets.PublicKey,
33+
"private_key": mongoSecrets.PrivateKey,
34+
"access_key": awsSecrets.AccessKey,
35+
"secret_key": awsSecrets.SecretKey,
36+
"aws_region": awsSecrets.AwsRegion,
37+
},
38+
}
39+
40+
terraformTest := terraform.WithDefaultRetryableErrors(t, terraformOptions)
41+
42+
defer terraform.Destroy(t, terraformTest)
43+
terraform.InitAndApply(t, terraformTest)
44+
}

‎integration-testing/resource_mongodbatlas_encryption_at_rest_test.go‎

Lines changed: 26 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,33 @@
1+
// +build integration
2+
13
package integration_testing
24

35
import (
46
"fmt"
5-
"os"
6-
"strings"
77
"testing"
88

99
"github.com/gruntwork-io/terratest/modules/terraform"
1010
)
1111

12-
func SkipTestExtCred(t *testing.T) {
13-
if strings.EqualFold(os.Getenv("SKIP_TEST_EXTERNAL_CREDENTIALS"), "true") {
14-
t.SkipNow()
15-
}
16-
}
1712
func TestTerraformResourceMongoDBAtlasEncryptionAtRestWithRole_basicAWS(t *testing.T) {
18-
SkipTestExtCred(t)
1913
t.Parallel()
2014

21-
var (
22-
projectID = os.Getenv("MONGODB_ATLAS_PROJECT_ID")
23-
accessKey = os.Getenv("AWS_ACCESS_KEY_ID")
24-
secretKey = os.Getenv("AWS_SECRET_ACCESS_KEY")
25-
customerKey = os.Getenv("AWS_CUSTOMER_MASTER_KEY_ID")
26-
awsRegion = os.Getenv("AWS_REGION")
27-
publicKey = os.Getenv("MONGODB_ATLAS_PUBLIC_KEY")
28-
privateKey = os.Getenv("MONGODB_ATLAS_PRIVATE_KEY")
29-
)
15+
mongoSecrets := GetCredentialsFromEnv()
16+
awsSecrets := GetAWSCredentialsFromEnv()
17+
3018
// Construct the terraform options with default retryable errors to handle the most common
3119
// retryable errors in terraform testing.
3220
terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
3321
// The path to where our Terraform code is located
3422
TerraformDir: "../examples/atlas-encryptionAtRest-roles",
3523
Vars: map[string]interface{}{
36-
"access_key": accessKey,
37-
"secret_key": secretKey,
38-
"customer_master_key": customerKey,
39-
"atlas_region": awsRegion,
40-
"project_id": projectID,
41-
"public_key": publicKey,
42-
"private_key": privateKey,
24+
"access_key": awsSecrets.AccessKey,
25+
"secret_key": awsSecrets.SecretKey,
26+
"customer_master_key": awsSecrets.CustomerMasterKey,
27+
"atlas_region": awsSecrets.AwsRegion,
28+
"project_id": mongoSecrets.ProjectID,
29+
"public_key": mongoSecrets.PublicKey,
30+
"private_key": mongoSecrets.PrivateKey,
4331
},
4432
})
4533

@@ -53,20 +41,20 @@ func TestTerraformResourceMongoDBAtlasEncryptionAtRestWithRole_basicAWS(t *testi
5341
awsRoleARN := terraform.Output(t, terraformOptions, "aws_iam_role_arn")
5442
cpaRoleID := terraform.Output(t, terraformOptions, "cpa_role_id")
5543

56-
fmt.Println(fmt.Sprintf("awsRoleARN : %s", awsRoleARN))
57-
fmt.Println(fmt.Sprintf("cpaRoleID : %s", cpaRoleID))
44+
fmt.Printf("awsRoleARN : %s", awsRoleARN)
45+
fmt.Printf("cpaRoleID : %s", cpaRoleID)
5846

5947
terraformOptionsUpdated := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
6048
// The path to where our Terraform code is located
6149
TerraformDir: "../examples/atlas-encryptionAtRest-roles",
6250
Vars: map[string]interface{}{
63-
"access_key": accessKey,
64-
"secret_key": secretKey,
65-
"customer_master_key": customerKey,
66-
"atlas_region": awsRegion,
67-
"project_id": projectID,
68-
"public_key": publicKey,
69-
"private_key": privateKey,
51+
"access_key": awsSecrets.AccessKey,
52+
"secret_key": awsSecrets.SecretKey,
53+
"customer_master_key": awsSecrets.CustomerMasterKey,
54+
"atlas_region": awsSecrets.AwsRegion,
55+
"project_id": mongoSecrets.ProjectID,
56+
"public_key": mongoSecrets.PublicKey,
57+
"private_key": mongoSecrets.PrivateKey,
7058
"aws_iam_role_arn": awsRoleARN,
7159
},
7260
})
@@ -77,11 +65,11 @@ func TestTerraformResourceMongoDBAtlasEncryptionAtRestWithRole_basicAWS(t *testi
7765
// The path to where our Terraform code is located
7866
TerraformDir: "../examples/atlas-encryptionAtRest-roles/second_step",
7967
Vars: map[string]interface{}{
80-
"customer_master_key": customerKey,
81-
"atlas_region": awsRegion,
82-
"project_id": projectID,
83-
"public_key": publicKey,
84-
"private_key": privateKey,
68+
"customer_master_key": awsSecrets.CustomerMasterKey,
69+
"atlas_region": awsSecrets.AwsRegion,
70+
"project_id": mongoSecrets.ProjectID,
71+
"public_key": mongoSecrets.PublicKey,
72+
"private_key": mongoSecrets.PrivateKey,
8573
"cpa_role_id": cpaRoleID,
8674
},
8775
})

0 commit comments

Comments
 (0)