Skip to content

Commit 99bbd23

Browse files
coderGo93Edgar López
coderGo93
and
Edgar López
authored
INTMDB-133: Updated Encryption At Rest to work with IAM Roles (#365)
* chore: updated vendor from mongodb client master * feat: added parameter role_id * set parameters in read * chore: updated vendor for terrastest * test: added testacc for encryption at rest * test: added examples for encryption at rest using iam roles in tf * feat: added folder for testing using terratest * docs: updated docs * fixes linter errors * fixes linter * fix error tests * test: changed skip to skipnow func * fix: changed version mongodb plugin to normal version * added env var in workflow for automated tests * added env var in workflow for automated tests * deleted examples, mod for terratest and run again go mod vendor * chore:updated vendor * docs: made changes suggested by melissa Co-authored-by: Edgar López <[email protected]>
1 parent 3ae7e07 commit 99bbd23

File tree

11 files changed

+263
-36
lines changed

11 files changed

+263
-36
lines changed

‎GNUmakefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,4 @@ endif
7878
@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
7979

8080
.PHONY: build test testacc fmt fmtcheck lint check tools test-compile website website-lint website-test
81+

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@ require (
1111
github.com/spf13/cast v1.3.1
1212
github.com/terraform-providers/terraform-provider-aws v1.60.1-0.20200518153306-40099de47e37
1313
github.com/terraform-providers/terraform-provider-google v1.20.1-0.20200518165017-1dd21651c496
14-
go.mongodb.org/atlas v0.5.1-0.20201123170532-371c0d8194fe
14+
go.mongodb.org/atlas v0.5.1-0.20201208195148-2ef1965cb1ef
1515
)

‎go.sum‎

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8Nz
9494
github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
9595
github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
9696
github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
97+
github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
9798
github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
9899
github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
99100
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -134,6 +135,7 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
134135
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
135136
github.com/go-ole/go-ole v1.2.1/go.mod h1:7FAglXiTm7HKlQRDeOQ6ZNUHidzCWXuZWq/1dTyBNF8=
136137
github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
138+
github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
137139
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
138140
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
139141
github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
@@ -489,6 +491,7 @@ github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:
489491
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
490492
github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
491493
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
494+
github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
492495
github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
493496
github.com/ryancurrah/gomodguard v1.0.4 h1:oCreMAt9GuFXDe9jW4HBpc3GjdX3R/sUEcLAGh1zPx8=
494497
github.com/ryancurrah/gomodguard v1.0.4/go.mod h1:9T/Cfuxs5StfsocWr4WzDL36HqnX0fVb9d5fSEaLhoE=
@@ -601,26 +604,8 @@ github.com/zclconf/go-cty v1.2.1/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q
601604
github.com/zclconf/go-cty-yaml v1.0.1 h1:up11wlgAaDvlAGENcFDnZgkn0qUJurso7k6EpURKNF8=
602605
github.com/zclconf/go-cty-yaml v1.0.1/go.mod h1:IP3Ylp0wQpYm50IHK8OZWKMu6sPJIUgKa8XhiVHura0=
603606
go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
604-
go.mongodb.org/atlas v0.3.1-0.20200716160607-1b4e8b15eadf h1:uphQUeBtEbNSmlhg1MRVJOMMhFBtrT6+K6rSmXGxCPk=
605-
go.mongodb.org/atlas v0.3.1-0.20200716160607-1b4e8b15eadf/go.mod h1:xa/V3muNuVoReSG0y2pigUUnfPOx1cHF0ZV2uCE+c7I=
606-
go.mongodb.org/atlas v0.4.1-0.20200817181428-cd1e61b39f75 h1:aXDdZDxIeD37cn0uVGQl+oHbT//g9OYybLF+R4u2NHk=
607-
go.mongodb.org/atlas v0.4.1-0.20200817181428-cd1e61b39f75/go.mod h1:QlKvZKT43+R6lhHlaTy2E7Q/3AoAljMI6v5apfqslIs=
608-
go.mongodb.org/atlas v0.4.1-0.20200819194203-09c49e85aa0d h1:5GrmSNMip4s758EBOchuRTLarSxpRMOclvUjo9Dez7M=
609-
go.mongodb.org/atlas v0.4.1-0.20200819194203-09c49e85aa0d/go.mod h1:QlKvZKT43+R6lhHlaTy2E7Q/3AoAljMI6v5apfqslIs=
610-
go.mongodb.org/atlas v0.4.1-0.20200820152733-8dc4a7c19a2b h1:AuAQZDrQLesdmz9mIPaIn07OJRoG4Vfm+M3xd31HGgo=
611-
go.mongodb.org/atlas v0.4.1-0.20200820152733-8dc4a7c19a2b/go.mod h1:QlKvZKT43+R6lhHlaTy2E7Q/3AoAljMI6v5apfqslIs=
612-
go.mongodb.org/atlas v0.4.1-0.20200903102338-049d0778b833 h1:gH8Ih2OacuB6qVitO+wI5EBKdbtM/YdbhJstiMR2Vfw=
613-
go.mongodb.org/atlas v0.4.1-0.20200903102338-049d0778b833/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
614-
go.mongodb.org/atlas v0.4.1-0.20200916170654-ac3833accfa2 h1:qjEP4bC8yTi57jBYHtSSA8gzPN4vJl3XG23YBMXCgUg=
615-
go.mongodb.org/atlas v0.4.1-0.20200916170654-ac3833accfa2/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
616-
go.mongodb.org/atlas v0.5.1-0.20201007214134-b315fe7503d2 h1:b4Ng7d2sCSgYKwLMOetbwLcPE732SiBnJqH5rQrhZOs=
617-
go.mongodb.org/atlas v0.5.1-0.20201007214134-b315fe7503d2/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
618-
go.mongodb.org/atlas v0.5.1-0.20201106143903-ab022d8c43b5 h1:/U1ze48A0J3td+rItu+/jpNCLQxdNKtkIkpnuy2ZKHc=
619-
go.mongodb.org/atlas v0.5.1-0.20201106143903-ab022d8c43b5/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
620-
go.mongodb.org/atlas v0.5.1-0.20201117180402-049456a13b6e h1:mAoOV+XVJ1bwVIojwXRe3oDTpycfN+zraR6oEqkroic=
621-
go.mongodb.org/atlas v0.5.1-0.20201117180402-049456a13b6e/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
622-
go.mongodb.org/atlas v0.5.1-0.20201123170532-371c0d8194fe h1:xyaNXTRtHfWGYtKIdBdwuPxxumSbqEF5QI5r7kdOGcw=
623-
go.mongodb.org/atlas v0.5.1-0.20201123170532-371c0d8194fe/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
607+
go.mongodb.org/atlas v0.5.1-0.20201208195148-2ef1965cb1ef h1:W356PZzBuIdUwuxAq94SSIniPO7C1Wl8KYwmU+MPHYc=
608+
go.mongodb.org/atlas v0.5.1-0.20201208195148-2ef1965cb1ef/go.mod h1:CIaBeO8GLHhtYLw7xSSXsw7N90Z4MFY87Oy9qcPyuEs=
624609
go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
625610
go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
626611
go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -759,6 +744,7 @@ golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
759744
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
760745
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
761746
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
747+
golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
762748
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
763749
golang.org/x/tools v0.0.0-20170915040203-e531a2a1c15f/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
764750
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎mongodbatlas/resource_mongodbatlas_encryption_at_rest.go‎

Lines changed: 79 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ import (
1111
matlas "go.mongodb.org/atlas/mongodbatlas"
1212
)
1313

14+
const (
15+
errorCreateEncryptionAtRest = "error creating Encryption At Rest: %s"
16+
errorReadEncryptionAtRest = "error getting Encryption At Rest: %s"
17+
errorDeleteEncryptionAtRest = "error deleting Encryption At Rest: (%s): %s"
18+
errorUpdateEncryptionAtRest = "error updating Encryption At Rest: %s"
19+
errorAlertEncryptionAtRestSetting = "error setting `%s` for Encryption At Rest (%s): %s"
20+
)
21+
1422
func resourceMongoDBAtlasEncryptionAtRest() *schema.Resource {
1523
return &schema.Resource{
1624
Create: resourceMongoDBAtlasEncryptionAtRestCreate,
@@ -52,6 +60,10 @@ func resourceMongoDBAtlasEncryptionAtRest() *schema.Resource {
5260
Type: schema.TypeString,
5361
Required: true,
5462
},
63+
"role_id": {
64+
Type: schema.TypeString,
65+
Optional: true,
66+
},
5567
},
5668
},
5769
},
@@ -142,7 +154,7 @@ func resourceMongoDBAtlasEncryptionAtRestCreate(d *schema.ResourceData, meta int
142154

143155
_, _, err := conn.EncryptionsAtRest.Create(context.Background(), encryptionAtRestReq)
144156
if err != nil {
145-
return fmt.Errorf("error creating Encryption at Rest: %s", err)
157+
return fmt.Errorf(errorCreateEncryptionAtRest, err)
146158
}
147159

148160
d.SetId(d.Get("project_id").(string))
@@ -153,9 +165,25 @@ func resourceMongoDBAtlasEncryptionAtRestCreate(d *schema.ResourceData, meta int
153165
func resourceMongoDBAtlasEncryptionAtRestRead(d *schema.ResourceData, meta interface{}) error {
154166
conn := meta.(*matlas.Client)
155167

156-
_, _, err := conn.EncryptionsAtRest.Get(context.Background(), d.Id())
168+
resp, _, err := conn.EncryptionsAtRest.Get(context.Background(), d.Id())
157169
if err != nil {
158-
return fmt.Errorf("error getting Encryption at Rest information: %s", err)
170+
return fmt.Errorf(errorReadEncryptionAtRest, err)
171+
}
172+
173+
if err := d.Set("project_id", resp.GroupID); err != nil {
174+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "project_id", d.Id(), err)
175+
}
176+
177+
if err := d.Set("aws_kms", flattenAWSKMS(&resp.AwsKms)); err != nil {
178+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "aws_kms", d.Id(), err)
179+
}
180+
181+
if err := d.Set("azure_key_vault", flattenAzureVault(&resp.AzureKeyVault)); err != nil {
182+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "azure_key_vault", d.Id(), err)
183+
}
184+
185+
if err := d.Set("google_cloud_kms", flattenGCPKms(&resp.GoogleCloudKms)); err != nil {
186+
return fmt.Errorf(errorAlertEncryptionAtRestSetting, "google_cloud_kms", d.Id(), err)
159187
}
160188

161189
return nil
@@ -167,7 +195,7 @@ func resourceMongoDBAtlasEncryptionAtRestUpdate(d *schema.ResourceData, meta int
167195

168196
encrypt, _, err := conn.EncryptionsAtRest.Get(context.Background(), projectID)
169197
if err != nil {
170-
return fmt.Errorf("error getting encryption at rest information: %s", err)
198+
return fmt.Errorf(errorUpdateEncryptionAtRest, err)
171199
}
172200

173201
encrypt.GroupID = projectID
@@ -197,7 +225,7 @@ func resourceMongoDBAtlasEncryptionAtRestDelete(d *schema.ResourceData, meta int
197225

198226
_, err := conn.EncryptionsAtRest.Delete(context.Background(), d.Id())
199227
if err != nil {
200-
return fmt.Errorf("error removing encryption at rest (%s): %s", d.Id(), err)
228+
return fmt.Errorf(errorDeleteEncryptionAtRest, d.Id(), err)
201229
}
202230

203231
return nil
@@ -212,6 +240,7 @@ func expandAwsKms(awsKms map[string]interface{}) matlas.AwsKms {
212240
SecretAccessKey: cast.ToString(awsKms["secret_access_key"]),
213241
CustomerMasterKeyID: cast.ToString(awsKms["customer_master_key_id"]),
214242
Region: awsRegion,
243+
RoleID: cast.ToString(awsKms["role_id"]),
215244
}
216245
}
217246

@@ -236,3 +265,48 @@ func expandGCPKms(gcpKms map[string]interface{}) matlas.GoogleCloudKms {
236265
KeyVersionResourceID: cast.ToString(gcpKms["key_version_resource_id"]),
237266
}
238267
}
268+
269+
func flattenAWSKMS(m *matlas.AwsKms) map[string]interface{} {
270+
if m != nil {
271+
return map[string]interface{}{
272+
"enabled": cast.ToString(m.Enabled),
273+
"access_key_id": m.AccessKeyID,
274+
"secret_access_key": m.SecretAccessKey,
275+
"customer_master_key_id": m.CustomerMasterKeyID,
276+
"region": m.Region,
277+
"role_id": m.RoleID,
278+
}
279+
}
280+
281+
return map[string]interface{}{}
282+
}
283+
284+
func flattenAzureVault(m *matlas.AzureKeyVault) map[string]interface{} {
285+
if m != nil {
286+
return map[string]interface{}{
287+
"enabled": cast.ToString(m.Enabled),
288+
"client_id": m.ClientID,
289+
"azure_environment": m.AzureEnvironment,
290+
"subscription_id": m.SubscriptionID,
291+
"resource_group_name": m.ResourceGroupName,
292+
"key_vault_name": m.KeyVaultName,
293+
"key_identifier": m.KeyIdentifier,
294+
"secret": m.Secret,
295+
"tenant_id": m.TenantID,
296+
}
297+
}
298+
299+
return map[string]interface{}{}
300+
}
301+
302+
func flattenGCPKms(m *matlas.GoogleCloudKms) map[string]interface{} {
303+
if m != nil {
304+
return map[string]interface{}{
305+
"enabled": cast.ToString(m.Enabled),
306+
"service_account_key": m.ServiceAccountKey,
307+
"key_version_resource_id": m.KeyVersionResourceID,
308+
}
309+
}
310+
311+
return map[string]interface{}{}
312+
}

‎mongodbatlas/resource_mongodbatlas_encryption_at_rest_test.go‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,97 @@ import (
66
"os"
77
"testing"
88

9+
"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
10+
911
"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
1012
"github.com/hashicorp/terraform-plugin-sdk/terraform"
1113
"github.com/mwielbut/pointy"
1214
"github.com/spf13/cast"
1315
matlas "go.mongodb.org/atlas/mongodbatlas"
1416
)
1517

18+
const (
19+
initialConfigEncryptionRestRoleAWS = `
20+
provider "aws" {
21+
region = lower(replace("%[1]s", "_", "-"))
22+
access_key = "%[2]s"
23+
secret_key = "%[3]s"
24+
}
25+
26+
%[7]s
27+
28+
resource "mongodbatlas_cloud_provider_access" "test" {
29+
project_id = "%[4]s"
30+
provider_name = "AWS"
31+
%[8]s
32+
33+
}
34+
35+
resource "aws_iam_role_policy" "test_policy" {
36+
name = "%[5]s"
37+
role = aws_iam_role.test_role.id
38+
39+
policy = <<-EOF
40+
{
41+
"Version": "2012-10-17",
42+
"Statement": [
43+
{
44+
"Effect": "Allow",
45+
"Action": "*",
46+
"Resource": "*"
47+
}
48+
]
49+
}
50+
EOF
51+
}
52+
53+
resource "aws_iam_role" "test_role" {
54+
name = "%[6]s"
55+
56+
assume_role_policy = <<EOF
57+
{
58+
"Version": "2012-10-17",
59+
"Statement": [
60+
{
61+
"Effect": "Allow",
62+
"Principal": {
63+
"AWS": "${mongodbatlas_cloud_provider_access.test.atlas_aws_account_arn}"
64+
},
65+
"Action": "sts:AssumeRole",
66+
"Condition": {
67+
"StringEquals": {
68+
"sts:ExternalId": "${mongodbatlas_cloud_provider_access.test.atlas_assumed_role_external_id}"
69+
}
70+
}
71+
}
72+
]
73+
}
74+
EOF
75+
76+
}
77+
78+
%[9]s
79+
80+
`
81+
configEncryptionRest = `
82+
resource "mongodbatlas_encryption_at_rest" "test" {
83+
project_id = "%s"
84+
85+
aws_kms = {
86+
enabled = %t
87+
customer_master_key_id = "%s"
88+
region = "%s"
89+
role_id = mongodbatlas_cloud_provider_access.test.role_id
90+
}
91+
}`
92+
dataAWSARNConfig = `
93+
data "aws_iam_role" "test" {
94+
name = "%s"
95+
}
96+
97+
`
98+
)
99+
16100
func TestAccResourceMongoDBAtlasEncryptionAtRest_basicAWS(t *testing.T) {
17101
SkipTestExtCred(t)
18102
var (
@@ -189,6 +273,46 @@ func TestAccResourceMongoDBAtlasEncryptionAtRest_basicGCP(t *testing.T) {
189273
})
190274
}
191275

276+
func TestAccResourceMongoDBAtlasEncryptionAtRestWithRole_basicAWS(t *testing.T) {
277+
SkipTest(t) // For now it will skipped because of aws errors reasons, already made another test using terratest.
278+
SkipTestExtCred(t)
279+
var (
280+
resourceName = "mongodbatlas_encryption_at_rest.test"
281+
projectID = os.Getenv("MONGODB_ATLAS_PROJECT_ID")
282+
accessKeyID = os.Getenv("AWS_ACCESS_KEY_ID")
283+
secretKey = os.Getenv("AWS_SECRET_ACCESS_KEY")
284+
policyName = acctest.RandomWithPrefix("test-aws-policy")
285+
roleName = acctest.RandomWithPrefix("test-aws-role")
286+
287+
awsKms = matlas.AwsKms{
288+
Enabled: pointy.Bool(true),
289+
CustomerMasterKeyID: os.Getenv("AWS_CUSTOMER_MASTER_KEY_ID"),
290+
Region: os.Getenv("AWS_REGION"),
291+
}
292+
)
293+
294+
resource.Test(t, resource.TestCase{
295+
PreCheck: func() { testAccPreCheck(t); checkAwsEnv(t) },
296+
Providers: testAccProviders,
297+
CheckDestroy: testAccCheckMongoDBAtlasEncryptionAtRestDestroy,
298+
Steps: []resource.TestStep{
299+
{
300+
Config: testAccMongoDBAtlasEncryptionAtRestConfigAwsKmsWithRole(awsKms.Region, accessKeyID, secretKey, projectID, policyName, roleName, false, &awsKms),
301+
},
302+
{
303+
Config: testAccMongoDBAtlasEncryptionAtRestConfigAwsKmsWithRole(awsKms.Region, accessKeyID, secretKey, projectID, policyName, roleName, true, &awsKms),
304+
Check: resource.ComposeTestCheckFunc(
305+
testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName),
306+
resource.TestCheckResourceAttr(resourceName, "project_id", projectID),
307+
resource.TestCheckResourceAttr(resourceName, "aws_kms.enabled", cast.ToString(awsKms.Enabled)),
308+
resource.TestCheckResourceAttr(resourceName, "aws_kms.customer_master_key_id", awsKms.CustomerMasterKeyID),
309+
resource.TestCheckResourceAttr(resourceName, "aws_kms.region", awsKms.Region),
310+
),
311+
},
312+
},
313+
})
314+
}
315+
192316
func testAccCheckMongoDBAtlasEncryptionAtRestExists(resourceName string) resource.TestCheckFunc {
193317
return func(s *terraform.State) error {
194318
conn := testAccProvider.Meta().(*matlas.Client)
@@ -281,3 +405,14 @@ func testAccMongoDBAtlasEncryptionAtRestConfigGoogleCloudKms(projectID string, g
281405
}
282406
`, projectID, *google.Enabled, google.ServiceAccountKey, google.KeyVersionResourceID)
283407
}
408+
409+
func testAccMongoDBAtlasEncryptionAtRestConfigAwsKmsWithRole(region, awsAccesKey, awsSecretKey, projectID, policyName, awsRoleName string, isUpdate bool, aws *matlas.AwsKms) string {
410+
config := fmt.Sprintf(initialConfigEncryptionRestRoleAWS, region, awsAccesKey, awsSecretKey, projectID, policyName, awsRoleName, "", "", "")
411+
if isUpdate {
412+
configEncrypt := fmt.Sprintf(configEncryptionRest, projectID, *aws.Enabled, aws.CustomerMasterKeyID, aws.Region)
413+
dataAWSARN := fmt.Sprintf(dataAWSARNConfig, awsRoleName)
414+
dataARN := `iam_assumed_role_arn = data.aws_iam_role.test.arn`
415+
config = fmt.Sprintf(initialConfigEncryptionRestRoleAWS, region, awsAccesKey, awsSecretKey, projectID, policyName, awsRoleName, dataAWSARN, dataARN, configEncrypt)
416+
}
417+
return config
418+
}

‎vendor/go.mongodb.org/atlas/mongodbatlas/cloud_provider_access.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/go.mongodb.org/atlas/mongodbatlas/encryptions_at_rest.go‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)