[datadog_integration_aws_*] Validate AWS account ID and improve error handling

datadog/internal/validators/validators.go

@@ -206,6 +206,32 @@ func ValidateDatadogDowntimeTimezone(v interface{}, k string) (ws []string, erro
 	return
 }
 
+// ValidateAWSAccountID AWS Account ID must be a string exactly 12 digits long
+// See https://docs.aws.amazon.com/organizations/latest/APIReference/API_Account.html
+func ValidateAWSAccountID(v any, p cty.Path) diag.Diagnostics {
+	value, ok := v.(string)
+	var diags diag.Diagnostics
+	AWSAccountIDRegex := regexp.MustCompile(`^\d{12}$`)
+	AWSIAMAAccessKeyRegex := regexp.MustCompile(`^(AKIA|ASIA)[A-Z0-9]{16,20}`)
+	if ok && AWSIAMAAccessKeyRegex.MatchString(value) {
+		// Help the user with a deprecation warning
+		// Fedramp DD previously required using an IAM access key in place of the AWS account id
+		diags = append(diags, diag.Diagnostic{
+			Severity: diag.Warning,
+			Summary:  "Deprecated",
+			Detail:   "the provided account ID might be an IAM access key. This behavior is deprecated. Use the AWS account ID instead.",
+		})
+	}
+	if ok && !AWSAccountIDRegex.MatchString(value) {
+		diags = append(diags, diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  "Invalid value",
+			Detail:   "account id must be a string containing exactly 12 digits",
+		})
+	}
+	return diags
+}
+
 type BetweenValidator struct {
 	min float64
 	max float64
@@ -230,7 +256,7 @@ func (v BetweenValidator) ValidateString(ctx context.Context, request validator.
 
 	if err != nil {
 		response.Diagnostics.AddError(
-			fmt.Sprintf("value must be float"),
+			"value must be float",
 			fmt.Sprintf("was %s", value),
 		)
 	}

datadog/resource_datadog_integration_aws.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 
 	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/utils"
+	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/validators"
 
 	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV1"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -33,9 +34,10 @@ func resourceDatadogIntegrationAws() *schema.Resource {
 		SchemaFunc: func() map[string]*schema.Schema {
 			return map[string]*schema.Schema{
 				"account_id": {
-					Description: "Your AWS Account ID without dashes.",
-					Type:        schema.TypeString,
-					Optional:    true,
+					Description:      "Your AWS Account ID without dashes.",
+					Type:             schema.TypeString,
+					Optional:         true,
+					ValidateDiagFunc: validators.ValidateAWSAccountID,
 				},
 				"role_name": {
 					Description:   "Your Datadog role delegation name.",

datadog/resource_datadog_integration_aws_lambda_arn.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/utils"
+	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/validators"
 
 	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV1"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -32,10 +33,11 @@ func resourceDatadogIntegrationAwsLambdaArn() *schema.Resource {
 		SchemaFunc: func() map[string]*schema.Schema {
 			return map[string]*schema.Schema{
 				"account_id": {
-					Description: "Your AWS Account ID without dashes.",
-					Type:        schema.TypeString,
-					Required:    true,
-					ForceNew:    true, // waits for update API call support
+					Description:      "Your AWS Account ID without dashes.",
+					Type:             schema.TypeString,
+					Required:         true,
+					ForceNew:         true, // waits for update API call support
+					ValidateDiagFunc: validators.ValidateAWSAccountID,
 				},
 				"lambda_arn": {
 					Description: "The ARN of the Datadog forwarder Lambda.",
@@ -73,7 +75,11 @@ func resourceDatadogIntegrationAwsLambdaArnCreate(ctx context.Context, d *schema
 
 	d.SetId(fmt.Sprintf("%s %s", attachLambdaArnRequest.GetAccountId(), attachLambdaArnRequest.GetLambdaArn()))
 
-	return resourceDatadogIntegrationAwsLambdaArnRead(ctx, d, meta)
+	readDiag := resourceDatadogIntegrationAwsLambdaArnRead(ctx, d, meta)
+	if !readDiag.HasError() && d.Id() == "" {
+		return diag.FromErr(fmt.Errorf("aws integration lambda arn with account id `%s` and lambda arn `%s` not found after creation", attachLambdaArnRequest.GetAccountId(), attachLambdaArnRequest.GetLambdaArn()))
+	}
+	return readDiag
 }
 
 func resourceDatadogIntegrationAwsLambdaArnRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {

datadog/resource_datadog_integration_aws_log_collection.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/utils"
+	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/validators"
 
 	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV1"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -25,10 +26,11 @@ func resourceDatadogIntegrationAwsLogCollection() *schema.Resource {
 		SchemaFunc: func() map[string]*schema.Schema {
 			return map[string]*schema.Schema{
 				"account_id": {
-					Description: "Your AWS Account ID without dashes.",
-					Type:        schema.TypeString,
-					Required:    true,
-					ForceNew:    true,
+					Description:      "Your AWS Account ID without dashes.",
+					Type:             schema.TypeString,
+					Required:         true,
+					ForceNew:         true,
+					ValidateDiagFunc: validators.ValidateAWSAccountID,
 				},
 				"services": {
 					Description: "A list of services to collect logs from. See the [api docs](https://docs.datadoghq.com/api/v1/aws-logs-integration/#get-list-of-aws-log-ready-services) for more details on which services are supported.",
@@ -78,7 +80,11 @@ func resourceDatadogIntegrationAwsLogCollectionCreate(ctx context.Context, d *sc
 
 	d.SetId(accountID)
 
-	return resourceDatadogIntegrationAwsLogCollectionRead(ctx, d, meta)
+	readDiag := resourceDatadogIntegrationAwsLogCollectionRead(ctx, d, meta)
+	if !readDiag.HasError() && d.Id() == "" {
+		return diag.FromErr(fmt.Errorf("aws integration log collection resource with account id `%s` not found after creation", accountID))
+	}
+	return readDiag
 }
 
 func resourceDatadogIntegrationAwsLogCollectionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -96,7 +102,11 @@ func resourceDatadogIntegrationAwsLogCollectionUpdate(ctx context.Context, d *sc
 		return utils.TranslateClientErrorDiag(err, httpresp, "error updating log collection services for Amazon Web Services integration account")
 	}
 
-	return resourceDatadogIntegrationAwsLogCollectionRead(ctx, d, meta)
+	readDiag := resourceDatadogIntegrationAwsLogCollectionRead(ctx, d, meta)
+	if !readDiag.HasError() && d.Id() == "" {
+		return diag.FromErr(fmt.Errorf("aws integration log collection resource with account id `%s` not found after creation", enableLogCollectionServices.GetAccountId()))
+	}
+	return readDiag
 }
 
 func resourceDatadogIntegrationAwsLogCollectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {

datadog/resource_datadog_integration_aws_tag_filter.go

@@ -29,6 +29,8 @@ func resourceDatadogIntegrationAwsTagFilter() *schema.Resource {
 					Description: "Your AWS Account ID without dashes.",
 					Type:        schema.TypeString,
 					Required:    true,
+					// TODO: When backend is ready, add validation back.
+					// ValidateDiagFunc: validators.ValidateAWSAccountID,
 				},
 				"namespace": {
 					Description:      "The namespace associated with the tag filter entry.",
@@ -76,7 +78,11 @@ func resourceDatadogIntegrationAwsTagFilterCreate(ctx context.Context, d *schema
 	}
 
 	d.SetId(fmt.Sprintf("%s:%s", req.GetAccountId(), req.GetNamespace()))
-	return resourceDatadogIntegrationAwsTagFilterRead(ctx, d, meta)
+	readDiag := resourceDatadogIntegrationAwsTagFilterRead(ctx, d, meta)
+	if !readDiag.HasError() && d.Id() == "" {
+		return diag.FromErr(fmt.Errorf("aws integration tag filter resource for account id `%s` with namespace `%s` not found after creation", req.GetAccountId(), req.GetNamespace()))
+	}
+	return readDiag
 }
 
 func resourceDatadogIntegrationAwsTagFilterUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -91,7 +97,11 @@ func resourceDatadogIntegrationAwsTagFilterUpdate(ctx context.Context, d *schema
 		return utils.TranslateClientErrorDiag(err, httpresp, "error updating aws tag filter")
 	}
 
-	return resourceDatadogIntegrationAwsTagFilterRead(ctx, d, meta)
+	readDiag := resourceDatadogIntegrationAwsTagFilterRead(ctx, d, meta)
+	if !readDiag.HasError() && d.Id() == "" {
+		return diag.FromErr(fmt.Errorf("aws integration tag filter resource for account id `%s` with namespace `%s` not found after creation", req.GetAccountId(), req.GetNamespace()))
+	}
+	return readDiag
 }
 
 func resourceDatadogIntegrationAwsTagFilterRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {

datadog/resource_datadog_logs_archive.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/utils"
+	"github.com/terraform-providers/terraform-provider-datadog/datadog/internal/validators"
 
 	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
 	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
@@ -34,10 +35,15 @@ func resourceDatadogLogsArchive() *schema.Resource {
 					Optional:    true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"bucket":     {Description: "Name of your s3 bucket.", Type: schema.TypeString, Required: true},
-							"path":       {Description: "Path where the archive is stored.", Type: schema.TypeString, Optional: true},
-							"account_id": {Description: "Your AWS account id.", Type: schema.TypeString, Required: true},
-							"role_name":  {Description: "Your AWS role name", Type: schema.TypeString, Required: true},
+							"bucket": {Description: "Name of your s3 bucket.", Type: schema.TypeString, Required: true},
+							"path":   {Description: "Path where the archive is stored.", Type: schema.TypeString, Optional: true},
+							"account_id": {
+								Description:      "Your AWS account id.",
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: validators.ValidateAWSAccountID,
+							},
+							"role_name": {Description: "Your AWS role name", Type: schema.TypeString, Required: true},
 						},
 					},
 				},

datadog/tests/cassettes/TestAccDatadogIntegrationAWSAccessKey.freeze

@@ -1 +1 @@
-2023-10-27T14:35:22.014995-04:00
+2023-12-11T09:35:33.429916-05:00