Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for S3 Object Lock legal holds #7179

Closed
wants to merge 6 commits into from
Closed

Add support for S3 Object Lock legal holds #7179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4231124
Add support for S3 Object Lock legal holds.
Jan 16, 2019
87e34d3
Reuse code from S3 object sweeper to delete object versions.
ewbankkit Feb 1, 2019
2db7de1
Rename 'aws_s3_bucket_object.force_delete' to 'aws_s3_bucket_object.f…
ewbankkit Feb 8, 2019
043b568
Remove delete markers when destroying an S3 object.
ewbankkit Feb 8, 2019
8a4e06d
Ensure that 'force_destroy' removes any locked objects.
ewbankkit Feb 8, 2019
6a39c96
Replace 'suppressUnsetContainerAttribute' with 'suppressMissingOption…
ewbankkit Jul 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 21 additions & 10 deletions aws/data_source_aws_s3_bucket_object.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,19 @@ func dataSourceAwsS3BucketObject() *schema.Resource {
},

"tags": tagsSchemaComputed(),

"legal_hold": {
Type: schema.TypeList,
Computed: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"status": {
Type: schema.TypeString,
Computed: true,
},
},
},
},
},
}
}
Expand Down Expand Up @@ -167,6 +180,14 @@ func dataSourceAwsS3BucketObjectRead(d *schema.ResourceData, meta interface{}) e
d.Set("storage_class", out.StorageClass)
}

if err := d.Set("legal_hold", flattenS3ObjectLockLegalHoldFromString(out.ObjectLockLegalHoldStatus)); err != nil {
return fmt.Errorf("error getting S3 object lock legal hold (bucket: %s, key: %s): %s", bucket, key, err)
}

if err := getTagsS3Object(conn, d); err != nil {
return fmt.Errorf("error getting S3 object tags (bucket: %s, key: %s): %s", bucket, key, err)
}

if isContentTypeAllowed(out.ContentType) {
input := s3.GetObjectInput{
Bucket: aws.String(bucket),
Expand Down Expand Up @@ -203,16 +224,6 @@ func dataSourceAwsS3BucketObjectRead(d *schema.ResourceData, meta interface{}) e
uniqueId, contentType)
}

tagResp, err := conn.GetObjectTagging(
&s3.GetObjectTaggingInput{
Bucket: aws.String(bucket),
Key: aws.String(key),
})
if err != nil {
return err
}
d.Set("tags", tagsToMapS3(tagResp.TagSet))

return nil
}

Expand Down
198 changes: 109 additions & 89 deletions aws/data_source_aws_s3_bucket_object_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ import (
)

func TestAccDataSourceAWSS3BucketObject_basic(t *testing.T) {
resourceName := "aws_s3_bucket_object.object"
dsName := "data.aws_s3_bucket_object.obj"
rInt := acctest.RandInt()
resourceOnlyConf, conf := testAccAWSDataSourceS3ObjectConfig_basic(rInt)

Expand All @@ -27,26 +29,30 @@ func TestAccDataSourceAWSS3BucketObject_basic(t *testing.T) {
{
Config: resourceOnlyConf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSS3BucketObjectExists("aws_s3_bucket_object.object", &rObj),
testAccCheckAWSS3BucketObjectExists(resourceName, &rObj),
),
},
{
Config: conf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsS3ObjectDataSourceExists("data.aws_s3_bucket_object.obj", &dsObj),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_length", "11"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_type", "binary/octet-stream"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "etag", "b10a8db164e0754105b7a99be72e3fe5"),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "last_modified",
testAccCheckAwsS3ObjectDataSourceExists(dsName, &dsObj),
resource.TestCheckResourceAttr(dsName, "content_length", "11"),
resource.TestCheckResourceAttr(dsName, "content_type", "binary/octet-stream"),
resource.TestCheckResourceAttr(dsName, "etag", "b10a8db164e0754105b7a99be72e3fe5"),
resource.TestMatchResourceAttr(dsName, "last_modified",
regexp.MustCompile("^[a-zA-Z]{3}, [0-9]+ [a-zA-Z]+ [0-9]{4} [0-9:]+ [A-Z]+$")),
resource.TestCheckNoResourceAttr("data.aws_s3_bucket_object.obj", "body"),
resource.TestCheckNoResourceAttr(dsName, "body"),
resource.TestCheckResourceAttr(dsName, "legal_hold.#", "0"),
resource.TestCheckResourceAttr(dsName, "tags.%", "0"),
),
},
},
})
}

func TestAccDataSourceAWSS3BucketObject_readableBody(t *testing.T) {
resourceName := "aws_s3_bucket_object.object"
dsName := "data.aws_s3_bucket_object.obj"
rInt := acctest.RandInt()
resourceOnlyConf, conf := testAccAWSDataSourceS3ObjectConfig_readableBody(rInt)

Expand All @@ -61,26 +67,28 @@ func TestAccDataSourceAWSS3BucketObject_readableBody(t *testing.T) {
{
Config: resourceOnlyConf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSS3BucketObjectExists("aws_s3_bucket_object.object", &rObj),
testAccCheckAWSS3BucketObjectExists(resourceName, &rObj),
),
},
{
Config: conf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsS3ObjectDataSourceExists("data.aws_s3_bucket_object.obj", &dsObj),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_length", "3"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_type", "text/plain"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "etag", "a6105c0a611b41b08f1209506350279e"),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "last_modified",
testAccCheckAwsS3ObjectDataSourceExists(dsName, &dsObj),
resource.TestCheckResourceAttr(dsName, "content_length", "3"),
resource.TestCheckResourceAttr(dsName, "content_type", "text/plain"),
resource.TestCheckResourceAttr(dsName, "etag", "a6105c0a611b41b08f1209506350279e"),
resource.TestMatchResourceAttr(dsName, "last_modified",
regexp.MustCompile("^[a-zA-Z]{3}, [0-9]+ [a-zA-Z]+ [0-9]{4} [0-9:]+ [A-Z]+$")),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "body", "yes"),
resource.TestCheckResourceAttr(dsName, "body", "yes"),
),
},
},
})
}

func TestAccDataSourceAWSS3BucketObject_kmsEncrypted(t *testing.T) {
resourceName := "aws_s3_bucket_object.object"
dsName := "data.aws_s3_bucket_object.obj"
rInt := acctest.RandInt()
resourceOnlyConf, conf := testAccAWSDataSourceS3ObjectConfig_kmsEncrypted(rInt)

Expand All @@ -95,29 +103,31 @@ func TestAccDataSourceAWSS3BucketObject_kmsEncrypted(t *testing.T) {
{
Config: resourceOnlyConf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSS3BucketObjectExists("aws_s3_bucket_object.object", &rObj),
testAccCheckAWSS3BucketObjectExists(resourceName, &rObj),
),
},
{
Config: conf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsS3ObjectDataSourceExists("data.aws_s3_bucket_object.obj", &dsObj),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_length", "22"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_type", "text/plain"),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "etag", regexp.MustCompile("^[a-f0-9]{32}$")),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "server_side_encryption", "aws:kms"),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "sse_kms_key_id",
testAccCheckAwsS3ObjectDataSourceExists(dsName, &dsObj),
resource.TestCheckResourceAttr(dsName, "content_length", "22"),
resource.TestCheckResourceAttr(dsName, "content_type", "text/plain"),
resource.TestMatchResourceAttr(dsName, "etag", regexp.MustCompile("^[a-f0-9]{32}$")),
resource.TestCheckResourceAttr(dsName, "server_side_encryption", "aws:kms"),
resource.TestMatchResourceAttr(dsName, "sse_kms_key_id",
regexp.MustCompile(`^arn:aws:kms:[a-z]{2}-[a-z]+-\d{1}:[0-9]{12}:key/[a-z0-9-]{36}$`)),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "last_modified",
resource.TestMatchResourceAttr(dsName, "last_modified",
regexp.MustCompile("^[a-zA-Z]{3}, [0-9]+ [a-zA-Z]+ [0-9]{4} [0-9:]+ [A-Z]+$")),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "body", "Keep Calm and Carry On"),
resource.TestCheckResourceAttr(dsName, "body", "Keep Calm and Carry On"),
),
},
},
})
}

func TestAccDataSourceAWSS3BucketObject_allParams(t *testing.T) {
resourceName := "aws_s3_bucket_object.object"
dsName := "data.aws_s3_bucket_object.obj"
rInt := acctest.RandInt()
resourceOnlyConf, conf := testAccAWSDataSourceS3ObjectConfig_allParams(rInt)

Expand All @@ -132,35 +142,38 @@ func TestAccDataSourceAWSS3BucketObject_allParams(t *testing.T) {
{
Config: resourceOnlyConf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSS3BucketObjectExists("aws_s3_bucket_object.object", &rObj),
testAccCheckAWSS3BucketObjectExists(resourceName, &rObj),
),
},
{
Config: conf,
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsS3ObjectDataSourceExists("data.aws_s3_bucket_object.obj", &dsObj),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_length", "21"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_type", "application/unknown"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "etag", "723f7a6ac0c57b445790914668f98640"),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "last_modified",
testAccCheckAwsS3ObjectDataSourceExists(dsName, &dsObj),
resource.TestCheckResourceAttr(dsName, "content_length", "21"),
resource.TestCheckResourceAttr(dsName, "content_type", "application/unknown"),
resource.TestCheckResourceAttr(dsName, "etag", "723f7a6ac0c57b445790914668f98640"),
resource.TestMatchResourceAttr(dsName, "last_modified",
regexp.MustCompile("^[a-zA-Z]{3}, [0-9]+ [a-zA-Z]+ [0-9]{4} [0-9:]+ [A-Z]+$")),
resource.TestMatchResourceAttr("data.aws_s3_bucket_object.obj", "version_id", regexp.MustCompile("^.{32}$")),
resource.TestCheckNoResourceAttr("data.aws_s3_bucket_object.obj", "body"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "cache_control", "no-cache"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_disposition", "attachment"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_encoding", "identity"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "content_language", "en-GB"),
resource.TestMatchResourceAttr(dsName, "version_id", regexp.MustCompile("^.{32}$")),
resource.TestCheckNoResourceAttr(dsName, "body"),
resource.TestCheckResourceAttr(dsName, "cache_control", "no-cache"),
resource.TestCheckResourceAttr(dsName, "content_disposition", "attachment"),
resource.TestCheckResourceAttr(dsName, "content_encoding", "identity"),
resource.TestCheckResourceAttr(dsName, "content_language", "en-GB"),
// Encryption is off
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "server_side_encryption", ""),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "sse_kms_key_id", ""),
resource.TestCheckResourceAttr(dsName, "server_side_encryption", ""),
resource.TestCheckResourceAttr(dsName, "sse_kms_key_id", ""),
// Supported, but difficult to reproduce in short testing time
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "storage_class", "STANDARD"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "expiration", ""),
resource.TestCheckResourceAttr(dsName, "storage_class", "STANDARD"),
resource.TestCheckResourceAttr(dsName, "expiration", ""),
// Currently unsupported in aws_s3_bucket_object resource
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "expires", ""),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "website_redirect_location", ""),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "metadata.%", "0"),
resource.TestCheckResourceAttr("data.aws_s3_bucket_object.obj", "tags.%", "1"),
resource.TestCheckResourceAttr(dsName, "expires", ""),
resource.TestCheckResourceAttr(dsName, "website_redirect_location", ""),
resource.TestCheckResourceAttr(dsName, "metadata.%", "0"),
resource.TestCheckResourceAttr(dsName, "tags.%", "1"),
resource.TestCheckResourceAttr(dsName, "tags.Key1", "Value 1"),
resource.TestCheckResourceAttr(dsName, "legal_hold.#", "1"),
resource.TestCheckResourceAttr(dsName, "legal_hold.0.status", "ON"),
),
},
},
Expand Down Expand Up @@ -198,108 +211,115 @@ func testAccCheckAwsS3ObjectDataSourceExists(n string, obj *s3.GetObjectOutput)
func testAccAWSDataSourceS3ObjectConfig_basic(randInt int) (string, string) {
resources := fmt.Sprintf(`
resource "aws_s3_bucket" "object_bucket" {
bucket = "tf-object-test-bucket-%d"
bucket = "tf-object-test-bucket-%d"
}

resource "aws_s3_bucket_object" "object" {
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d"
content = "Hello World"
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d"
content = "Hello World"
}
`, randInt, randInt)

both := fmt.Sprintf(`%s
data "aws_s3_bucket_object" "obj" {
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d"
}
`, resources, randInt, randInt)
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d"
}`, resources, randInt, randInt)

return resources, both
}

func testAccAWSDataSourceS3ObjectConfig_readableBody(randInt int) (string, string) {
resources := fmt.Sprintf(`
resource "aws_s3_bucket" "object_bucket" {
bucket = "tf-object-test-bucket-%d"
bucket = "tf-object-test-bucket-%d"
}

resource "aws_s3_bucket_object" "object" {
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-readable"
content = "yes"
content_type = "text/plain"
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-readable"
content = "yes"
content_type = "text/plain"
}
`, randInt, randInt)

both := fmt.Sprintf(`%s
data "aws_s3_bucket_object" "obj" {
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-readable"
}
`, resources, randInt, randInt)
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-readable"
}`, resources, randInt, randInt)

return resources, both
}

func testAccAWSDataSourceS3ObjectConfig_kmsEncrypted(randInt int) (string, string) {
resources := fmt.Sprintf(`
resource "aws_s3_bucket" "object_bucket" {
bucket = "tf-object-test-bucket-%d"
bucket = "tf-object-test-bucket-%d"
}

resource "aws_kms_key" "example" {
description = "TF Acceptance Test KMS key"
deletion_window_in_days = 7
}

resource "aws_s3_bucket_object" "object" {
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-encrypted"
content = "Keep Calm and Carry On"
content_type = "text/plain"
kms_key_id = "${aws_kms_key.example.arn}"
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-encrypted"
content = "Keep Calm and Carry On"
content_type = "text/plain"
kms_key_id = "${aws_kms_key.example.arn}"
}
`, randInt, randInt)

both := fmt.Sprintf(`%s
data "aws_s3_bucket_object" "obj" {
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-encrypted"
}
`, resources, randInt, randInt)
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-encrypted"
}`, resources, randInt, randInt)

return resources, both
}

func testAccAWSDataSourceS3ObjectConfig_allParams(randInt int) (string, string) {
resources := fmt.Sprintf(`
resource "aws_s3_bucket" "object_bucket" {
bucket = "tf-object-test-bucket-%d"
versioning {
enabled = true
}
bucket = "tf-object-test-bucket-%d"
versioning {
enabled = true
}
object_lock_configuration {
object_lock_enabled = "Enabled"
}
}

resource "aws_s3_bucket_object" "object" {
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-all-params"
content = <<CONTENT
bucket = "${aws_s3_bucket.object_bucket.bucket}"
key = "tf-testing-obj-%d-all-params"
content = <<CONTENT
{"msg": "Hi there!"}
CONTENT
content_type = "application/unknown"
cache_control = "no-cache"
content_disposition = "attachment"
content_encoding = "identity"
content_language = "en-GB"
tags = {
Key1 = "Value 1"
}
content_type = "application/unknown"
cache_control = "no-cache"
content_disposition = "attachment"
content_encoding = "identity"
content_language = "en-GB"
tags = {
Key1 = "Value 1"
}
legal_hold {
status = "ON"
}
force_destroy = true
}
`, randInt, randInt)

both := fmt.Sprintf(`%s
data "aws_s3_bucket_object" "obj" {
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-all-params"
}
`, resources, randInt, randInt)
bucket = "tf-object-test-bucket-%d"
key = "tf-testing-obj-%d-all-params"
}`, resources, randInt, randInt)

return resources, both
}
Loading