refactor: Migrate mongodbatlas_encryption_at_rest to Terraform Plugin Framework

mongodbatlas/framework/validator/aws_kms_config_validator.go

@@ -0,0 +1,54 @@
+package validator
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+)
+
+type awsKmsConfigValidator struct{}
+
+func (v awsKmsConfigValidator) Description(_ context.Context) string {
+	return "for credentials: `access_key_id` and `secret_access_key` are allowed but not `role_id`." +
+		" For roles: `access_key_id` and `secret_access_key` are not allowed but `role_id` is allowed"
+}
+
+func (v awsKmsConfigValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+func (v awsKmsConfigValidator) ValidateObject(ctx context.Context, req validator.ObjectRequest, response *validator.ObjectResponse) {
+	// If the value is unknown or null, there is nothing to validate.
+	if req.ConfigValue.IsUnknown() || req.ConfigValue.IsNull() {
+		return
+	}
+
+	obj, diag := req.ConfigValue.ToObjectValue(ctx)
+	if diag.HasError() {
+		response.Diagnostics.Append(diag.Errors()...)
+		return
+	}
+
+	attrMap := obj.Attributes()
+	ak, akOk := attrMap["access_key_id"]
+	sa, saOk := attrMap["secret_access_key"]
+	r, rOk := attrMap["role_id"]
+	accessKeyDefined := akOk && !ak.IsNull()
+	secretAccessKeyDefined := saOk && !sa.IsNull()
+	roleIDDefined := rOk && !r.IsNull()
+
+	if (accessKeyDefined && secretAccessKeyDefined && roleIDDefined) ||
+		(accessKeyDefined && roleIDDefined) ||
+		(secretAccessKeyDefined && roleIDDefined) {
+		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
+			req.Path,
+			v.Description(ctx),
+			req.ConfigValue.String(),
+		))
+	}
+}
+
+func AwsKmsConfig() validator.Object {
+	return awsKmsConfigValidator{}
+}

mongodbatlas/framework/validator/aws_kms_config_validator_test.go

@@ -0,0 +1,105 @@
+package validator
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func TestValidAwsKmsConfig(t *testing.T) {
+	enabled := true
+	validType1 := map[string]attr.Type{
+		"enabled":                types.BoolType,
+		"customer_master_key_id": types.StringType,
+		"region":                 types.StringType,
+		"role_id":                types.StringType,
+	}
+	validValue1 := map[string]attr.Value{
+		"enabled":                types.BoolValue(enabled),
+		"customer_master_key_id": types.StringValue("testCustomerMasterKeyID"),
+		"region":                 types.StringValue("testRegion"),
+		"role_id":                types.StringValue("testRoleID"),
+	}
+	validType2 := map[string]attr.Type{
+		"enabled":                types.BoolType,
+		"access_key_id":          types.StringType,
+		"secret_access_key":      types.StringType,
+		"customer_master_key_id": types.StringType,
+		"region":                 types.StringType,
+	}
+	validValue2 := map[string]attr.Value{
+		"enabled":                types.BoolValue(enabled),
+		"access_key_id":          types.StringValue("testAccessKey"),
+		"secret_access_key":      types.StringValue("testSecretAccessKey"),
+		"customer_master_key_id": types.StringValue("testCustomerMasterKeyID"),
+		"region":                 types.StringValue("testRegion"),
+	}
+	inValidType := map[string]attr.Type{
+		"enabled":                types.BoolType,
+		"access_key_id":          types.StringType,
+		"secret_access_key":      types.StringType,
+		"customer_master_key_id": types.StringType,
+		"region":                 types.StringType,
+		"role_id":                types.StringType,
+	}
+	inValidValue := map[string]attr.Value{
+		"enabled":                types.BoolValue(enabled),
+		"access_key_id":          types.StringValue("testAccessKey"),
+		"secret_access_key":      types.StringValue("testSecretAccessKey"),
+		"customer_master_key_id": types.StringValue("testCustomerMasterKeyID"),
+		"region":                 types.StringValue("testRegion"),
+		"role_id":                types.StringValue("testRoleID"),
+	}
+
+	tests := []struct {
+		awsKmsConfigValue map[string]attr.Value
+		awsKmsConfigType  map[string]attr.Type
+		name              string
+		wantErr           bool
+	}{
+		{
+			name:              "Valid Value 1",
+			awsKmsConfigValue: validValue1,
+			awsKmsConfigType:  validType1,
+			wantErr:           false,
+		},
+		{
+			name:              "Valid Value 2",
+			awsKmsConfigValue: validValue2,
+			awsKmsConfigType:  validType2,
+			wantErr:           false,
+		},
+		{
+			name:              "Invalid Value",
+			awsKmsConfigValue: inValidValue,
+			awsKmsConfigType:  inValidType,
+			wantErr:           true,
+		},
+	}
+
+	for _, tt := range tests {
+		wantErr := tt.wantErr
+
+		awsKmsConfigValidator := awsKmsConfigValidator{}
+		validatorRequest := validator.ObjectRequest{
+			ConfigValue: types.ObjectValueMust(tt.awsKmsConfigType, tt.awsKmsConfigValue),
+		}
+
+		validatorResponse := validator.ObjectResponse{
+			Diagnostics: diag.Diagnostics{},
+		}
+
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			awsKmsConfigValidator.ValidateObject(context.Background(), validatorRequest, &validatorResponse)
+
+			if validatorResponse.Diagnostics.HasError() && !wantErr {
+				t.Errorf("error = %v, wantErr %v", validatorResponse.Diagnostics.Errors(), wantErr)
+			}
+		})
+	}
+}

mongodbatlas/fw_provider.go

@@ -22,6 +22,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-mux/tf5to6server"
 	"github.com/hashicorp/terraform-plugin-mux/tf6muxserver"
 	sdkv2schema "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
 	cstmvalidator "github.com/mongodb/terraform-provider-mongodbatlas/mongodbatlas/framework/validator"
 	"github.com/mongodb/terraform-provider-mongodbatlas/version"
 )
@@ -378,6 +379,7 @@ func (p *MongodbtlasProvider) DataSources(context.Context) []func() datasource.D
 func (p *MongodbtlasProvider) Resources(context.Context) []func() resource.Resource {
 	return []func() resource.Resource{
 		NewProjectRS,
+		NewEncryptionAtRestRS,
 		NewDatabaseUserRS,
 		NewAlertConfigurationRS,
 	}