Add `iam_groups` to `vault_aws_secret_backend_role` #826

lawliet89 · 2020-07-22T07:25:47Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

Add `iam_groups` to `vault_aws_secret_backend_role`

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSSecretBackendRole'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run=TestAccAWSSecretBackendRole -timeout 120m
?       github.com/terraform-providers/terraform-provider-vault [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/coverage    [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/generate    [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/codegen (cached) [no tests to run]
?       github.com/terraform-providers/terraform-provider-vault/generated       [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/datasources/transform/decode  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/datasources/transform/encode  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/alphabet  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/role      (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/template  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/transformation    (cached) [no tests to run]
?       github.com/terraform-providers/terraform-provider-vault/schema  [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/util    (cached) [no tests to run]
=== RUN   TestAccAWSSecretBackendRole_basic
--- PASS: TestAccAWSSecretBackendRole_basic (0.41s)
=== RUN   TestAccAWSSecretBackendRole_import
--- PASS: TestAccAWSSecretBackendRole_import (0.32s)
=== RUN   TestAccAWSSecretBackendRole_nested
--- PASS: TestAccAWSSecretBackendRole_nested (0.33s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   (cached)

...

tvoran

Thanks for adding this! It's looking ok, though the spacing/tabs seems a bit off in the tests?

vault/resource_aws_secret_backend_role_test.go

Co-authored-by: Theron Voran <[email protected]>

lawliet89 · 2020-08-16T09:12:36Z

Thanks. The spacing/tabs is hard to differentiate in my VSCode.

tvoran

So I noticed while trying this out that removing the iam_groups from a role doesn't work quite right. Turns out it's because of the check for iamGroups of length 0 before setting that parameter in the data. I left a couple suggestions to fix this, and I think this will need another test step in TestAccAWSSecretBackendRole_basic() that tries removing the iam_groups.

(It looks like this is also an issue with policy_arns, so it's not surprising you ran into it.)

vault/resource_aws_secret_backend_role.go

Co-authored-by: Theron Voran <[email protected]>

lawliet89 · 2020-08-19T02:19:45Z

Thanks for the suggestion.

I asked a member of the Vault team before and they said that if you send a parameter to a version of Vault that does not support it (in this case < 1.4), Vault would ignore it.

I think we might be able to simplify this by always sending the parameter whether the list is empty or not.

$ VAULT_ADDR=http://127.0.0.1:8200 VAULT_TOKEN=12345 AWS_ACCESS_KEY_ID=12345 AWS_SECRET_ACCESS_KEY=12345 make testacc TESTARGS='-run=TestAccAWSSecretBackendRole_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run=TestAccAWSSecretBackendRole_basic -timeout 120m
?       github.com/terraform-providers/terraform-provider-vault [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/coverage    [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/generate    [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/codegen (cached) [no tests to run]
?       github.com/terraform-providers/terraform-provider-vault/generated       [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/datasources/transform/decode  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/datasources/transform/encode  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/alphabet  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/role      (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/template  (cached) [no tests to run]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/generated/resources/transform/transformation    (cached) [no tests to run]
?       github.com/terraform-providers/terraform-provider-vault/schema  [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/util    (cached) [no tests to run]
=== RUN   TestAccAWSSecretBackendRole_basic
--- PASS: TestAccAWSSecretBackendRole_basic (0.55s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   0.577s

Test failures seem to be in

=== RUN   TestAccIdentityGroupMemberEntityIdsExclusive

--- FAIL: TestAccIdentityGroupMemberEntityIdsExclusive (0.23s)

    testing.go:640: Step 1 error: Check failed: Check 3/3 error: vault_identity_group_member_entity_ids.member_entity_ids: Attribute 'member_entity_ids.#' expected "1", got "2"

=== RUN   TestAccIdentityGroupMemberEntityIdsNonExclusiveEmpty

--- PASS: TestAccIdentityGroupMemberEntityIdsNonExclusiveEmpty (0.37s)

=== RUN   TestAccIdentityGroupMemberEntityIdsNonExclusive

--- FAIL: TestAccIdentityGroupMemberEntityIdsNonExclusive (0.23s)

    testing.go:640: Step 1 error: Check failed: Check 4/5 error: vault_identity_group_member_entity_ids.test: Attribute 'member_entity_ids.#' found when not expected

These tests seem to be quite flaky.

tvoran

Yep, I'm seeing flakiness with those tests too, though I did have all of them pass locally (along with the AWS tests) so I think we're good.

catsby · 2020-08-28T11:34:38Z

Hello all - this was released in v2.13.0 , thanks for the contribution and your patience!

Add iam_groups to vault_aws_secret_backend_role

c5826c7

ghost added size/M documentation labels Jul 22, 2020

kalafut requested a review from tvoran August 11, 2020 03:35

tvoran reviewed Aug 15, 2020

View reviewed changes

vault/resource_aws_secret_backend_role_test.go Outdated Show resolved Hide resolved

vault/resource_aws_secret_backend_role_test.go Outdated Show resolved Hide resolved

vault/resource_aws_secret_backend_role_test.go Outdated Show resolved Hide resolved

Apply suggestions from code review

9c6a3b5

Co-authored-by: Theron Voran <[email protected]>

calvn approved these changes Aug 17, 2020

View reviewed changes

tvoran requested changes Aug 19, 2020

View reviewed changes

vault/resource_aws_secret_backend_role.go Outdated Show resolved Hide resolved

vault/resource_aws_secret_backend_role.go Outdated Show resolved Hide resolved

lawliet89 and others added 2 commits August 19, 2020 10:14

Apply suggestions from code review

af7788b

Co-authored-by: Theron Voran <[email protected]>

Add test step

da9da8d

lawliet89 requested a review from tvoran August 19, 2020 02:23

tvoran approved these changes Aug 19, 2020

View reviewed changes

tvoran merged commit 43e03cf into hashicorp:master Aug 19, 2020

lawliet89 deleted the aws-groups branch August 20, 2020 02:03

dandandy pushed a commit to dandandy/terraform-provider-vault that referenced this pull request Jun 17, 2021

Add iam_groups to vault_aws_secret_backend_role (hashicorp#826)

17a80e2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `iam_groups` to `vault_aws_secret_backend_role` #826

Add `iam_groups` to `vault_aws_secret_backend_role` #826

lawliet89 commented Jul 22, 2020

tvoran left a comment

lawliet89 commented Aug 16, 2020

tvoran left a comment

lawliet89 commented Aug 19, 2020 •

edited

Loading

tvoran left a comment

catsby commented Aug 28, 2020

Add iam_groups to vault_aws_secret_backend_role #826

Add iam_groups to vault_aws_secret_backend_role #826

Conversation

lawliet89 commented Jul 22, 2020

Community Note

tvoran left a comment

Choose a reason for hiding this comment

lawliet89 commented Aug 16, 2020

tvoran left a comment

Choose a reason for hiding this comment

lawliet89 commented Aug 19, 2020 • edited Loading

tvoran left a comment

Choose a reason for hiding this comment

catsby commented Aug 28, 2020

Add `iam_groups` to `vault_aws_secret_backend_role` #826

Add `iam_groups` to `vault_aws_secret_backend_role` #826

lawliet89 commented Aug 19, 2020 •

edited

Loading