diff --git a/builtin/providers/aws/resource_aws_iam_group_membership.go b/builtin/providers/aws/resource_aws_iam_group_membership.go index 21d8f8733..10556567c 100644 --- a/builtin/providers/aws/resource_aws_iam_group_membership.go +++ b/builtin/providers/aws/resource_aws_iam_group_membership.go @@ -1,11 +1,12 @@ package aws import ( + "fmt" "log" "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/service/iam" - "github.com/hashicorp/terraform/helper/resource" "github.com/hashicorp/terraform/helper/schema" ) @@ -17,12 +18,20 @@ func resourceAwsIamGroupMembership() *schema.Resource { Delete: resourceAwsIamGroupMembershipDelete, Schema: map[string]*schema.Schema{ - "user_name": &schema.Schema{ + "name": &schema.Schema{ Type: schema.TypeString, Required: true, ForceNew: true, }, - "group_name": &schema.Schema{ + + "users": &schema.Schema{ + Type: schema.TypeSet, + Required: true, + Elem: &schema.Schema{Type: schema.TypeString}, + Set: schema.HashString, + }, + + "group": &schema.Schema{ Type: schema.TypeString, Required: true, ForceNew: true, @@ -34,44 +43,47 @@ func resourceAwsIamGroupMembership() *schema.Resource { func resourceAwsIamGroupMembershipCreate(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).iamconn - _, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{ - UserName: aws.String(d.Get("user_name").(string)), - GroupName: aws.String(d.Get("group_name").(string)), - }) + userList := expandStringList(d.Get("users").(*schema.Set).List()) + group := d.Get("group").(string) - if err != nil { - return err + for _, u := range userList { + _, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{ + UserName: u, + GroupName: aws.String(group), + }) + + if err != nil { + return err + } } - d.SetId(resource.UniqueId()) + d.SetId(d.Get("name").(string)) return resourceAwsIamGroupMembershipRead(d, meta) } func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).iamconn - u := d.Get("user_name").(string) - resp, err := conn.ListGroupsForUser(&iam.ListGroupsForUserInput{ - UserName: aws.String(u), + resp, err := conn.GetGroup(&iam.GetGroupInput{ + GroupName: aws.String(d.Get("group").(string)), }) if err != nil { + if awsErr, ok := err.(awserr.Error); ok { + // aws specific error + log.Printf("\n\n------\n AWS Error: %s :::: %s", awsErr.Code(), awsErr.Message()) + // group not found + d.SetId("") + } return err } - d.Set("user_name", u) - - gn := d.Get("group_name").(string) - var group *iam.Group - for _, g := range resp.Groups { - if gn == *g.GroupName { - group = g - } + ul := make([]string, 0, len(resp.Users)) + for _, u := range resp.Users { + ul = append(ul, *u.UserName) } - if group == nil { - // if not found, set to "" - log.Printf("[DEBUG] Group (%s) not found for User (%s)", u, gn) - d.SetId("") + if err := d.Set("users", ul); err != nil { + return fmt.Errorf("[WARN] Error setting user list from IAM Group Membership (%s), error: %s", err) } return nil @@ -79,13 +91,18 @@ func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{}) func resourceAwsIamGroupMembershipDelete(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).iamconn - _, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{ - UserName: aws.String(d.Get("user_name").(string)), - GroupName: aws.String(d.Get("group_name").(string)), - }) + userList := expandStringList(d.Get("users").(*schema.Set).List()) + group := d.Get("group").(string) - if err != nil { - return err + for _, u := range userList { + _, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{ + UserName: u, + GroupName: aws.String(group), + }) + + if err != nil { + return err + } } d.SetId("") diff --git a/builtin/providers/aws/resource_aws_iam_group_membership_test.go b/builtin/providers/aws/resource_aws_iam_group_membership_test.go index 41b04ea51..a24ac1a74 100644 --- a/builtin/providers/aws/resource_aws_iam_group_membership_test.go +++ b/builtin/providers/aws/resource_aws_iam_group_membership_test.go @@ -30,7 +30,7 @@ func TestAccAWSGroupMembership_basic(t *testing.T) { } func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error { - iamconn := testAccProvider.Meta().(*AWSClient).iamconn + conn := testAccProvider.Meta().(*AWSClient).iamconn for _, rs := range s.RootModule().Resources { if rs.Type != "aws_iam_group_membership" { @@ -38,22 +38,17 @@ func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error { } // Try to get user - user := rs.Primary.Attributes["user_name"] - group := rs.Primary.Attributes["group_name"] + group := rs.Primary.Attributes["group"] - resp, err := iamconn.ListGroupsForUser(&iam.ListGroupsForUserInput{ - UserName: aws.String(user), + _, err := conn.GetGroup(&iam.GetGroupInput{ + GroupName: aws.String(group), }) if err != nil { // might error here return err } - for _, g := range resp.Groups { - if group == *g.GroupName { - return fmt.Errorf("Error: User (%s) is still a memeber of Group (%s)", user, group) - } - } + return fmt.Errorf("Error: Group (%s) still exists", group) } @@ -71,25 +66,20 @@ func testAccCheckAWSGroupMembershipExists(n string, g *iam.Group) resource.TestC return fmt.Errorf("No User name is set") } - iamconn := testAccProvider.Meta().(*AWSClient).iamconn - user := rs.Primary.Attributes["user_name"] - gn := rs.Primary.Attributes["group_name"] + conn := testAccProvider.Meta().(*AWSClient).iamconn + gn := rs.Primary.Attributes["group"] - resp, err := iamconn.ListGroupsForUser(&iam.ListGroupsForUserInput{ - UserName: aws.String(user), + resp, err := conn.GetGroup(&iam.GetGroupInput{ + GroupName: aws.String(gn), }) + if err != nil { - return err + return fmt.Errorf("Error: Group (%s) not found", gn) } - for _, i := range resp.Groups { - if gn == *i.GroupName { - *g = *i - return nil - } - } + *g = *resp.Group - return fmt.Errorf("Error: User (%s) not a member of Group (%s)", user, gn) + return nil } } @@ -114,7 +104,8 @@ resource "aws_iam_user" "user" { } resource "aws_iam_group_membership" "team" { - user_name = "${aws_iam_user.user.name}" - group_name = "${aws_iam_group.group.name}" + name = "tf-testing-group-membership" + users = ["${aws_iam_user.user.name}"] + group = "${aws_iam_group.group.name}" } `