package aws import ( "fmt" "github.com/aws/aws-sdk-go/service/ec2" "github.com/hashicorp/errwrap" "github.com/hashicorp/terraform/helper/schema" ) // Security group import fans out to multiple resources due to the // security group rules. Instead of creating one resource with nested // rules, we use the best practices approach of one resource per rule. func resourceAwsSecurityGroupImportState( d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) { conn := meta.(*AWSClient).ec2conn // First query the security group sgRaw, _, err := SGStateRefreshFunc(conn, d.Id())() if err != nil { return nil, err } if sgRaw == nil { return nil, fmt.Errorf("security group not found") } sg := sgRaw.(*ec2.SecurityGroup) // Start building our results results := make([]*schema.ResourceData, 1, 1+len(sg.IpPermissions)+len(sg.IpPermissionsEgress)) results[0] = d // Construct the rules permMap := map[string][]*ec2.IpPermission{ "ingress": sg.IpPermissions, "egress": sg.IpPermissionsEgress, } for ruleType, perms := range permMap { for _, perm := range perms { ds, err := resourceAwsSecurityGroupImportStatePerm(sg, ruleType, perm) if err != nil { return nil, err } results = append(results, ds...) } } return results, nil } func resourceAwsSecurityGroupImportStatePerm(sg *ec2.SecurityGroup, ruleType string, perm *ec2.IpPermission) ([]*schema.ResourceData, error) { var result []*schema.ResourceData if len(perm.UserIdGroupPairs) == 0 { r, err := resourceAwsSecurityGroupImportStatePermPair(sg, ruleType, perm) if err != nil { return nil, err } result = append(result, r) } else { // If the rule contained more than one source security group, this // will iterate over them and create one rule for each // source security group. for _, pair := range perm.UserIdGroupPairs { p := &ec2.IpPermission{ FromPort: perm.FromPort, IpProtocol: perm.IpProtocol, PrefixListIds: perm.PrefixListIds, ToPort: perm.ToPort, UserIdGroupPairs: []*ec2.UserIdGroupPair{pair}, } if perm.Ipv6Ranges != nil { p.Ipv6Ranges = perm.Ipv6Ranges } if perm.IpRanges != nil { p.IpRanges = perm.IpRanges } r, err := resourceAwsSecurityGroupImportStatePermPair(sg, ruleType, p) if err != nil { return nil, err } result = append(result, r) } } return result, nil } func resourceAwsSecurityGroupImportStatePermPair(sg *ec2.SecurityGroup, ruleType string, perm *ec2.IpPermission) (*schema.ResourceData, error) { // Construct the rule. We do this by populating the absolute // minimum necessary for Refresh on the rule to work. This // happens to be a lot of fields since they're almost all needed // for de-dupping. sgId := sg.GroupId id := ipPermissionIDHash(*sgId, ruleType, perm) ruleResource := resourceAwsSecurityGroupRule() d := ruleResource.Data(nil) d.SetId(id) d.SetType("aws_security_group_rule") d.Set("security_group_id", sgId) d.Set("type", ruleType) // 'self' is false by default. Below, we range over the group ids and set true // if the parent sg id is found d.Set("self", false) if len(perm.UserIdGroupPairs) > 0 { s := perm.UserIdGroupPairs[0] // Check for Pair that is the same as the Security Group, to denote self. // Otherwise, mark the group id in source_security_group_id isVPC := sg.VpcId != nil && *sg.VpcId != "" if isVPC { if *s.GroupId == *sg.GroupId { d.Set("self", true) // prune the self reference from the UserIdGroupPairs, so we don't // have duplicate sg ids (both self and in source_security_group_id) perm.UserIdGroupPairs = append(perm.UserIdGroupPairs[:0], perm.UserIdGroupPairs[0+1:]...) } } else { if *s.GroupName == *sg.GroupName { d.Set("self", true) // prune the self reference from the UserIdGroupPairs, so we don't // have duplicate sg ids (both self and in source_security_group_id) perm.UserIdGroupPairs = append(perm.UserIdGroupPairs[:0], perm.UserIdGroupPairs[0+1:]...) } } } if err := setFromIPPerm(d, sg, perm); err != nil { return nil, errwrap.Wrapf("Error importing AWS Security Group: {{err}}", err) } return d, nil }