Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix linters / Retest on AWS provider V5 #188

Merged
merged 2 commits into from
Jun 1, 2023
Merged

Fix linters / Retest on AWS provider V5 #188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
59cfd83
precommit/terraform
max-lobur Jun 1, 2023
890f5c1
bump test timeout
max-lobur Jun 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/complete/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ module "s3_bucket" {
bucket_name = var.bucket_name
object_lock_configuration = var.object_lock_configuration
s3_replication_enabled = local.s3_replication_enabled
s3_replica_bucket_arn = join("", module.s3_bucket_replication_target.*.bucket_arn)
s3_replica_bucket_arn = join("", module.s3_bucket_replication_target[*].bucket_arn)
s3_replication_rules = local.s3_replication_rules
privileged_principal_actions = var.privileged_principal_actions
privileged_principal_arns = local.privileged_principal_arns
Expand Down
4 changes: 2 additions & 2 deletions examples/complete/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ output "bucket_arn" {
}

output "replication_bucket_id" {
value = local.s3_replication_enabled ? join("", module.s3_bucket_replication_target.*.bucket_id) : null
value = local.s3_replication_enabled ? join("", module.s3_bucket_replication_target[*].bucket_id) : null
description = "Replication bucket ID"
}

output "replication_bucket_arn" {
value = local.s3_replication_enabled ? join("", module.s3_bucket_replication_target.*.bucket_arn) : null
value = local.s3_replication_enabled ? join("", module.s3_bucket_replication_target[*].bucket_arn) : null
description = "Replication bucket bucket ARN"
}

Expand Down
14 changes: 7 additions & 7 deletions examples/complete/privileged-principals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ data "aws_iam_policy_document" "deployment_iam_policy" {
resource "aws_iam_policy" "deployment_iam_policy" {
count = var.privileged_principal_enabled ? 1 : 0

policy = join("", data.aws_iam_policy_document.deployment_iam_policy.*.json)
policy = join("", data.aws_iam_policy_document.deployment_iam_policy[*].json)
}

module "deployment_principal_label" {
Expand All @@ -58,8 +58,8 @@ module "deployment_principal_label" {
resource "aws_iam_role" "deployment_iam_role" {
count = var.privileged_principal_enabled ? 1 : 0

name = join("", module.deployment_principal_label.*.id)
assume_role_policy = join("", data.aws_iam_policy_document.deployment_assume_role.*.json)
name = join("", module.deployment_principal_label[*].id)
assume_role_policy = join("", data.aws_iam_policy_document.deployment_assume_role[*].json)

tags = module.deployment_principal_label.tags
}
Expand All @@ -78,15 +78,15 @@ module "additional_deployment_principal_label" {
resource "aws_iam_role" "additional_deployment_iam_role" {
count = var.privileged_principal_enabled ? 1 : 0

name = join("", module.additional_deployment_principal_label.*.id)
assume_role_policy = join("", data.aws_iam_policy_document.deployment_assume_role.*.json)
name = join("", module.additional_deployment_principal_label[*].id)
assume_role_policy = join("", data.aws_iam_policy_document.deployment_assume_role[*].json)

tags = module.additional_deployment_principal_label.tags
}

resource "aws_iam_role_policy_attachment" "additional_deployment_role_attachment" {
count = var.privileged_principal_enabled ? 1 : 0

policy_arn = join("", aws_iam_policy.deployment_iam_policy.*.arn)
role = join("", aws_iam_role.deployment_iam_role.*.name)
policy_arn = join("", aws_iam_policy.deployment_iam_policy[*].arn)
role = join("", aws_iam_role.deployment_iam_role[*].name)
}
2 changes: 1 addition & 1 deletion lifecycle.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ locals {

resource "aws_s3_bucket_lifecycle_configuration" "default" {
count = local.enabled && length(local.lc_rules) > 0 ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

dynamic "rule" {
for_each = local.lc_rules
Expand Down
42 changes: 21 additions & 21 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
locals {
enabled = module.this.enabled
partition = join("", data.aws_partition.current.*.partition)
partition = join("", data.aws_partition.current[*].partition)

object_lock_enabled = local.enabled && var.object_lock_configuration != null
replication_enabled = local.enabled && var.s3_replication_enabled
versioning_enabled = local.enabled && var.versioning_enabled
transfer_acceleration_enabled = local.enabled && var.transfer_acceleration_enabled

bucket_name = var.bucket_name != null && var.bucket_name != "" ? var.bucket_name : module.this.id
bucket_arn = "arn:${local.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}"
bucket_arn = "arn:${local.partition}:s3:::${join("", aws_s3_bucket.default[*].id)}"

public_access_block_enabled = var.block_public_acls || var.block_public_policy || var.ignore_public_acls || var.restrict_public_buckets

Expand Down Expand Up @@ -46,14 +46,14 @@ resource "aws_s3_bucket" "default" {

resource "aws_s3_bucket_accelerate_configuration" "default" {
count = local.transfer_acceleration_enabled ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)
status = "Enabled"
}

# Ensure the resource exists to track drift, even if the feature is disabled
resource "aws_s3_bucket_versioning" "default" {
count = local.enabled ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

versioning_configuration {
status = local.versioning_enabled ? "Enabled" : "Suspended"
Expand All @@ -62,7 +62,7 @@ resource "aws_s3_bucket_versioning" "default" {

resource "aws_s3_bucket_logging" "default" {
count = local.enabled && var.logging != null ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

target_bucket = var.logging["bucket_name"]
target_prefix = var.logging["prefix"]
Expand All @@ -72,7 +72,7 @@ resource "aws_s3_bucket_logging" "default" {
# https://www.terraform.io/docs/providers/aws/r/s3_bucket.html#enable-default-server-side-encryption
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
count = local.enabled ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

rule {
bucket_key_enabled = var.bucket_key_enabled
Expand All @@ -86,7 +86,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "default" {

resource "aws_s3_bucket_website_configuration" "default" {
count = local.enabled && (try(length(var.website_configuration), 0) > 0) ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

dynamic "index_document" {
for_each = try(length(var.website_configuration[0].index_document), 0) > 0 ? [true] : []
Expand Down Expand Up @@ -129,7 +129,7 @@ resource "aws_s3_bucket_website_configuration" "default" {
// any trying to switch from one to the other will cause a conflict.
resource "aws_s3_bucket_website_configuration" "redirect" {
count = local.enabled && (try(length(var.website_redirect_all_requests_to), 0) > 0) ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

redirect_all_requests_to {
host_name = var.website_redirect_all_requests_to[0].host_name
Expand All @@ -141,7 +141,7 @@ resource "aws_s3_bucket_website_configuration" "redirect" {
resource "aws_s3_bucket_cors_configuration" "default" {
count = local.enabled && try(length(var.cors_configuration), 0) > 0 ? 1 : 0

bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

dynamic "cors_rule" {
for_each = var.cors_configuration
Expand All @@ -158,7 +158,7 @@ resource "aws_s3_bucket_cors_configuration" "default" {

resource "aws_s3_bucket_acl" "default" {
count = local.enabled && var.s3_object_ownership != "BucketOwnerEnforced" ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

# Conflicts with access_control_policy so this is enabled if no grants
acl = try(length(local.acl_grants), 0) == 0 ? var.acl : null
Expand All @@ -181,7 +181,7 @@ resource "aws_s3_bucket_acl" "default" {
}

owner {
id = join("", data.aws_canonical_user_id.default.*.id)
id = join("", data.aws_canonical_user_id.default[*].id)
}
}
}
Expand All @@ -191,7 +191,7 @@ resource "aws_s3_bucket_acl" "default" {
resource "aws_s3_bucket_replication_configuration" "default" {
count = local.replication_enabled ? 1 : 0

bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)
role = aws_iam_role.replication[0].arn

dynamic "rule" {
Expand Down Expand Up @@ -303,7 +303,7 @@ resource "aws_s3_bucket_replication_configuration" "default" {
resource "aws_s3_bucket_object_lock_configuration" "default" {
count = local.object_lock_enabled ? 1 : 0

bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

object_lock_enabled = "Enabled"

Expand All @@ -322,7 +322,7 @@ module "s3_user" {

enabled = local.enabled && var.user_enabled
s3_actions = var.allowed_bucket_actions
s3_resources = ["${join("", aws_s3_bucket.default.*.arn)}/*", join("", aws_s3_bucket.default.*.arn)]
s3_resources = ["${join("", aws_s3_bucket.default[*].arn)}/*", join("", aws_s3_bucket.default[*].arn)]

create_iam_access_key = var.access_key_enabled
ssm_enabled = var.store_access_key_in_ssm
Expand Down Expand Up @@ -442,8 +442,8 @@ data "aws_iam_policy_document" "bucket_policy" {
sid = "AllowPrivilegedPrincipal[${statement.key}]" # add indices to Sid
actions = var.privileged_principal_actions
resources = distinct(flatten([
"arn:${local.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}",
formatlist("arn:${local.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}/%s*", values(statement.value)[0]),
"arn:${local.partition}:s3:::${join("", aws_s3_bucket.default[*].id)}",
formatlist("arn:${local.partition}:s3:::${join("", aws_s3_bucket.default[*].id)}/%s*", values(statement.value)[0]),
]))
principals {
type = "AWS"
Expand All @@ -456,14 +456,14 @@ data "aws_iam_policy_document" "bucket_policy" {
data "aws_iam_policy_document" "aggregated_policy" {
count = local.enabled ? 1 : 0

source_policy_documents = data.aws_iam_policy_document.bucket_policy.*.json
source_policy_documents = data.aws_iam_policy_document.bucket_policy[*].json
override_policy_documents = local.source_policy_documents
}

resource "aws_s3_bucket_policy" "default" {
count = local.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || length(var.s3_replication_source_roles) > 0 || length(var.privileged_principal_arns) > 0 || length(var.source_policy_documents) > 0) ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
policy = join("", data.aws_iam_policy_document.aggregated_policy.*.json)
bucket = join("", aws_s3_bucket.default[*].id)
policy = join("", data.aws_iam_policy_document.aggregated_policy[*].json)
depends_on = [aws_s3_bucket_public_access_block.default]
}

Expand All @@ -472,7 +472,7 @@ resource "aws_s3_bucket_policy" "default" {
# for the nuances of the blocking options
resource "aws_s3_bucket_public_access_block" "default" {
count = module.this.enabled && local.public_access_block_enabled ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

block_public_acls = var.block_public_acls
block_public_policy = var.block_public_policy
Expand All @@ -483,7 +483,7 @@ resource "aws_s3_bucket_public_access_block" "default" {
# Per https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
resource "aws_s3_bucket_ownership_controls" "default" {
count = local.enabled ? 1 : 0
bucket = join("", aws_s3_bucket.default.*.id)
bucket = join("", aws_s3_bucket.default[*].id)

rule {
object_ownership = var.s3_object_ownership
Expand Down
16 changes: 8 additions & 8 deletions outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,35 +1,35 @@
output "bucket_domain_name" {
value = local.enabled ? join("", aws_s3_bucket.default.*.bucket_domain_name) : ""
value = local.enabled ? join("", aws_s3_bucket.default[*].bucket_domain_name) : ""
description = "FQDN of bucket"
}

output "bucket_regional_domain_name" {
value = local.enabled ? join("", aws_s3_bucket.default.*.bucket_regional_domain_name) : ""
value = local.enabled ? join("", aws_s3_bucket.default[*].bucket_regional_domain_name) : ""
description = "The bucket region-specific domain name"
}

output "bucket_website_domain" {
value = join("", aws_s3_bucket_website_configuration.default.*.website_domain, aws_s3_bucket_website_configuration.redirect.*.website_domain)
value = join("", aws_s3_bucket_website_configuration.default[*].website_domain, aws_s3_bucket_website_configuration.redirect[*].website_domain)
description = "The bucket website domain, if website is enabled"
}

output "bucket_website_endpoint" {
value = join("", aws_s3_bucket_website_configuration.default.*.website_endpoint, aws_s3_bucket_website_configuration.redirect.*.website_endpoint)
value = join("", aws_s3_bucket_website_configuration.default[*].website_endpoint, aws_s3_bucket_website_configuration.redirect[*].website_endpoint)
description = "The bucket website endpoint, if website is enabled"
}

output "bucket_id" {
value = local.enabled ? join("", aws_s3_bucket.default.*.id) : ""
value = local.enabled ? join("", aws_s3_bucket.default[*].id) : ""
description = "Bucket Name (aka ID)"
}

output "bucket_arn" {
value = local.enabled ? join("", aws_s3_bucket.default.*.arn) : ""
value = local.enabled ? join("", aws_s3_bucket.default[*].arn) : ""
description = "Bucket ARN"
}

output "bucket_region" {
value = local.enabled ? join("", aws_s3_bucket.default.*.region) : ""
value = local.enabled ? join("", aws_s3_bucket.default[*].region) : ""
description = "Bucket region"
}

Expand Down Expand Up @@ -59,7 +59,7 @@ output "user_unique_id" {
}

output "replication_role_arn" {
value = local.enabled && local.replication_enabled ? join("", aws_iam_role.replication.*.arn) : ""
value = local.enabled && local.replication_enabled ? join("", aws_iam_role.replication[*].arn) : ""
description = "The ARN of the replication IAM Role"
}

Expand Down
2 changes: 1 addition & 1 deletion test/src/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ init:
## Run tests
test: init
go mod download
go test -v -timeout 30m
go test -v -timeout 45m

## Run tests in docker container
docker/test:
Expand Down