service/guardduty: Support GuardDuty Organizations (hashicorp#13034)

* service/guardduty: Support GuardDuty Organizations

Reference: hashicorp#13005
Reference: hashicorp#13006

Changes:

```
FEATURES:

* **New Resource:** `aws_guardduty_organization_admin_account`
* **New Resource:** `aws_guardduty_organization_configuration`
```

Output from acceptance testing:

```
--- PASS: TestAccAWSGuardDuty (137.70s)
    --- PASS: TestAccAWSGuardDuty/Detector (58.97s)
        --- PASS: TestAccAWSGuardDuty/Detector/basic (41.45s)
        --- PASS: TestAccAWSGuardDuty/Detector/import (17.52s)
    --- PASS: TestAccAWSGuardDuty/OrganizationAdminAccount (31.74s)
        --- PASS: TestAccAWSGuardDuty/OrganizationAdminAccount/basic (31.74s)
    --- PASS: TestAccAWSGuardDuty/OrganizationConfiguration (46.99s)
        --- PASS: TestAccAWSGuardDuty/OrganizationConfiguration/basic (46.99s)
```

* resource/aws_guardduty_organization_admin_account: Adjust for review comments

Reference: hashicorp#13034 (review)

Output from acceptance testing:

```
    --- PASS: TestAccAWSGuardDuty/OrganizationAdminAccount (44.91s)
        --- PASS: TestAccAWSGuardDuty/OrganizationAdminAccount/basic (44.91s)
```

aws/internal/service/guardduty/waiter/status.go

@@ -0,0 +1,59 @@
+package waiter
+
+import (
+ "github.com/aws/aws-sdk-go/aws"
+ "github.com/aws/aws-sdk-go/service/guardduty"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+)
+
+const (
+ // AdminStatus NotFound
+ AdminStatusNotFound = "NotFound"
+
+ // AdminStatus Unknown
+ AdminStatusUnknown = "Unknown"
+)
+
+// AdminAccountAdminStatus fetches the AdminAccount and its AdminStatus
+func AdminAccountAdminStatus(conn *guardduty.GuardDuty, adminAccountID string) resource.StateRefreshFunc {
+ return func() (interface{}, string, error) {
+ adminAccount, err := getOrganizationAdminAccount(conn, adminAccountID)
+
+ if err != nil {
+ return nil, AdminStatusUnknown, err
+ }
+
+ if adminAccount == nil {
+ return adminAccount, AdminStatusNotFound, nil
+ }
+
+ return adminAccount, aws.StringValue(adminAccount.AdminStatus), nil
+ }
+}
+
+// TODO: Migrate to shared internal package for aws package and this package
+func getOrganizationAdminAccount(conn *guardduty.GuardDuty, adminAccountID string) (*guardduty.AdminAccount, error) {
+ input := &guardduty.ListOrganizationAdminAccountsInput{}
+ var result *guardduty.AdminAccount
+
+ err := conn.ListOrganizationAdminAccountsPages(input, func(page *guardduty.ListOrganizationAdminAccountsOutput, lastPage bool) bool {
+ if page == nil {
+ return !lastPage
+ }
+
+ for _, adminAccount := range page.AdminAccounts {
+ if adminAccount == nil {
+ continue
+ }
+
+ if aws.StringValue(adminAccount.AdminAccountId) == adminAccountID {
+ result = adminAccount
+ return false
+ }
+ }
+
+ return !lastPage
+ })
+
+ return result, err
+}

aws/internal/service/guardduty/waiter/waiter.go

@@ -0,0 +1,59 @@
+package waiter
+
+import (
+ "time"
+
+ "github.com/aws/aws-sdk-go/service/guardduty"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+)
+
+const (
+ // Maximum amount of time to wait for an AdminAccount to return Enabled
+ AdminAccountEnabledTimeout = 5 * time.Minute
+
+ // Maximum amount of time to wait for an AdminAccount to return NotFound
+ AdminAccountNotFoundTimeout = 5 * time.Minute
+
+ // Maximum amount of time to wait for membership to propagate
+ // When removing Organization Admin Accounts, there is eventual
+ // consistency even after the account is no longer listed.
+ // Reference error message:
+ // BadRequestException: The request is rejected because the current account cannot delete detector while it has invited or associated members.
+ MembershipPropagationTimeout = 2 * time.Minute
+)
+
+// AdminAccountEnabled waits for an AdminAccount to return Enabled
+func AdminAccountEnabled(conn *guardduty.GuardDuty, adminAccountID string) (*guardduty.AdminAccount, error) {
+ stateConf := &resource.StateChangeConf{
+ Pending: []string{AdminStatusNotFound},
+ Target: []string{guardduty.AdminStatusEnabled},
+ Refresh: AdminAccountAdminStatus(conn, adminAccountID),
+ Timeout: AdminAccountNotFoundTimeout,
+ }
+
+ outputRaw, err := stateConf.WaitForState()
+
+ if output, ok := outputRaw.(*guardduty.AdminAccount); ok {
+ return output, err
+ }
+
+ return nil, err
+}
+
+// AdminAccountNotFound waits for an AdminAccount to return NotFound
+func AdminAccountNotFound(conn *guardduty.GuardDuty, adminAccountID string) (*guardduty.AdminAccount, error) {
+ stateConf := &resource.StateChangeConf{
+ Pending: []string{guardduty.AdminStatusDisableInProgress},
+ Target: []string{AdminStatusNotFound},
+ Refresh: AdminAccountAdminStatus(conn, adminAccountID),
+ Timeout: AdminAccountNotFoundTimeout,
+ }
+
+ outputRaw, err := stateConf.WaitForState()
+
+ if output, ok := outputRaw.(*guardduty.AdminAccount); ok {
+ return output, err
+ }
+
+ return nil, err
+}

aws/provider.go

@@ -589,6 +589,8 @@ func Provider() terraform.ResourceProvider {
  "aws_guardduty_invite_accepter": resourceAwsGuardDutyInviteAccepter(),
  "aws_guardduty_ipset": resourceAwsGuardDutyIpset(),
  "aws_guardduty_member": resourceAwsGuardDutyMember(),
+ "aws_guardduty_organization_admin_account": resourceAwsGuardDutyOrganizationAdminAccount(),
+ "aws_guardduty_organization_configuration": resourceAwsGuardDutyOrganizationConfiguration(),
  "aws_guardduty_threatintelset": resourceAwsGuardDutyThreatintelset(),
  "aws_iam_access_key": resourceAwsIamAccessKey(),
  "aws_iam_account_alias": resourceAwsIamAccountAlias(),

aws/resource_aws_guardduty_detector.go

@@ -6,7 +6,9 @@ import (
 
  "github.com/aws/aws-sdk-go/aws"
  "github.com/aws/aws-sdk-go/service/guardduty"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/resource"
  "github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+ "github.com/terraform-providers/terraform-provider-aws/aws/internal/service/guardduty/waiter"
 )
 
 func resourceAwsGuardDutyDetector() *schema.Resource {
@@ -106,14 +108,32 @@ func resourceAwsGuardDutyDetectorUpdate(d *schema.ResourceData, meta interface{}
 
 func resourceAwsGuardDutyDetectorDelete(d *schema.ResourceData, meta interface{}) error {
  conn := meta.(*AWSClient).guarddutyconn
- input := guardduty.DeleteDetectorInput{
+
+ input := &guardduty.DeleteDetectorInput{
  DetectorId: aws.String(d.Id()),
  }
 
- log.Printf("[DEBUG] Delete GuardDuty Detector: %s", input)
- _, err := conn.DeleteDetector(&input)
+ err := resource.Retry(waiter.MembershipPropagationTimeout, func() *resource.RetryError {
+ _, err := conn.DeleteDetector(input)
+
+ if isAWSErr(err, guardduty.ErrCodeBadRequestException, "cannot delete detector while it has invited or associated members") {
+ return resource.RetryableError(err)
+ }
+
+ if err != nil {
+ return resource.NonRetryableError(err)
+ }
+
+ return nil
+ })
+
+ if isResourceTimeoutError(err) {
+ _, err = conn.DeleteDetector(input)
+ }
+
  if err != nil {
- return fmt.Errorf("Deleting GuardDuty Detector '%s' failed: %s", d.Id(), err.Error())
+ return fmt.Errorf("error deleting GuardDuty Detector (%s): %w", d.Id(), err)
  }
+
  return nil
 }

aws/resource_aws_guardduty_organization_admin_account.go

@@ -0,0 +1,122 @@
+package aws
+
+import (
+ "fmt"
+ "log"
+
+ "github.com/aws/aws-sdk-go/aws"
+ "github.com/aws/aws-sdk-go/service/guardduty"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+ "github.com/terraform-providers/terraform-provider-aws/aws/internal/service/guardduty/waiter"
+)
+
+func resourceAwsGuardDutyOrganizationAdminAccount() *schema.Resource {
+ return &schema.Resource{
+ Create: resourceAwsGuardDutyOrganizationAdminAccountCreate,
+ Read: resourceAwsGuardDutyOrganizationAdminAccountRead,
+ Delete: resourceAwsGuardDutyOrganizationAdminAccountDelete,
+
+ Importer: &schema.ResourceImporter{
+ State: schema.ImportStatePassthrough,
+ },
+
+ Schema: map[string]*schema.Schema{
+ "admin_account_id": {
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ ValidateFunc: validateAwsAccountId,
+ },
+ },
+ }
+}
+
+func resourceAwsGuardDutyOrganizationAdminAccountCreate(d *schema.ResourceData, meta interface{}) error {
+ conn := meta.(*AWSClient).guarddutyconn
+
+ adminAccountID := d.Get("admin_account_id").(string)
+
+ input := &guardduty.EnableOrganizationAdminAccountInput{
+ AdminAccountId: aws.String(adminAccountID),
+ }
+
+ _, err := conn.EnableOrganizationAdminAccount(input)
+
+ if err != nil {
+ return fmt.Errorf("error enabling GuardDuty Organization Admin Account (%s): %w", adminAccountID, err)
+ }
+
+ d.SetId(adminAccountID)
+
+ if _, err := waiter.AdminAccountEnabled(conn, d.Id()); err != nil {
+ return fmt.Errorf("error waiting for GuardDuty Organization Admin Account (%s) to enable: %w", d.Id(), err)
+ }
+
+ return resourceAwsGuardDutyOrganizationAdminAccountRead(d, meta)
+}
+
+func resourceAwsGuardDutyOrganizationAdminAccountRead(d *schema.ResourceData, meta interface{}) error {
+ conn := meta.(*AWSClient).guarddutyconn
+
+ adminAccount, err := getGuardDutyOrganizationAdminAccount(conn, d.Id())
+
+ if err != nil {
+ return fmt.Errorf("error reading GuardDuty Organization Admin Account (%s): %w", d.Id(), err)
+ }
+
+ if adminAccount == nil {
+ log.Printf("[WARN] GuardDuty Organization Admin Account (%s) not found, removing from state", d.Id())
+ d.SetId("")
+ return nil
+ }
+
+ d.Set("admin_account_id", adminAccount.AdminAccountId)
+
+ return nil
+}
+
+func resourceAwsGuardDutyOrganizationAdminAccountDelete(d *schema.ResourceData, meta interface{}) error {
+ conn := meta.(*AWSClient).guarddutyconn
+
+ input := &guardduty.DisableOrganizationAdminAccountInput{
+ AdminAccountId: aws.String(d.Id()),
+ }
+
+ _, err := conn.DisableOrganizationAdminAccount(input)
+
+ if err != nil {
+ return fmt.Errorf("error disabling GuardDuty Organization Admin Account (%s): %w", d.Id(), err)
+ }
+
+ if _, err := waiter.AdminAccountNotFound(conn, d.Id()); err != nil {
+ return fmt.Errorf("error waiting for GuardDuty Organization Admin Account (%s) to disable: %w", d.Id(), err)
+ }
+
+ return nil
+}
+
+func getGuardDutyOrganizationAdminAccount(conn *guardduty.GuardDuty, adminAccountID string) (*guardduty.AdminAccount, error) {
+ input := &guardduty.ListOrganizationAdminAccountsInput{}
+ var result *guardduty.AdminAccount
+
+ err := conn.ListOrganizationAdminAccountsPages(input, func(page *guardduty.ListOrganizationAdminAccountsOutput, lastPage bool) bool {
+ if page == nil {
+ return !lastPage
+ }
+
+ for _, adminAccount := range page.AdminAccounts {
+ if adminAccount == nil {
+ continue
+ }
+
+ if aws.StringValue(adminAccount.AdminAccountId) == adminAccountID {
+ result = adminAccount
+ return false
+ }
+ }
+
+ return !lastPage
+ })
+
+ return result, err
+}