Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Support partitions in policy data sources #4152

Closed
drew-altana opened this issue Oct 24, 2024 · 0 comments · Fixed by #4181
Closed

[FEATURE] Support partitions in policy data sources #4152

drew-altana opened this issue Oct 24, 2024 · 0 comments · Fixed by #4181
Labels
feature New feature or request

Comments

@drew-altana
Copy link

Configuration

data "databricks_aws_bucket_policy" "this" {
  bucket = "mycoolbucket"
}

resource "aws_s3_bucket_policy" "root_bucket_policy" {
  bucket = "mycoolbucket"
  policy = data.databricks_aws_bucket_policy.this.json
}

Expected Behavior

Arns generated are in the govcloud partition with the govcloud AWS ARN

Actual Behavior

api error MalformedPolicy: Invalid principal in policy

  "bucketPolicy": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": [
                        "s3:GetObject",
                        "s3:GetObjectVersion",
                        "s3:PutObject",
                        "s3:DeleteObject",
                        "s3:ListBucket",
                        "s3:GetBucketLocation"
                    ],
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::414351767826:root"
                    },
                    "Resource": [
                        "arn:aws:s3:::mycoolbucket/*",
                        "arn:aws:s3:::mycoolbucket"
                    ]
                }
            ]
        },
        "bucketName": "mycoolbucket",
        "Host": "mycoolbucket.s3.us-gov-west-1.amazonaws.com",
        "policy": ""
    },

Steps to Reproduce

  1. terraform apply-->

Terraform and provider versions

1.51.0

Is it a regression?

unknown

Debug Output

Important Factoids

This is for us-gov-west-1 it's obvious the code here is not partition aware:

fmt.Sprintf("arn:aws:s3:::%s/*", bucket),

Would you like to implement a fix?

No

Use-cases

Attempting to deploy databricks to govcloud.

Attempted Solutions

I just couldn't use data sources in the policies, had to generate them myself.

Proposal

The provider should alter the output based on paritition to support govcloud.

References

#4054

@drew-altana drew-altana added the feature New feature or request label Oct 24, 2024
github-merge-queue bot pushed a commit that referenced this issue Nov 12, 2024
## Changes
- Resolves
#4054
- Resolves
#4152
- Add optional argument `aws_partition` to all aws policy data sources
to allow usage in all aws partitions

## Tests
<!-- 
How is this tested? Please see the checklist below and also describe any
other relevant tests
-->

- [x] `make test` run locally
- [x] relevant change in `docs/` folder
- [x] covered with integration tests in `internal/acceptance`
- [x] relevant acceptance tests are passing
- [ ] using Go SDK
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant