From 144a918eeba2469a9c71be9961b0aeee105904e5 Mon Sep 17 00:00:00 2001 From: O327903 Date: Mon, 11 Mar 2024 23:37:50 +0000 Subject: [PATCH 1/3] Fix Issue --- internal/service/ecs/service.go | 16 ++- internal/service/ecs/service_test.go | 201 +++++++++++++++++++++++++++ 2 files changed, 214 insertions(+), 3 deletions(-) diff --git a/internal/service/ecs/service.go b/internal/service/ecs/service.go index 1a1f5e8ec30..244d4907974 100644 --- a/internal/service/ecs/service.go +++ b/internal/service/ecs/service.go @@ -1510,7 +1510,11 @@ func expandTimeout(timeout []interface{}) *ecs.TimeoutConfiguration { if len(timeout) == 0 { return nil } - raw := timeout[0].(map[string]interface{}) + + raw, ok := timeout[0].(map[string]interface{}) + if !ok { + return nil + } timeoutConfig := &ecs.TimeoutConfiguration{} if v, ok := raw["idle_timeout_seconds"].(int); ok { timeoutConfig.IdleTimeoutSeconds = aws.Int64(int64(v)) @@ -1526,7 +1530,10 @@ func expandTLS(tls []interface{}) *ecs.ServiceConnectTlsConfiguration { return nil } - raw := tls[0].(map[string]interface{}) + raw, ok := tls[0].(map[string]interface{}) + if !ok { + return nil + } tlsConfig := &ecs.ServiceConnectTlsConfiguration{} if v, ok := raw["issuer_cert_authority"].([]interface{}); ok && len(v) > 0 { tlsConfig.IssuerCertificateAuthority = expandIssuerCertAuthority(v) @@ -1545,7 +1552,10 @@ func expandIssuerCertAuthority(pca []interface{}) *ecs.ServiceConnectTlsCertific return nil } - raw := pca[0].(map[string]interface{}) + raw, ok := pca[0].(map[string]interface{}) + if !ok { + return nil + } config := &ecs.ServiceConnectTlsCertificateAuthority{} if v, ok := raw["aws_pca_authority_arn"].(string); ok && v != "" { diff --git a/internal/service/ecs/service_test.go b/internal/service/ecs/service_test.go index 760aefc006f..303583411c3 100644 --- a/internal/service/ecs/service_test.go +++ b/internal/service/ecs/service_test.go @@ -1369,6 +1369,29 @@ func TestAccECSService_ServiceConnect_full(t *testing.T) { }) } +func TestAccECSService_ServiceConnect_tls_with_empty_timout(t *testing.T) { + ctx := acctest.Context(t) + var service ecs.Service + rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix) + resourceName := "aws_ecs_service.test" + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acctest.PreCheck(ctx, t) }, + ErrorCheck: acctest.ErrorCheck(t, ecs.EndpointsID), + ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories, + CheckDestroy: testAccCheckServiceDestroy(ctx), + Steps: []resource.TestStep{ + { + Config: testAccServiceConfig_serviceConnect_tls_with_empty_timeout_block(rName), + Check: resource.ComposeTestCheckFunc( + testAccCheckServiceExists(ctx, resourceName, &service), + resource.TestCheckResourceAttr(resourceName, "service_connect_configuration.#", "1"), + ), + }, + }, + }) +} + func TestAccECSService_ServiceConnect_ingressPortOverride(t *testing.T) { ctx := acctest.Context(t) var service ecs.Service @@ -4415,6 +4438,184 @@ data "aws_caller_identity" "current" {} `, rName) } +func testAccServiceConfig_serviceConnect_tls_with_empty_timeout_block(rName string) string { + return fmt.Sprintf(` +resource "aws_kms_key" "test" { + description = %[1]q + deletion_window_in_days = 7 + policy = data.aws_iam_policy_document.test.json +} + + +data "aws_iam_policy_document" "test" { + policy_id = "KMSPolicy" + + statement { + sid = "Root User Permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"] + } + actions = [ + "kms:*"] + resources = ["*"] + } + + statement { + sid = "EC2 kms permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [aws_iam_role.test.arn] + } + actions = [ + "kms:Encrypt", + "kms:Decrypt", + "kms:GenerateDataKey", + "kms:GenerateDataKeyPair"] + resources = ["*"] + } +} + +resource "aws_iam_role" "test" { + name = %[1]q + + assume_role_policy = < Date: Tue, 12 Mar 2024 00:41:57 +0000 Subject: [PATCH 2/3] Fix Issue --- .changelog/36309.txt | 3 +++ internal/service/ecs/service.go | 2 +- internal/service/ecs/service_test.go | 4 ++-- 3 files changed, 6 insertions(+), 3 deletions(-) create mode 100644 .changelog/36309.txt diff --git a/.changelog/36309.txt b/.changelog/36309.txt new file mode 100644 index 00000000000..0c9791f906b --- /dev/null +++ b/.changelog/36309.txt @@ -0,0 +1,3 @@ +```release-note:bug +resource/ecs_service : This fixes a bug introduced in [v5.37.0] causing an exception if service connect timeout block is empty or the aws_pca_authority_arn is set to null. +``` diff --git a/internal/service/ecs/service.go b/internal/service/ecs/service.go index 7417c30296b..ea54a14b10a 100644 --- a/internal/service/ecs/service.go +++ b/internal/service/ecs/service.go @@ -447,7 +447,7 @@ func ResourceService() *schema.Resource { Schema: map[string]*schema.Schema{ "aws_pca_authority_arn": { Type: schema.TypeString, - Optional: true, + Required: true, ValidateFunc: verify.ValidARN, }, }, diff --git a/internal/service/ecs/service_test.go b/internal/service/ecs/service_test.go index 2e8229f0dda..6a8300a3da2 100644 --- a/internal/service/ecs/service_test.go +++ b/internal/service/ecs/service_test.go @@ -1370,7 +1370,7 @@ func TestAccECSService_ServiceConnect_full(t *testing.T) { }) } -func TestAccECSService_ServiceConnect_tls_with_empty_timout(t *testing.T) { +func TestAccECSService_ServiceConnect_tls_with_empty_timeout(t *testing.T) { ctx := acctest.Context(t) var service ecs.Service rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix) @@ -1378,7 +1378,7 @@ func TestAccECSService_ServiceConnect_tls_with_empty_timout(t *testing.T) { resource.ParallelTest(t, resource.TestCase{ PreCheck: func() { acctest.PreCheck(ctx, t) }, - ErrorCheck: acctest.ErrorCheck(t, ecs.EndpointsID), + ErrorCheck: acctest.ErrorCheck(t, names.ECSServiceID), ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories, CheckDestroy: testAccCheckServiceDestroy(ctx), Steps: []resource.TestStep{ From 33289f591f59c2f22beb608676a6eacad2a8c4e9 Mon Sep 17 00:00:00 2001 From: Kit Ewbank Date: Tue, 12 Mar 2024 13:34:31 -0400 Subject: [PATCH 3/3] Tweak CHANGELOG entries. --- .changelog/36309.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.changelog/36309.txt b/.changelog/36309.txt index 0c9791f906b..f43ee4b6cee 100644 --- a/.changelog/36309.txt +++ b/.changelog/36309.txt @@ -1,3 +1,7 @@ ```release-note:bug -resource/ecs_service : This fixes a bug introduced in [v5.37.0] causing an exception if service connect timeout block is empty or the aws_pca_authority_arn is set to null. +resource/aws_ecs_service: Fix `panic: interface conversion: interface {} is nil, not map[string]interface {}` when `service_connect_configuration.service.timeout` is empty ``` + +```release-note:bug +resource/aws_ecs_service: `service_connect_configuration.service.tls.issuer_cert_authority.aws_pca_authority_arn` is Required +``` \ No newline at end of file