New resource: aws_securityhub_standards_control #14714

Tensho · 2020-08-18T10:14:28Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

New resource: aws_securityhub_standards_control

Example Usage

resource "aws_securityhub_account" "example" {}

resource "aws_securityhub_standards_subscription" "cis_aws_foundations_benchmark" {
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
  depends_on    = [aws_securityhub_account.example]
}

resource "aws_securityhub_standards_control" "ensure_iam_password_policy_prevents_password_reuse" {
  arn             = "arn:aws:securityhub:us-east-1:078884324539:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
  control_status  = "DISABLED"
  disabled_reason = "We handle password policies within Okta" 
  depends_on      = [aws_securityhub_standards_subscription.cis_aws_foundations_benchmark]
}

Acceptance Tests

$ make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHubStandardsControl'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHubStandardsControl -timeout 120m
=== RUN   TestAccAWSSecurityHubStandardsControl_basic
--- PASS: TestAccAWSSecurityHubStandardsControl_basic (19.31s)
=== RUN   TestAccAWSSecurityHubStandardsControl_disabledControlStatus
--- PASS: TestAccAWSSecurityHubStandardsControl_disabledControlStatus (18.76s)
=== RUN   TestAccAWSSecurityHubStandardsControl_enabledControlStatusAndDisabledReason
--- PASS: TestAccAWSSecurityHubStandardsControl_enabledControlStatusAndDisabledReason (6.82s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	47.379s

Notes

This is my first attempt to make terraform-plugin-sdk/v2 compatible resource. Please don't hesitate to refer me to the best practices according to this shift.
I don't' know what is a standard approach for time.Time attribute type in this provider and chose a simple String() conversion.
Standard control resource has an "adoption" lifecycle – resource already exists in the cloud and Terraform provider calls Create() to accept it into the management and Delete() just removes from the state.
I noticed some resource have Read() func call at the end of Update() func and some not. I do believe if a resource has computed attributes any update (for synchronous API) should re-read them to the state. Please correct me if I'm wrong.

Tensho · 2020-08-18T10:38:59Z

@DrFaust92 Why does terrafmt argue here? Local run doesn't bring more context... 🤔

DrFaust92 · 2020-08-18T21:27:21Z

I think that the issue lies with the name of website/docs/r/securityhub_standards_control.markdown
rename to website/docs/r/securityhub_standards_control.html.markdown

Tensho · 2020-08-19T10:01:46Z

@DrFaust92 Thank you for the suggestion 🙇 The problem was in trailing space 😅

Tensho · 2020-09-07T14:46:29Z

Just to not forget, I've submitted AWS feature request support ticket to provide any of these options in SecurityHub API and AWS Go DSK to get the specific standard control:

Add GetStandardsControls API action accepting standard control ARN parameter.
Extend DescribeStandardsControls API action with StandardControlArn parameter.
Return StandardSubscriptionArn in DescribeStandardsControls API action response (StandardsControl data type).

This should allow to rid of the local filtering.

ewbankkit · 2020-09-25T12:53:16Z

Relates: #15090.

aws/resource_aws_securityhub_standards_control.go

ewbankkit · 2020-09-25T13:09:15Z

If Create and Update perform the same underlying action the pattern is to name the method with Put and use set it in both schema.Resource.Create and schema.Resource.Update. Take a look at aws/resource_aws_cloudwatch_dashboard.go for an example
For timestamps we prefer RFC 3339: Add awsproviderlint check to prefer RFC 3339 dates #13708

aws/resource_aws_securityhub_standards_control.go

website/docs/r/securityhub_standards_control.markdown

aws/resource_aws_securityhub_standards_control_test.go

lanzrein · 2021-03-30T12:54:52Z

Hello,
Is there any timeline on when this PR will be merged?
I would like very much to use this feature.
Many thanks !

MRinalducci · 2021-04-14T08:24:37Z

Hi @ewbankkit any news regarding the merge of this PR?
We're currently in a uncomfortable situation without this feature.
Maybe @bill-rich can help us out?
Thanks for your time!

jgeurts · 2021-05-19T13:31:33Z

@Tensho Could you please merge latest with your changes?

navjotkaur10 · 2021-06-09T08:59:45Z

Hello,
Any news on getting this PR merged? We would like to use this feature.

robertstettner · 2021-07-02T09:52:05Z

Hi @ewbankkit, could we please merge this?

…are exported"

…rialize tests.

ewbankkit

LGTM 🚀.

Commercial

% make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHub_serial/StandardsSubscription'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHub_serial/StandardsSubscription -timeout 180m
=== RUN   TestAccAWSSecurityHub_serial
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription/basic
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription/disappears
--- PASS: TestAccAWSSecurityHub_serial (35.15s)
    --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription (35.15s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/basic (18.83s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/disappears (16.32s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	38.304s
% make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHub_serial/StandardsControl'     
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHub_serial/StandardsControl -timeout 180m
=== RUN   TestAccAWSSecurityHub_serial
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/basic
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/DisabledControlStatus
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/EnabledControlStatusAndDisabledReason
--- PASS: TestAccAWSSecurityHub_serial (49.49s)
    --- PASS: TestAccAWSSecurityHub_serial/StandardsControl (49.49s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/basic (20.87s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/DisabledControlStatus (17.66s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/EnabledControlStatusAndDisabledReason (10.95s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	53.082s

GovCloud

% make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHub_serial/StandardsSubscription'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHub_serial/StandardsSubscription -timeout 180m
=== RUN   TestAccAWSSecurityHub_serial
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription/basic
=== RUN   TestAccAWSSecurityHub_serial/StandardsSubscription/disappears
--- PASS: TestAccAWSSecurityHub_serial (46.33s)
    --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription (46.33s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/basic (25.05s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/disappears (21.29s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	49.527s
% make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHub_serial/StandardsControl'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHub_serial/StandardsControl -timeout 180m
=== RUN   TestAccAWSSecurityHub_serial
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/basic
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/DisabledControlStatus
=== RUN   TestAccAWSSecurityHub_serial/StandardsControl/EnabledControlStatusAndDisabledReason
--- PASS: TestAccAWSSecurityHub_serial (60.13s)
    --- PASS: TestAccAWSSecurityHub_serial/StandardsControl (60.13s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/basic (23.57s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/DisabledControlStatus (22.34s)
        --- PASS: TestAccAWSSecurityHub_serial/StandardsControl/EnabledControlStatusAndDisabledReason (14.22s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	63.236s

ewbankkit · 2021-07-13T16:19:31Z

@Tensho Thanks for the contribution 🎉 👏.
I made a couple of minor tweaks to get this merged quicker:

Documentation changes
Serialized acceptance tests

… status in 'testAccCheckAWSSecurityHubStandardsSubscriptionDestroy'. Acceptance test output: % make testacc TEST=./aws TESTARGS='-run=TestAccAWSSecurityHub_serial/StandardsSubscription' ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSSecurityHub_serial/StandardsSubscription -timeout 180m === RUN TestAccAWSSecurityHub_serial === RUN TestAccAWSSecurityHub_serial/StandardsSubscription === RUN TestAccAWSSecurityHub_serial/StandardsSubscription/basic === RUN TestAccAWSSecurityHub_serial/StandardsSubscription/disappears --- PASS: TestAccAWSSecurityHub_serial (39.10s) --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription (39.10s) --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/basic (22.59s) --- PASS: TestAccAWSSecurityHub_serial/StandardsSubscription/disappears (16.51s) PASS ok github.com/terraform-providers/terraform-provider-aws/aws 42.508s

github-actions · 2021-07-15T23:45:52Z

This functionality has been released in v3.50.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions · 2021-08-15T02:05:27Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

Tensho requested a review from a team August 18, 2020 10:14

Tensho force-pushed the securityhub-standard-controls branch 4 times, most recently from ff595c7 to 96cad0c Compare August 18, 2020 10:31

Tensho force-pushed the securityhub-standard-controls branch from aaf0e84 to 6fe8166 Compare August 18, 2020 10:59

Tensho force-pushed the securityhub-standard-controls branch 2 times, most recently from 404e956 to 3605e16 Compare August 25, 2020 09:56

ewbankkit reviewed Sep 25, 2020

View reviewed changes

aws/resource_aws_securityhub_standards_control.go Outdated Show resolved Hide resolved

ewbankkit reviewed Sep 25, 2020

View reviewed changes

aws/resource_aws_securityhub_standards_control.go Outdated Show resolved Hide resolved

ewbankkit reviewed Sep 25, 2020

View reviewed changes

aws/resource_aws_securityhub_standards_control.go Outdated Show resolved Hide resolved

Tensho force-pushed the securityhub-standard-controls branch 2 times, most recently from c4a960f to cba70bf Compare September 29, 2020 14:30