set users for data_iam_group

aws/data_source_aws_iam_group.go

@@ -30,6 +30,55 @@ func dataSourceAwsIAMGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
+			"users": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"path": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"user_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"user_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"arn": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"create_date": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"password_last_used": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"permissions_boundary": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"permissions_boundary_type": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"permissions_boundary_arn": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+						"tags": tagsSchemaComputed(),
+					},
+				},
+			},
 		},
 	}
 }
@@ -59,5 +108,37 @@ func dataSourceAwsIAMGroupRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("path", group.Path)
 	d.Set("group_id", group.GroupId)
 
+	if err := d.Set("users", getUsers(resp.Users)); err != nil {
+		return err
+	}
+
 	return nil
 }
+
+func getUsers(u []*iam.User) interface{} {
+	s := []interface{}{}
+	for _, v := range u {
+		user := map[string]interface{}{
+			"path":        aws.StringValue(v.Path),
+			"user_name":   aws.StringValue(v.UserName),
+			"user_id":     aws.StringValue(v.UserId),
+			"arn":         aws.StringValue(v.Arn),
+			"create_date": aws.TimeValue(v.CreateDate).String(),
+			"tags":        tagsToMapIAM(v.Tags),
+		}
+
+		if v.PasswordLastUsed != nil {
+			user["password_last_used"] = aws.TimeValue(v.PasswordLastUsed).String()
+		}
+
+		if v.PermissionsBoundary != nil {
+			pb := map[string]interface{}{
+				"permissions_boundary_type": aws.StringValue(v.PermissionsBoundary.PermissionsBoundaryType),
+				"permissions_boundary_arn":  aws.StringValue(v.PermissionsBoundary.PermissionsBoundaryArn),
+			}
+			user["permissions_boundary"] = pb
+		}
+		s = append(s, user)
+	}
+	return s
+}

aws/data_source_aws_iam_group_test.go

@@ -29,6 +29,25 @@ func TestAccAWSDataSourceIAMGroup_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSDataSourceIAMGroup_users(t *testing.T) {
+	groupName := fmt.Sprintf("test-datasource-user-%d", acctest.RandInt())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsIAMGroupUsersConfig(groupName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("data.aws_iam_group.test", "group_id"),
+					resource.TestCheckResourceAttr("data.aws_iam_group.test", "group_name", groupName),
+					resource.TestCheckResourceAttr("data.aws_iam_group.test", "users.#", "2"),
+				),
+			},
+		},
+	})
+}
+
 func testAccAwsIAMGroupConfig(name string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_group" "group" {
@@ -41,3 +60,36 @@ data "aws_iam_group" "test" {
 }
 `, name)
 }
+
+func testAccAwsIAMGroupUsersConfig(name string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_user" "user_one" {
+  name = "%s_user_one"
+  path = "/"
+}
+
+resource "aws_iam_user" "user_two" {
+  name = "%s_user_two"
+  path = "/"
+}
+
+resource "aws_iam_group" "group" {
+  name = "%s"
+  path = "/"
+}
+
+resource "aws_iam_group_membership" "group" {
+  name = "%s"
+  group = "${aws_iam_group.group.name}"
+
+  users = [
+    "${aws_iam_user.user_one.name}",
+    "${aws_iam_user.user_two.name}",
+  ]
+}
+
+data "aws_iam_group" "test" {
+  group_name = "${aws_iam_group_membership.group.name}"
+}
+`, name, name, name, name)
+}

website/docs/d/iam_group.html.markdown

@@ -30,3 +30,17 @@ data "aws_iam_group" "example" {
 * `path` - The path to the group.
 
 * `group_id` - The stable and unique string identifying the group.
+
+* `users` - The list of users in the group.
+  * `path` - The path to the user.
+  * `user_name` - The friendly name identifying the user.
+  * `user_id` - The stable and unique string identifying the user.
+  * `arn` - The Amazon Resource Name (ARN) that identifies the user.
+  * `create_date` - The date and time the user was created.
+  * `password_last_used` - The date and time when the user's password was last used to sign in to an AWS website.
+  * `permissions_boundary` - The ARN of the policy used to set the permissions boundary for the user.
+    * `permissions_boundary_type` - The permissions boundary usage type for an entity.
+    * `permissions_boundary_arn` - The ARN of the policy used to set the permissions boundary for the user or role.
+  * `tags` - Tags associated to the user.
+    * `tags.#.key` - The key name of the tag.
+    * `tags.#.value` - The value of the tag.