add support for importing aws_network_acl_rule resources

aws/resource_aws_network_acl_rule.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -19,6 +20,30 @@ func resourceAwsNetworkAclRule() *schema.Resource {
 		Create: resourceAwsNetworkAclRuleCreate,
 		Read:   resourceAwsNetworkAclRuleRead,
 		Delete: resourceAwsNetworkAclRuleDelete,
+		Importer: &schema.ResourceImporter{
+			State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				idParts := strings.Split(d.Id(), ":")
+				if len(idParts) != 4 || idParts[0] == "" || idParts[1] == "" || idParts[2] == "" || idParts[3] == "" {
+					return nil, fmt.Errorf("unexpected format of ID (%q), expected NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS", d.Id())
+				}
+				networkAclID := idParts[0]
+				ruleNumber, err := strconv.Atoi(idParts[1])
+				if err != nil {
+					return nil, err
+				}
+				protocol := idParts[2]
+				egress, err := strconv.ParseBool(idParts[3])
+				if err != nil {
+					return nil, err
+				}
+
+				d.Set("network_acl_id", networkAclID)
+				d.Set("rule_number", ruleNumber)
+				d.Set("egress", egress)
+				d.SetId(networkAclIdRuleNumberEgressHash(networkAclID, ruleNumber, egress, protocol))
+				return []*schema.ResourceData{d}, nil
+			},
+		},
 
 		Schema: map[string]*schema.Schema{
 			"network_acl_id": {
@@ -210,8 +235,8 @@ func resourceAwsNetworkAclRuleRead(d *schema.ResourceData, meta interface{}) err
 	d.Set("ipv6_cidr_block", resp.Ipv6CidrBlock)
 	d.Set("egress", resp.Egress)
 	if resp.IcmpTypeCode != nil {
-		d.Set("icmp_code", resp.IcmpTypeCode.Code)
-		d.Set("icmp_type", resp.IcmpTypeCode.Type)
+		d.Set("icmp_code", strconv.FormatInt(aws.Int64Value(resp.IcmpTypeCode.Code), 10))
+		d.Set("icmp_type", strconv.FormatInt(aws.Int64Value(resp.IcmpTypeCode.Type), 10))
 	}
 	if resp.PortRange != nil {
 		d.Set("from_port", resp.PortRange.From)

aws/resource_aws_network_acl_rule_test.go

@@ -30,6 +30,24 @@ func TestAccAWSNetworkAclRule_basic(t *testing.T) {
 					testAccCheckAWSNetworkAclRuleExists("aws_network_acl_rule.wibble", &networkAcl),
 				),
 			},
+			{
+				ResourceName:      "aws_network_acl_rule.baz",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc("aws_network_acl_rule.baz", "tcp"),
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "aws_network_acl_rule.qux",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc("aws_network_acl_rule.qux", "icmp"),
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "aws_network_acl_rule.wibble",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc("aws_network_acl_rule.wibble", "icmp"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -124,6 +142,12 @@ func TestAccAWSNetworkAclRule_ipv6(t *testing.T) {
 					testAccCheckAWSNetworkAclRuleExists("aws_network_acl_rule.baz", &networkAcl),
 				),
 			},
+			{
+				ResourceName:      "aws_network_acl_rule.baz",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc("aws_network_acl_rule.baz", "tcp"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -144,6 +168,12 @@ func TestAccAWSNetworkAclRule_ipv6ICMP(t *testing.T) {
 					testAccCheckAWSNetworkAclRuleExists(resourceName, &networkAcl),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc(resourceName, "58"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -177,6 +207,12 @@ func TestAccAWSNetworkAclRule_ipv6VpcAssignGeneratedIpv6CidrBlockUpdate(t *testi
 					testAccCheckAWSNetworkAclRuleExists(resourceName, &networkAcl),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSNetworkAclRuleImportStateIdFunc(resourceName, "tcp"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -632,15 +668,13 @@ resource "aws_network_acl" "test" {
 }
 
 resource "aws_network_acl_rule" "test" {
-  from_port       = -1
   icmp_code       = -1
   icmp_type       = -1
   ipv6_cidr_block = "::/0"
   network_acl_id  = "${aws_network_acl.test.id}"
   protocol        = 58
   rule_action     = "allow"
   rule_number     = 150
-  to_port         = -1
 }
 `, rName, rName)
 }
@@ -677,3 +711,21 @@ resource "aws_network_acl_rule" "test" {
 }
 `, ipv6Enabled)
 }
+
+func testAccAWSNetworkAclRuleImportStateIdFunc(resourceName, resourceProtocol string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return "", fmt.Errorf("not found: %s", resourceName)
+		}
+		networkAclId := rs.Primary.Attributes["network_acl_id"]
+		ruleNumber := rs.Primary.Attributes["rule_number"]
+		protocol := rs.Primary.Attributes["protocol"]
+		// Ensure the resource's ID will be determined from the original protocol value set in the resource's config
+		if protocol != resourceProtocol {
+			protocol = resourceProtocol
+		}
+		egress := rs.Primary.Attributes["egress"]
+		return fmt.Sprintf("%s:%s:%s:%s", networkAclId, ruleNumber, protocol, egress), nil
+	}
+}

website/docs/r/network_acl_rule.html.markdown

@@ -64,3 +64,21 @@ The following arguments are supported:
 In addition to all arguments above, the following attributes are exported:
 
 * `id` - The ID of the network ACL Rule
+
+## Import
+
+Individual rules can be imported using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (e.g. 6) or string (e.g. tcp) value.
+If importing a rule previously provisioned by Terraform, the `PROTOCOL` must be the input value used at creation time.
+For more information on protocol numbers and keywords, see here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+
+For example, import a network ACL Rule with an argument like this:
+
+```console
+$ terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:tcp:false
+```
+
+Or by the procotol's decimal value:
+
+```console
+$ terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:6:false
+```