Aws transfer server security group ids

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+# This GitHub action can publish assets for release when a tag is created.
+# Currently its setup to run on any tag that matches the pattern "v*" (ie. v0.1.0).
+#
+# This uses an action (paultyng/ghaction-import-gpg) that assumes you set your 
+# private key in the `GPG_PRIVATE_KEY` secret and passphrase in the `PASSPHRASE`
+# secret. If you would rather own your own GPG handling, please fork this action
+# or use an alternative one for key handling.
+#
+# You will need to pass the `--batch` flag to `gpg` in your signing step 
+# in `goreleaser` to indicate this is being used in a non-interactive mode.
+#
+name: release
+on:
+  push:
+    tags:
+      - 'v*'
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Unshallow
+        run: git fetch --prune --unshallow
+      -
+        name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.14
+      -
+        name: Import GPG key
+        id: import_gpg
+        # TODO: move this to HashiCorp namespace or find alternative that is just simple gpg commands
+        # see https://github.com/hashicorp/terraform-provider-scaffolding/issues/22
+        uses: paultyng/ghaction-import-gpg@v2.1.0
+        env:
+          # These secrets will need to be configured for the repository:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+      -
+        name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v2
+        with:
+          version: latest
+          args: release --rm-dist
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          # GitHub sets this automatically
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ENHANCEMENTS:
 
+
 * data-source/aws_subnet: Add `customer_owned_ipv4_pool` and `map_customer_owned_ip_on_launch` attributes ([#16676](https://github.com/hashicorp/terraform-provider-aws/issues/16676))
 * resource/aws_glacier_vault: Add plan-time validation for `notification` configuration block `events` and `sns_topic_arn` arguments ([#12645](https://github.com/hashicorp/terraform-provider-aws/issues/12645))
 * resource/aws_iam_access_key: Add `create_date` attribute ([#17318](https://github.com/hashicorp/terraform-provider-aws/issues/17318))

aws/resource_aws_transfer_server.go

@@ -72,6 +72,13 @@ func resourceAwsTransferServer() *schema.Resource {
 							Set:           schema.HashString,
 							ConflictsWith: []string{"endpoint_details.0.vpc_endpoint_id"},
 						},
+						"security_group_ids": {
+							Type:          schema.TypeSet,
+							Optional:      true,
+							Elem:          &schema.Schema{Type: schema.TypeString},
+							Set:           schema.HashString,
+							ConflictsWith: []string{"endpoint_details.0.vpc_endpoint_id"},
+						},
 						"vpc_id": {
 							Type:          schema.TypeString,
 							Optional:      true,
@@ -208,10 +215,12 @@ func resourceAwsTransferServerCreate(d *schema.ResourceData, meta interface{}) e
 		if err := stopAndWaitForTransferServer(d.Id(), conn, d.Timeout(schema.TimeoutCreate)); err != nil {
 			return err
 		}
+		// Here we ansure that SecurityGroupsids is nil. We can't update this
+		createOpts.EndpointDetails.SecurityGroupIds = nil
 
 		updateOpts := &transfer.UpdateServerInput{
 			ServerId:        aws.String(d.Id()),
-			EndpointDetails: expandTransferServerEndpointDetails(d.Get("endpoint_details").([]interface{})),
+			EndpointDetails: createOpts.EndpointDetails,
 		}
 
 		// EIPs cannot be assigned directly on server creation, so the server must
@@ -332,6 +341,8 @@ func resourceAwsTransferServerUpdate(d *schema.ResourceData, meta interface{}) e
 		updateFlag = true
 		if attr, ok := d.GetOk("endpoint_details"); ok {
 			updateOpts.EndpointDetails = expandTransferServerEndpointDetails(attr.([]interface{}))
+			// Here we ansure that SecurityGroupsids is nil. We can't update this
+			updateOpts.EndpointDetails.SecurityGroupIds = nil
 		}
 
 		// Prevent the following error: InvalidRequestException: Server must be OFFLINE to change AddressAllocationIds
@@ -493,6 +504,10 @@ func expandTransferServerEndpointDetails(l []interface{}) *transfer.EndpointDeta
 		out.AddressAllocationIds = expandStringSet(v)
 	}
 
+	if v, ok := e["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
+		out.SecurityGroupIds = expandStringSet(v)
+	}
+
 	if v, ok := e["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
 		out.SubnetIds = expandStringSet(v)
 	}

website/docs/r/transfer_server.html.markdown

@@ -83,6 +83,7 @@ The following arguments are supported:
 * `address_allocation_ids` - (Optional) A list of address allocation IDs that are required to attach an Elastic IP address to your SFTP server's endpoint. This property can only be used when `endpoint_type` is set to `VPC`.
 * `subnet_ids` - (Optional) A list of subnet IDs that are required to host your SFTP server endpoint in your VPC. This property can only be used when `endpoint_type` is set to `VPC`.
 * `vpc_id` - (Optional) The VPC ID of the virtual private cloud in which the SFTP server's endpoint will be hosted. This property can only be used when `endpoint_type` is set to `VPC`.
+* `security_group_ids` - (Optional) A list of Security Groups Ids. This property can only be used when `endpoint_type` is set to `VPC`. It can't be change after transfer server creation.
 
 ## Attributes Reference
 In addition to all arguments above, the following attributes are exported: