[WIP]New Resource: aws_shield_protection, aws_shield_subscription

aws/config.go

@@ -62,6 +62,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/ses"
 	"github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/aws/aws-sdk-go/service/shield"
 	"github.com/aws/aws-sdk-go/service/simpledb"
 	"github.com/aws/aws-sdk-go/service/sns"
 	"github.com/aws/aws-sdk-go/service/sqs"
@@ -178,6 +179,7 @@ type AWSClient struct {
 	wafregionalconn       *wafregional.WAFRegional
 	iotconn               *iot.IoT
 	batchconn             *batch.Batch
+	shieldconn            *shield.Shield
 }
 
 func (c *AWSClient) S3() *s3.S3 {
@@ -387,6 +389,7 @@ func (c *Config) Client() (interface{}, error) {
 	client.wafconn = waf.New(sess)
 	client.wafregionalconn = wafregional.New(sess)
 	client.batchconn = batch.New(sess)
+	client.shieldconn = shield.New(sess)
 
 	// Workaround for https://github.com/aws/aws-sdk-go/issues/1376
 	client.kinesisconn.Handlers.Retry.PushBack(func(r *request.Request) {

aws/provider.go

@@ -432,6 +432,8 @@ func Provider() terraform.ResourceProvider {
 			"aws_ses_receipt_rule_set":                     resourceAwsSesReceiptRuleSet(),
 			"aws_ses_configuration_set":                    resourceAwsSesConfigurationSet(),
 			"aws_ses_event_destination":                    resourceAwsSesEventDestination(),
+			"aws_shield_protection":                        resourceAwsShieldProtection(),
+			"aws_shield_subscription":                      resourceAwsShieldSubscription(),
 			"aws_s3_bucket":                                resourceAwsS3Bucket(),
 			"aws_s3_bucket_policy":                         resourceAwsS3BucketPolicy(),
 			"aws_s3_bucket_object":                         resourceAwsS3BucketObject(),

aws/resource_aws_shield_protection.go

@@ -0,0 +1,82 @@
+package aws
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsShieldProtection() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsShieldProtectionCreate,
+		Read:   resourceAwsShieldProtectionRead,
+		Delete: resourceAwsShieldProtectionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"resource": &schema.Schema{
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validateArn,
+			},
+		},
+	}
+}
+
+func resourceAwsShieldProtectionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.CreateProtectionInput{
+		Name:        aws.String(d.Get("name").(string)),
+		ResourceArn: aws.String(d.Get("resource").(string)),
+	}
+
+	resp, err := conn.CreateProtection(input)
+	if err != nil {
+		return err
+	}
+	d.SetId(*resp.ProtectionId)
+	return resourceAwsShieldProtectionRead(d, meta)
+}
+
+func resourceAwsShieldProtectionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.DescribeProtectionInput{
+		ProtectionId: aws.String(d.Id()),
+	}
+
+	_, err := conn.DescribeProtection(input)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func resourceAwsShieldProtectionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.DeleteProtectionInput{
+		ProtectionId: aws.String(d.Id()),
+	}
+
+	_, err := conn.DeleteProtection(input)
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case shield.ErrCodeResourceNotFoundException:
+				return nil
+			default:
+				return err
+			}
+		}
+		return err
+	}
+	return nil
+}

aws/resource_aws_shield_protection_test.go

@@ -0,0 +1,112 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSShieldProtection(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSShieldProtectionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccShieldProtectionRoute53HostedZoneConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSShieldProtectionExists("aws_shield_protection.hoge"),
+				),
+			},
+			{
+				Config: testAccShieldProtectionElbConfig(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSShieldProtectionExists("aws_shield_protection.hoge"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSShieldProtectionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).shieldconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_shield_protection" {
+			continue
+		}
+
+		input := &shield.DescribeProtectionInput{
+			ProtectionId: aws.String(rs.Primary.ID),
+		}
+
+		_, err := conn.DescribeProtection(input)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSShieldProtectionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+// TODO: aws_shield_subscription
+const testAccShieldProtectionRoute53HostedZoneConfig = `
+resource "aws_route53_zone" "hoge" {
+	name = "hashicorp.com."
+	comment = "Custom comment"
+
+	tags {
+		foo = "bar"
+		Name = "tf-route53-tag-test"
+	}
+}
+
+resource "aws_shield_protection" "hoge" {
+  name = "hoge"
+  resource = "arn:aws:route53:::hostedzone/${aws_route53_zone.hoge.zone_id}"
+}
+`
+
+// TODO: aws_shield_subscription
+func testAccShieldProtectionElbConfig() string {
+	return fmt.Sprintf(`
+    resource "aws_elb" "hoge" {
+      name = "hoge"
+      availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
+
+      listener {
+        instance_port = 8000
+        instance_protocol = "http"
+        lb_port = 80
+        // Protocol should be case insensitive
+        lb_protocol = "HttP"
+      }
+
+    	tags {
+    		bar = "baz"
+    	}
+
+      cross_zone_load_balancing   = true
+    }
+
+    resource "aws_shield_protection" "hoge" {
+      name = "hoge"
+      resource = "arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/hoge"
+    }
+    `)
+}

aws/resource_aws_shield_subscription.go

@@ -0,0 +1,69 @@
+package aws
+
+import (
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsShieldSubscription() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsShieldSubscriptionCreate,
+		Read:   resourceAwsShieldSubscriptionRead,
+		Delete: resourceAwsShieldSubscriptionDelete,
+
+		Schema: map[string]*schema.Schema{},
+	}
+}
+
+func resourceAwsShieldSubscriptionCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.CreateSubscriptionInput{}
+
+	_, err := conn.CreateSubscription(input)
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case shield.ErrCodeResourceAlreadyExistsException:
+				return resourceAwsShieldSubscriptionRead(d, meta)
+			default:
+				return err
+			}
+		}
+		return err
+	}
+	return resourceAwsShieldSubscriptionRead(d, meta)
+}
+
+func resourceAwsShieldSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.DescribeSubscriptionInput{}
+
+	_, err := conn.DescribeSubscription(input)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func resourceAwsShieldSubscriptionDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).shieldconn
+
+	input := &shield.DeleteSubscriptionInput{}
+
+	_, err := conn.DeleteSubscription(input)
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case shield.ErrCodeResourceNotFoundException:
+				return nil
+			default:
+				return err
+			}
+		}
+		return err
+	}
+	return nil
+}

aws/resource_aws_shield_subscription_test.go

@@ -0,0 +1,62 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSShieldSubscription(t *testing.T) {
+	// Prevent activation of Shield Advanced
+	// resource.Test(t, resource.TestCase{
+	// 	PreCheck:     func() { testAccPreCheck(t) },
+	// 	Providers:    testAccProviders,
+	// 	CheckDestroy: testAccCheckAWSShieldSubscriptionDestroy,
+	// 	Steps: []resource.TestStep{
+	// 		{
+	// 			Config: testAccShieldSubscriptionConfig,
+	// 			Check: resource.ComposeTestCheckFunc(
+	// 				testAccCheckAWSShieldProtectionExists("aws_shield_subscription.hoge"),
+	// 			),
+	// 		},
+	// 	},
+	// })
+}
+
+func testAccCheckAWSShieldSubscriptionDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).shieldconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_shield_subscription" {
+			continue
+		}
+
+		input := &shield.DescribeSubscriptionInput{}
+
+		_, err := conn.DescribeSubscription(input)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSShieldSubscriptionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+const testAccShieldSubscriptionConfig = `
+  resource "aws_shield_subscription" "hoge" {
+  }
+`