New resource: aws_lakeformation_lf_tag

[danielcmessias]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates #19640

Updates

21/04/2022: PR has been refactored into Service Packages (#21306). Massive thanks to @stevenayers for his work on this!
03/08/2021: I have renamed 'policy tag' to 'LF Tag' everywhere, to ensure consistency with the AWS API and Console.

---

Adds new resource for creating Lake Formation Policy Tags, which are the first step towards Tag-Based Access Control in Lake Formation.

Example:

resource "aws_lakeformation_lf_tag" "environment" {
  key = "Environment"
  values = [
    "Production",
    "Development",
  ]
}

Output from acceptance testing:

$ make testacc TESTS=TestAccLakeFormation_serial PKG=lakeformation
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/lakeformation/... -v -count 1 -parallel 20 -run='TestAccLakeFormation_serial'  -timeout 180m
=== RUN   TestAccLakeFormation_serial
=== RUN   TestAccLakeFormation_serial/DataLakeSettings
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/basic
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/dataSource
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/disappears
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/withoutCatalogId
=== RUN   TestAccLakeFormation_serial/PermissionsBasic
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/databaseMultiple
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/dataLocation
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/disappears
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/basic
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/database
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/databaseIAMAllowed
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/basic
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/database
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/dataLocation
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/table
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/tableWithColumns
=== RUN   TestAccLakeFormation_serial/PermissionsTable
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardNoSelect
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardSelectPlus
=== RUN   TestAccLakeFormation_serial/PermissionsTable/implicit
=== RUN   TestAccLakeFormation_serial/PermissionsTable/multipleRoles
=== RUN   TestAccLakeFormation_serial/PermissionsTable/selectPlus
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardSelectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTable/basic
=== RUN   TestAccLakeFormation_serial/PermissionsTable/iamAllowed
=== RUN   TestAccLakeFormation_serial/PermissionsTable/selectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/basic
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/implicit
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardExcludedColumns
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectPlus
=== RUN   TestAccLakeFormation_serial/LFTags
=== RUN   TestAccLakeFormation_serial/LFTags/basic
=== RUN   TestAccLakeFormation_serial/LFTags/disappears
=== RUN   TestAccLakeFormation_serial/LFTags/values
--- PASS: TestAccLakeFormation_serial (1142.39s)
    --- PASS: TestAccLakeFormation_serial/DataLakeSettings (70.18s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/basic (18.08s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/dataSource (18.26s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/disappears (17.12s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/withoutCatalogId (16.72s)
    --- PASS: TestAccLakeFormation_serial/PermissionsBasic (260.94s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/databaseMultiple (28.62s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/dataLocation (31.57s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/disappears (89.34s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/basic (27.12s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/database (36.18s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/databaseIAMAllowed (48.11s)
    --- PASS: TestAccLakeFormation_serial/PermissionsDataSource (255.32s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/basic (28.43s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/database (30.40s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/dataLocation (29.74s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/table (32.51s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/tableWithColumns (134.24s)
    --- PASS: TestAccLakeFormation_serial/PermissionsTable (285.49s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardNoSelect (27.83s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardSelectPlus (29.56s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/implicit (29.81s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/multipleRoles (29.69s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/selectPlus (29.33s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardSelectOnly (28.95s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/basic (29.62s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/iamAllowed (50.31s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/selectOnly (30.40s)
    --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns (197.38s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/basic (77.98s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/implicit (30.19s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardExcludedColumns (29.58s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectOnly (29.29s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectPlus (30.35s)
    --- PASS: TestAccLakeFormation_serial/LFTags (73.08s)
        --- PASS: TestAccLakeFormation_serial/LFTags/basic (20.35s)
        --- PASS: TestAccLakeFormation_serial/LFTags/disappears (17.71s)
        --- PASS: TestAccLakeFormation_serial/LFTags/values (35.02s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation	1143.876s

[github-actions]

Welcome @danielcmessias 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[luk2302]

Any updates on this? We would like to use TBAC within our modules and therefore need to be able to create policy tags via tf.

[Tonkonozhenko]

@ewbankkit do you have any estimates of when this will be merged?

[zhelding]

Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding.

Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single aws directory to a large number of separate directories in internal/service, each corresponding to a particular AWS service. This separation of code has also allowed for us to simplify the names of underlying functions -- while still avoiding namespace collisions.

We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author.

For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000.

For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide.

[gh-jvirdee]

@danielcmessias - Thank you for working on this feature. Could you please rebase the code so that it can be merged?

Also related:
Lake Formation Tag-Based Access Control related resources and data sources

[danielcmessias]

PR has been refactored into Service Packages (#21306). Massive thanks to @stevenayers for his work on this!

[stevenayers]

@zhelding & @ewbankkit conflicts sorted when you get a chance, thank you! ❤️

[YakDriver]

@danielcmessias @stevenayers Thank you for your work on this! I have not yet had a chance to look at it but will over the next few days. Coordinate with me if you plan on making changes in that time. Again, thank you for all your work and sorry for the review delay!

[YakDriver]

Looks great! 🎉

% make testacc TESTS="TestAccLakeFormation_serial/LFTags" PKG=lakeformation
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/lakeformation/... -v -count 1 -parallel 20 -run='TestAccLakeFormation_serial/LFTags'  -timeout 180m
=== RUN   TestAccLakeFormation_serial
=== RUN   TestAccLakeFormation_serial/LFTags
=== RUN   TestAccLakeFormation_serial/LFTags/disappears
=== RUN   TestAccLakeFormation_serial/LFTags/values
=== RUN   TestAccLakeFormation_serial/LFTags/basic
--- PASS: TestAccLakeFormation_serial (58.03s)
    --- PASS: TestAccLakeFormation_serial/LFTags (58.03s)
        --- PASS: TestAccLakeFormation_serial/LFTags/disappears (14.87s)
        --- PASS: TestAccLakeFormation_serial/LFTags/values (27.42s)
        --- PASS: TestAccLakeFormation_serial/LFTags/basic (15.73s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation	59.355s

[github-actions]

This functionality has been released in v4.20.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.