f-DeleteUnusedFMManagedResources support for aws_fms_policy resource

.changelog/21295.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fms_policy: Add `delete_unused_fm_managed_resources` argument
+```

.changelog/21299.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fms_policy: Add `tags` argument and `tags_all` attribute to support resource tagging
+```

internal/service/fms/fms_test.go

@@ -14,6 +14,7 @@ func TestAccFMS_serial(t *testing.T) {
 			"cloudfrontDistribution": testAccPolicy_cloudFrontDistribution,
 			"includeMap":             testAccPolicy_includeMap,
 			"update":                 testAccPolicy_update,
+			"resourceTags":           testAccPolicy_resourceTags,
 			"tags":                   testAccPolicy_tags,
 		},
 	}

internal/service/fms/generate.go

@@ -1,4 +1,5 @@
-//go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -TagType=ResourceTag
+//go:generate go run -tags generate ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForResource -ListTagsInIDElem=ResourceArn -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=TagResource -TagInTagsElem=TagList -TagInIDElem=ResourceArn -UpdateTags -TagType=Tag
+
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
 package fms

internal/service/fms/policy.go

@@ -8,11 +8,13 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -22,27 +24,32 @@ func ResourcePolicy() *schema.Resource {
 		Read:   resourcePolicyRead,
 		Update: resourcePolicyUpdate,
 		Delete: resourcePolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
 		},
 
+		CustomizeDiff: verify.SetTagsDiff,
+
 		Schema: map[string]*schema.Schema{
-			"name": {
+			"arn": {
 				Type:     schema.TypeString,
-				Required: true,
+				Computed: true,
 			},
-
 			"delete_all_policy_resources": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Default:  true,
 			},
-
+			"delete_unused_fm_managed_resources": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"exclude_resource_tags": {
 				Type:     schema.TypeBool,
 				Required: true,
 			},
-
 			"exclude_map": {
 				Type:             schema.TypeList,
 				MaxItems:         1,
@@ -67,7 +74,6 @@ func ResourcePolicy() *schema.Resource {
 					},
 				},
 			},
-
 			"include_map": {
 				Type:             schema.TypeList,
 				MaxItems:         1,
@@ -92,108 +98,190 @@ func ResourcePolicy() *schema.Resource {
 					},
 				},
 			},
-
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"policy_update_token": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"remediation_enabled": {
 				Type:     schema.TypeBool,
 				Optional: true,
 			},
-
-			"resource_type_list": {
-				Type:          schema.TypeSet,
-				Optional:      true,
-				Computed:      true,
-				Set:           schema.HashString,
-				ConflictsWith: []string{"resource_type"},
-				Elem: &schema.Schema{
-					Type:         schema.TypeString,
-					ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
-				},
-			},
-
+			"resource_tags": tftags.TagsSchema(),
 			"resource_type": {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Computed:      true,
-				ConflictsWith: []string{"resource_type_list"},
 				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
+				ConflictsWith: []string{"resource_type_list"},
 			},
-
-			"policy_update_token": {
-				Type:     schema.TypeString,
+			"resource_type_list": {
+				Type:     schema.TypeSet,
+				Optional: true,
 				Computed: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
+				},
+				ConflictsWith: []string{"resource_type"},
 			},
-
-			"resource_tags": tftags.TagsSchema(),
-
 			"security_service_policy_data": {
 				Type:     schema.TypeList,
 				Required: true,
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"type": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
 						"managed_service_data": {
 							Type:             schema.TypeString,
 							Optional:         true,
 							DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
 						},
+						"type": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
 					},
 				},
 			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+			"tags":     tftags.TagsSchema(),
+			"tags_all": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
 func resourcePolicyCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).FMSConn
+	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
+	tags := defaultTagsConfig.MergeTags(tftags.New(d.Get("tags").(map[string]interface{})))
 
-	fmsPolicy := resourcePolicyExpandPolicy(d)
-
-	params := &fms.PutPolicyInput{
-		Policy: fmsPolicy,
+	input := &fms.PutPolicyInput{
+		Policy:  resourcePolicyExpandPolicy(d),
+		TagList: Tags(tags.IgnoreAWS()),
 	}
 
-	var resp *fms.PutPolicyOutput
-	var err error
-
-	resp, err = conn.PutPolicy(params)
+	output, err := conn.PutPolicy(input)
 
 	if err != nil {
-		return fmt.Errorf("Creating Policy Failed: %s", err.Error())
+		return fmt.Errorf("error creating FMS Policy: %w", err)
 	}
 
-	d.SetId(aws.StringValue(resp.Policy.PolicyId))
+	d.SetId(aws.StringValue(output.Policy.PolicyId))
 
 	return resourcePolicyRead(d, meta)
 }
 
 func resourcePolicyRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).FMSConn
+	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
+	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
+
+	output, err := FindPolicyByID(conn, d.Id())
 
-	var resp *fms.GetPolicyOutput
-	var req = &fms.GetPolicyInput{
-		PolicyId: aws.String(d.Id()),
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] FMS Policy %s not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
 
-	resp, err := conn.GetPolicy(req)
+	if err != nil {
+		return fmt.Errorf("error reading FMS Policy (%s): %w", d.Id(), err)
+	}
+
+	if err := resourcePolicyFlattenPolicy(d, output); err != nil {
+		return err
+	}
+
+	tags, err := ListTags(conn, d.Get("arn").(string))
 
 	if err != nil {
-		if tfawserr.ErrMessageContains(err, fms.ErrCodeResourceNotFoundException, "") {
-			log.Printf("[WARN] FMS Policy (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return nil
+		return fmt.Errorf("error listing tags for FMS Policy (%s): %w", d.Id(), err)
+	}
+
+	tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+
+	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+		return fmt.Errorf("error setting tags: %w", err)
+	}
+
+	if err := d.Set("tags_all", tags.Map()); err != nil {
+		return fmt.Errorf("error setting tags_all: %w", err)
+	}
+
+	return nil
+}
+
+func resourcePolicyUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).FMSConn
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &fms.PutPolicyInput{
+			Policy: resourcePolicyExpandPolicy(d),
 		}
-		return err
+
+		_, err := conn.PutPolicy(input)
+
+		if err != nil {
+			return fmt.Errorf("error updating FMS Policy (%s): %w", d.Id(), err)
+		}
+	}
+
+	if d.HasChange("tags_all") {
+		o, n := d.GetChange("tags_all")
+
+		if err := UpdateTags(conn, d.Get("arn").(string), o, n); err != nil {
+			return fmt.Errorf("error updating FMS Policy (%s) tags: %w", d.Id(), err)
+		}
+	}
+
+	return resourcePolicyRead(d, meta)
+}
+
+func resourcePolicyDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).FMSConn
+
+	log.Printf("[DEBUG] Deleting FMS Policy: %s", d.Id())
+	_, err := conn.DeletePolicy(&fms.DeletePolicyInput{
+		PolicyId:                 aws.String(d.Id()),
+		DeleteAllPolicyResources: aws.Bool(d.Get("delete_all_policy_resources").(bool)),
+	})
+
+	if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+		return nil
 	}
 
-	return resourcePolicyFlattenPolicy(d, resp)
+	if err != nil {
+		return fmt.Errorf("error deleting FMS Policy (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}
+
+func FindPolicyByID(conn *fms.FMS, id string) (*fms.GetPolicyOutput, error) {
+	input := &fms.GetPolicyInput{
+		PolicyId: aws.String(id),
+	}
+
+	output, err := conn.GetPolicy(input)
+
+	if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+		return nil, &resource.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
 }
 
 func resourcePolicyFlattenPolicy(d *schema.ResourceData, resp *fms.GetPolicyOutput) error {
@@ -211,6 +299,7 @@ func resourcePolicyFlattenPolicy(d *schema.ResourceData, resp *fms.GetPolicyOutp
 	if err := d.Set("resource_type_list", resp.Policy.ResourceTypeList); err != nil {
 		return err
 	}
+	d.Set("delete_unused_fm_managed_resources", resp.Policy.DeleteUnusedFMManagedResources)
 	d.Set("resource_type", resp.Policy.ResourceType)
 	d.Set("policy_update_token", resp.Policy.PolicyUpdateToken)
 	if err := d.Set("resource_tags", flattenFMSResourceTags(resp.Policy.ResourceTags)); err != nil {
@@ -236,11 +325,12 @@ func resourcePolicyExpandPolicy(d *schema.ResourceData) *fms.Policy {
 	}
 
 	fmsPolicy := &fms.Policy{
-		PolicyName:          aws.String(d.Get("name").(string)),
-		RemediationEnabled:  aws.Bool(d.Get("remediation_enabled").(bool)),
-		ResourceType:        resourceType,
-		ResourceTypeList:    resourceTypeList,
-		ExcludeResourceTags: aws.Bool(d.Get("exclude_resource_tags").(bool)),
+		PolicyName:                     aws.String(d.Get("name").(string)),
+		RemediationEnabled:             aws.Bool(d.Get("remediation_enabled").(bool)),
+		ResourceType:                   resourceType,
+		ResourceTypeList:               resourceTypeList,
+		ExcludeResourceTags:            aws.Bool(d.Get("exclude_resource_tags").(bool)),
+		DeleteUnusedFMManagedResources: aws.Bool(d.Get("delete_unused_fm_managed_resources").(bool)),
 	}
 
 	if d.Id() != "" {
@@ -263,41 +353,6 @@ func resourcePolicyExpandPolicy(d *schema.ResourceData) *fms.Policy {
 	return fmsPolicy
 }
 
-func resourcePolicyUpdate(d *schema.ResourceData, meta interface{}) error {
-	conn := meta.(*conns.AWSClient).FMSConn
-
-	fmsPolicy := resourcePolicyExpandPolicy(d)
-
-	params := &fms.PutPolicyInput{Policy: fmsPolicy}
-	_, err := conn.PutPolicy(params)
-
-	if err != nil {
-		return fmt.Errorf("Error modifying FMS Policy Rule: %s", err)
-	}
-
-	return resourcePolicyRead(d, meta)
-}
-
-func resourcePolicyDelete(d *schema.ResourceData, meta interface{}) error {
-	conn := meta.(*conns.AWSClient).FMSConn
-	log.Printf("[DEBUG] Delete FMS Policy: %s", d.Id())
-
-	_, err := conn.DeletePolicy(&fms.DeletePolicyInput{
-		PolicyId:                 aws.String(d.Id()),
-		DeleteAllPolicyResources: aws.Bool(d.Get("delete_all_policy_resources").(bool)),
-	})
-
-	if tfawserr.ErrMessageContains(err, fms.ErrCodeResourceNotFoundException, "") {
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error deleting FMS Policy (%s): %s", d.Id(), err)
-	}
-
-	return nil
-}
-
 func expandFMSPolicyMap(set []interface{}) map[string][]*string {
 	fmsPolicyMap := map[string][]*string{}
 	if len(set) > 0 {