r/ram_resource_share - add permission_arns argument

.changelog/25113.txt

@@ -0,0 +1,2 @@
+```release-note:enhancement
+resource/aws_ram_resource_share: Add `permission_arns` argument.

internal/service/ram/resource_share.go

@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -31,6 +32,11 @@ func ResourceResourceShare() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
+			"allow_external_principals": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -40,13 +46,15 @@ func ResourceResourceShare() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
-
-			"allow_external_principals": {
-				Type:     schema.TypeBool,
+			"permission_arns": {
+				Type:     schema.TypeSet,
+				ForceNew: true,
 				Optional: true,
-				Default:  false,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
 			},
-
 			"tags":     tftags.TagsSchema(),
 			"tags_all": tftags.TagsSchemaComputed(),
 		},
@@ -65,6 +73,10 @@ func resourceResourceShareCreate(d *schema.ResourceData, meta interface{}) error
 		AllowExternalPrincipals: aws.Bool(d.Get("allow_external_principals").(bool)),
 	}
 
+	if v, ok := d.GetOk("permission_arns"); ok && v.(*schema.Set).Len() > 0 {
+		request.PermissionArns = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
 	if len(tags) > 0 {
 		request.Tags = Tags(tags.IgnoreAWS())
 	}
@@ -90,12 +102,7 @@ func resourceResourceShareRead(d *schema.ResourceData, meta interface{}) error {
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	request := &ram.GetResourceSharesInput{
-		ResourceShareArns: []*string{aws.String(d.Id())},
-		ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
-	}
-
-	output, err := conn.GetResourceShares(request)
+	resourceShare, err := FindResourceShareOwnerSelfByARN(conn, d.Id())
 	if err != nil {
 		if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ram.ErrCodeUnknownResourceException) {
 			log.Printf("[WARN] RAM Resource Share (%s) not found, removing from state", d.Id())
@@ -105,14 +112,6 @@ func resourceResourceShareRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("error reading RAM resource share %s: %w", d.Id(), err)
 	}
 
-	if !d.IsNewResource() && len(output.ResourceShares) == 0 {
-		log.Printf("[WARN] RAM Resource Share (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
-	}
-
-	resourceShare := output.ResourceShares[0]
-
 	if !d.IsNewResource() && aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusActive {
 		log.Printf("[WARN] RAM Resource Share (%s) not active, removing from state", d.Id())
 		d.SetId("")
@@ -134,6 +133,23 @@ func resourceResourceShareRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("error setting tags_all: %w", err)
 	}
 
+	permsInput := &ram.ListResourceSharePermissionsInput{
+		ResourceShareArn: aws.String(d.Id()),
+	}
+
+	perms, err := conn.ListResourceSharePermissions(permsInput)
+	if err != nil {
+		return err
+	}
+
+	permArns := make([]*string, 0, len(perms.Permissions))
+
+	for _, perm := range perms.Permissions {
+		permArns = append(permArns, perm.Arn)
+	}
+
+	d.Set("permission_arns", flex.FlattenStringSet(permArns))
+
 	return nil
 }
 

internal/service/ram/resource_share_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfram "github.com/hashicorp/terraform-provider-aws/internal/service/ram"
 )
 
 func TestAccRAMResourceShare_basic(t *testing.T) {
@@ -32,6 +33,38 @@ func TestAccRAMResourceShare_basic(t *testing.T) {
 					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexp.MustCompile(`resource-share/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "allow_external_principals", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "permission_arns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccRAMResourceShare_permission(t *testing.T) {
+	var resourceShare ram.ResourceShare
+	resourceName := "aws_ram_resource_share.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:          func() { acctest.PreCheck(t) },
+		ErrorCheck:        acctest.ErrorCheck(t, ram.EndpointsID),
+		ProviderFactories: acctest.ProviderFactories,
+		CheckDestroy:      testAccCheckResourceShareDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceShareNamePermissionConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckResourceShareExists(resourceName, &resourceShare),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexp.MustCompile(`resource-share/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "allow_external_principals", "false"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "permission_arns.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -158,6 +191,29 @@ func TestAccRAMResourceShare_tags(t *testing.T) {
 	})
 }
 
+func TestAccRAMResourceShare_disappears(t *testing.T) {
+	var resourceShare ram.ResourceShare
+	resourceName := "aws_ram_resource_share.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:          func() { acctest.PreCheck(t) },
+		ErrorCheck:        acctest.ErrorCheck(t, ram.EndpointsID),
+		ProviderFactories: acctest.ProviderFactories,
+		CheckDestroy:      testAccCheckResourceShareDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceShareNameConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckResourceShareExists(resourceName, &resourceShare),
+					acctest.CheckResourceDisappears(acctest.Provider, tfram.ResourceResourceShare(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccCheckResourceShareExists(resourceName string, resourceShare *ram.ResourceShare) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RAMConn
@@ -171,22 +227,11 @@ func testAccCheckResourceShareExists(resourceName string, resourceShare *ram.Res
 			return fmt.Errorf("No ID is set")
 		}
 
-		request := &ram.GetResourceSharesInput{
-			ResourceShareArns: []*string{aws.String(rs.Primary.ID)},
-			ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
-		}
-
-		output, err := conn.GetResourceShares(request)
+		resourceShare, err := tfram.FindResourceShareOwnerSelfByARN(conn, rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		if len(output.ResourceShares) == 0 {
-			return fmt.Errorf("No RAM resource share found")
-		}
-
-		resourceShare = output.ResourceShares[0]
-
 		if aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusActive {
 			return fmt.Errorf("RAM resource share (%s) delet(ing|ed)", rs.Primary.ID)
 		}
@@ -203,21 +248,13 @@ func testAccCheckResourceShareDestroy(s *terraform.State) error {
 			continue
 		}
 
-		request := &ram.GetResourceSharesInput{
-			ResourceShareArns: []*string{aws.String(rs.Primary.ID)},
-			ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
-		}
-
-		output, err := conn.GetResourceShares(request)
+		resourceShare, err := tfram.FindResourceShareOwnerSelfByARN(conn, rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		if len(output.ResourceShares) > 0 {
-			resourceShare := output.ResourceShares[0]
-			if aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusDeleted {
-				return fmt.Errorf("RAM resource share (%s) still exists", rs.Primary.ID)
-			}
+		if aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusDeleted {
+			return fmt.Errorf("RAM resource share (%s) still exists", rs.Primary.ID)
 		}
 	}
 
@@ -265,3 +302,14 @@ resource "aws_ram_resource_share" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccResourceShareNamePermissionConfig(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_ram_resource_share" "test" {
+  name            = %[1]q
+  permission_arns = ["arn:${data.aws_partition.current.partition}:ram::aws:permission/AWSRAMBlankEndEntityCertificateAPICSRPassthroughIssuanceCertificateAuthority"]
+}
+`, rName)
+}

website/docs/r/ram_resource_share.markdown

@@ -29,6 +29,7 @@ The following arguments are supported:
 
 * `name` - (Required) The name of the resource share.
 * `allow_external_principals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permission_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
 * `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ## Attributes Reference