Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

d/aws_redshift_service_account: Deprecate #31006

Merged
merged 3 commits into from
Apr 26, 2023
Merged

d/aws_redshift_service_account: Deprecate #31006

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
86b393a
d/aws_redshift_service_account: Deprecation notice.
ewbankkit Apr 26, 2023
4a26408
d/aws_redshift_service_account: Remove from acceptance test configura…
ewbankkit Apr 26, 2023
68c6c12
Correct name for CHANGELOG entry file.
ewbankkit Apr 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/31006.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:note
data-source/aws_db_security_group: The `aws_redshift_service_account` data source has been deprecated and will be removed in a future version. AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy
```
10 changes: 4 additions & 6 deletions internal/service/redshift/cluster_data_source_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,8 +180,6 @@ data "aws_redshift_cluster" "test" {

func testAccClusterDataSourceConfig_logging(rName string) string {
return fmt.Sprintf(`
data "aws_redshift_service_account" "test" {}

resource "aws_s3_bucket" "test" {
bucket = %[1]q
force_destroy = true
Expand All @@ -193,8 +191,8 @@ data "aws_iam_policy_document" "test" {
resources = ["${aws_s3_bucket.test.arn}/*"]

principals {
identifiers = [data.aws_redshift_service_account.test.arn]
type = "AWS"
type = "Service"
identifiers = ["redshift.amazonaws.com"]
}
}

Expand All @@ -203,8 +201,8 @@ data "aws_iam_policy_document" "test" {
resources = [aws_s3_bucket.test.arn]

principals {
identifiers = [data.aws_redshift_service_account.test.arn]
type = "AWS"
type = "Service"
identifiers = ["redshift.amazonaws.com"]
}
}
}
Expand Down
6 changes: 2 additions & 4 deletions internal/service/redshift/cluster_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1198,8 +1198,6 @@ func testAccClusterConfig_loggingEnabled(rName string) string {
return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInExclude("usw2-az2"), fmt.Sprintf(`
data "aws_partition" "current" {}

data "aws_redshift_service_account" "main" {}

resource "aws_s3_bucket" "test" {
bucket = %[1]q
force_destroy = true
Expand All @@ -1215,7 +1213,7 @@ resource "aws_s3_bucket_policy" "test" {
"Sid": "Stmt1376526643067",
"Effect": "Allow",
"Principal": {
"AWS": "${data.aws_redshift_service_account.main.arn}"
"Service": "redshift.${data.aws_partition.current.dns_suffix}"
},
"Action": "s3:PutObject",
"Resource": "arn:${data.aws_partition.current.partition}:s3:::%[1]s/*"
Expand All @@ -1224,7 +1222,7 @@ resource "aws_s3_bucket_policy" "test" {
"Sid": "Stmt137652664067",
"Effect": "Allow",
"Principal": {
"AWS": "${data.aws_redshift_service_account.main.arn}"
"Service": "redshift.${data.aws_partition.current.dns_suffix}"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:${data.aws_partition.current.partition}:s3:::%[1]s"
Expand Down
2 changes: 2 additions & 0 deletions internal/service/redshift/service_account_data_source.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ func DataSourceServiceAccount() *schema.Resource {
Computed: true,
},
},

DeprecationMessage: `The aws_redshift_service_account data source has been deprecated and will be removed in a future version. Use a service principal name instead of AWS account ID in any relevant IAM policy.`,
}
}

Expand Down
66 changes: 0 additions & 66 deletions internal/service/redshift/service_account_data_source_test.go
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion website/docs/d/redshift_service_account.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ Use this data source to get the Account ID of the [AWS Redshift Service Account]
in a given region for the purpose of allowing Redshift to store audit data in S3.

~> **Note:** AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy.
The `aws_redshift_service_account` data source should now be considered deprecated and will be removed in a future version.
The `aws_redshift_service_account` data source has been deprecated and will be removed in a future version.

## Example Usage

Expand Down