diff --git a/.changelog/35684.txt b/.changelog/35684.txt new file mode 100644 index 00000000000..235b729785f --- /dev/null +++ b/.changelog/35684.txt @@ -0,0 +1,3 @@ +```release-note:enhancement +resource/aws_ecs_service: Add `service_connect_configuration.service.timeout` and `service_connect_configuration.service.tls` configuration blocks +``` \ No newline at end of file diff --git a/internal/service/ecs/service.go b/internal/service/ecs/service.go index 139abef7aea..cac4fc069ef 100644 --- a/internal/service/ecs/service.go +++ b/internal/service/ecs/service.go @@ -414,6 +414,57 @@ func ResourceService() *schema.Resource { Type: schema.TypeString, Required: true, }, + "timeout": { + Type: schema.TypeList, + Optional: true, + MaxItems: 1, + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + "idle_timeout_seconds": { + Type: schema.TypeInt, + Optional: true, + ValidateFunc: validation.IntBetween(0, 2147483647), + }, + "per_request_timeout_seconds": { + Type: schema.TypeInt, + Optional: true, + ValidateFunc: validation.IntBetween(0, 2147483647), + }, + }, + }, + }, + "tls": { + Type: schema.TypeList, + Optional: true, + MaxItems: 1, + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + "issuer_cert_authority": { + Type: schema.TypeList, + Required: true, + MaxItems: 1, + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + "aws_pca_authority_arn": { + Type: schema.TypeString, + Optional: true, + ValidateFunc: verify.ValidARN, + }, + }, + }, + }, + "kms_key": { + Type: schema.TypeString, + Optional: true, + }, + "role_arn": { + Type: schema.TypeString, + Optional: true, + ValidateFunc: verify.ValidARN, + }, + }, + }, + }, }, }, }, @@ -764,9 +815,9 @@ func resourceServiceRead(ctx context.Context, d *schema.ResourceData, meta inter return sdkdiag.AppendErrorf(diags, "setting network_configuration: %s", err) } - // if err := d.Set("service_connect_configuration", flattenServiceConnectConfiguration(service.ServiceConnectConfiguration)); err != nil { - // return fmt.Errorf("setting service_connect_configuration for (%s): %w", d.Id(), err) - // } + //if err := d.Set("service_connect_configuration", flattenServiceConnectConfiguration(service.ServiceConnectConfiguration)); err != nil { + // return sdkdiag.AppendErrorf(diags, "setting service_connect_configuration: %s", err) + //} if err := d.Set("service_registries", flattenServiceRegistries(service.ServiceRegistries)); err != nil { return sdkdiag.AppendErrorf(diags, "setting service_registries: %s", err) @@ -1441,12 +1492,68 @@ func expandServices(srv []interface{}) []*ecs.ServiceConnectService { config.PortName = aws.String(v) } + if v, ok := raw["timeout"].([]interface{}); ok && len(v) > 0 { + config.Timeout = expandTimeout(v) + } + + if v, ok := raw["tls"].([]interface{}); ok && len(v) > 0 { + config.Tls = expandTLS(v) + } + out = append(out, &config) } return out } +func expandTimeout(timeout []interface{}) *ecs.TimeoutConfiguration { + if len(timeout) == 0 { + return nil + } + raw := timeout[0].(map[string]interface{}) + timeoutConfig := &ecs.TimeoutConfiguration{} + if v, ok := raw["idle_timeout_seconds"].(int); ok { + timeoutConfig.IdleTimeoutSeconds = aws.Int64(int64(v)) + } + if v, ok := raw["per_request_timeout_seconds"].(int); ok { + timeoutConfig.PerRequestTimeoutSeconds = aws.Int64(int64(v)) + } + return timeoutConfig +} + +func expandTLS(tls []interface{}) *ecs.ServiceConnectTlsConfiguration { + if len(tls) == 0 { + return nil + } + + raw := tls[0].(map[string]interface{}) + tlsConfig := &ecs.ServiceConnectTlsConfiguration{} + if v, ok := raw["issuer_cert_authority"].([]interface{}); ok && len(v) > 0 { + tlsConfig.IssuerCertificateAuthority = expandIssuerCertAuthority(v) + } + if v, ok := raw["kms_key"].(string); ok && v != "" { + tlsConfig.KmsKey = aws.String(v) + } + if v, ok := raw["role_arn"].(string); ok && v != "" { + tlsConfig.RoleArn = aws.String(v) + } + return tlsConfig +} + +func expandIssuerCertAuthority(pca []interface{}) *ecs.ServiceConnectTlsCertificateAuthority { + if len(pca) == 0 { + return nil + } + + raw := pca[0].(map[string]interface{}) + config := &ecs.ServiceConnectTlsCertificateAuthority{} + + if v, ok := raw["aws_pca_authority_arn"].(string); ok && v != "" { + config.AwsPcaAuthorityArn = aws.String(v) + } + return config +} + func expandClientAliases(srv []interface{}) []*ecs.ServiceConnectClientAlias { if len(srv) == 0 { return nil diff --git a/internal/service/ecs/service_test.go b/internal/service/ecs/service_test.go index f5c0aa175b7..760aefc006f 100644 --- a/internal/service/ecs/service_test.go +++ b/internal/service/ecs/service_test.go @@ -4237,6 +4237,66 @@ resource "aws_ecs_service" "test" { func testAccServiceConfig_serviceConnectAllAttributes(rName string) string { return fmt.Sprintf(` +resource "aws_kms_key" "test" { + description = %[1]q + deletion_window_in_days = 7 + policy = data.aws_iam_policy_document.test.json +} + + +data "aws_iam_policy_document" "test" { + policy_id = "KMSPolicy" + + statement { + sid = "Root User Permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"] + } + actions = [ + "kms:*"] + resources = ["*"] + } + + statement { + sid = "EC2 kms permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [aws_iam_role.test.arn] + } + actions = [ + "kms:Encrypt", + "kms:Decrypt", + "kms:GenerateDataKey", + "kms:GenerateDataKeyPair"] + resources = ["*"] + } +} + +resource "aws_iam_role" "test" { + name = %[1]q + + assume_role_policy = <