diff --git a/aws/resource_aws_transfer_server.go b/aws/resource_aws_transfer_server.go index 00d69113361..9d53bac6cde 100644 --- a/aws/resource_aws_transfer_server.go +++ b/aws/resource_aws_transfer_server.go @@ -62,6 +62,12 @@ func resourceAwsTransferServer() *schema.Resource { ValidateFunc: validateArn, }, + "force_destroy": { + Type: schema.TypeBool, + Optional: true, + Default: false, + }, + "tags": tagsSchema(), }, } @@ -194,6 +200,13 @@ func resourceAwsTransferServerUpdate(d *schema.ResourceData, meta interface{}) e func resourceAwsTransferServerDelete(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).transferconn + if d.Get("force_destroy").(bool) { + log.Printf("[DEBUG] Transfer Server (%s) attempting to forceDestroy", d.Id()) + if err := deleteTransferUsers(conn, d.Id(), nil); err != nil { + return err + } + } + delOpts := &transfer.DeleteServerInput{ ServerId: aws.String(d.Id()), } @@ -234,3 +247,41 @@ func waitForTransferServerDeletion(conn *transfer.Transfer, serverID string) err return resource.RetryableError(fmt.Errorf("Transfer Server (%s) still exists", serverID)) }) } + +func deleteTransferUsers(conn *transfer.Transfer, serverID string, nextToken *string) error { + listOpts := &transfer.ListUsersInput{ + ServerId: aws.String(serverID), + NextToken: nextToken, + } + + log.Printf("[DEBUG] List Transfer User Option: %#v", listOpts) + + resp, err := conn.ListUsers(listOpts) + if err != nil { + return err + } + + for _, user := range resp.Users { + + delOpts := &transfer.DeleteUserInput{ + ServerId: aws.String(serverID), + UserName: user.UserName, + } + + log.Printf("[DEBUG] Delete Transfer User Option: %#v", delOpts) + + _, err = conn.DeleteUser(delOpts) + if err != nil { + if isAWSErr(err, transfer.ErrCodeResourceNotFoundException, "") { + continue + } + return fmt.Errorf("error deleting Transfer User (%s) for Server(%s): %s", *user.UserName, serverID, err) + } + } + + if resp.NextToken != nil { + return deleteTransferUsers(conn, serverID, resp.NextToken) + } + + return nil +} diff --git a/aws/resource_aws_transfer_server_test.go b/aws/resource_aws_transfer_server_test.go index 5111d840c80..9a61cab69fa 100644 --- a/aws/resource_aws_transfer_server_test.go +++ b/aws/resource_aws_transfer_server_test.go @@ -6,6 +6,7 @@ import ( "testing" "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/service/iam" "github.com/aws/aws-sdk-go/service/transfer" "github.com/hashicorp/terraform/helper/acctest" @@ -36,9 +37,10 @@ func TestAccAWSTransferServer_basic(t *testing.T) { ), }, { - ResourceName: "aws_transfer_server.foo", - ImportState: true, - ImportStateVerify: true, + ResourceName: "aws_transfer_server.foo", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"force_destroy"}, }, { Config: testAccAWSTransferServerConfig_basicUpdate(rName), @@ -108,6 +110,40 @@ func TestAccAWSTransferServer_disappears(t *testing.T) { }) } +func TestAccAWSTransferServer_forcedestroy(t *testing.T) { + var conf transfer.DescribedServer + var roleConf iam.GetRoleOutput + rName := acctest.RandString(5) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + IDRefreshName: "aws_transfer_server.foo", + Providers: testAccProviders, + CheckDestroy: testAccCheckAWSTransferServerDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAWSTransferServerConfig_forcedestroy(rName), + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSTransferServerExists("aws_transfer_server.foo", &conf), + testAccCheckAWSRoleExists("aws_iam_role.foo", &roleConf), + resource.TestCheckResourceAttr( + "aws_transfer_server.foo", "identity_provider_type", "SERVICE_MANAGED"), + resource.TestCheckResourceAttr( + "aws_transfer_server.foo", "force_destroy", "true"), + testAccCheckAWSTransferCreateUser(&conf, &roleConf, rName), + testAccCheckAWSTransferCreateSshKey(&conf, rName), + ), + }, + { + ResourceName: "aws_transfer_server.foo", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"force_destroy"}, + }, + }, + }) +} + func testAccCheckAWSTransferServerExists(n string, res *transfer.DescribedServer) resource.TestCheckFunc { return func(s *terraform.State) error { rs, ok := s.RootModule().Resources[n] @@ -177,6 +213,42 @@ func testAccCheckAWSTransferServerDestroy(s *terraform.State) error { return nil } +func testAccCheckAWSTransferCreateUser(describedServer *transfer.DescribedServer, getRoleOutput *iam.GetRoleOutput, userName string) resource.TestCheckFunc { + return func(s *terraform.State) error { + conn := testAccProvider.Meta().(*AWSClient).transferconn + + input := &transfer.CreateUserInput{ + ServerId: describedServer.ServerId, + UserName: aws.String(userName), + Role: getRoleOutput.Role.Arn, + } + + if _, err := conn.CreateUser(input); err != nil { + return fmt.Errorf("error creating Transfer User (%s) on Server (%s): %s", userName, aws.StringValue(describedServer.ServerId), err) + } + + return nil + } +} + +func testAccCheckAWSTransferCreateSshKey(describedServer *transfer.DescribedServer, userName string) resource.TestCheckFunc { + return func(s *terraform.State) error { + conn := testAccProvider.Meta().(*AWSClient).transferconn + + input := &transfer.ImportSshPublicKeyInput{ + ServerId: describedServer.ServerId, + UserName: aws.String(userName), + SshPublicKeyBody: aws.String("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 phodgson@thoughtworks.com"), + } + + if _, err := conn.ImportSshPublicKey(input); err != nil { + return fmt.Errorf("error creating Transfer SSH Public Key for (%s/%s): %s", userName, aws.StringValue(describedServer.ServerId), err) + } + + return nil + } +} + const testAccAWSTransferServerConfig_basic = ` resource "aws_transfer_server" "foo" {} ` @@ -348,3 +420,50 @@ resource "aws_transfer_server" "foo" { `, rName, rName, rName, rName) } + +func testAccAWSTransferServerConfig_forcedestroy(rName string) string { + return fmt.Sprintf(` +resource "aws_transfer_server" "foo" { + force_destroy = true +} + +resource "aws_iam_role" "foo" { + name = "tf-test-transfer-user-iam-role-%s" + + assume_role_policy = <