Add force destroy support for Transfer Server

aws/resource_aws_transfer_server.go

@@ -62,6 +62,12 @@ func resourceAwsTransferServer() *schema.Resource {
  ValidateFunc: validateArn,
  },
 
+ "force_destroy": {
+ Type: schema.TypeBool,
+ Optional: true,
+ Default: false,
+ },
+
  "tags": tagsSchema(),
  },
  }
@@ -194,6 +200,13 @@ func resourceAwsTransferServerUpdate(d *schema.ResourceData, meta interface{}) e
 func resourceAwsTransferServerDelete(d *schema.ResourceData, meta interface{}) error {
  conn := meta.(*AWSClient).transferconn
 
+ if d.Get("force_destroy").(bool) {
+ log.Printf("[DEBUG] Transfer Server (%s) attempting to forceDestroy", d.Id())
+ if err := deleteTransferUsers(conn, d.Id(), nil); err != nil {
+ return err
+ }
+ }
+
  delOpts := &transfer.DeleteServerInput{
  ServerId: aws.String(d.Id()),
  }
@@ -234,3 +247,41 @@ func waitForTransferServerDeletion(conn *transfer.Transfer, serverID string) err
  return resource.RetryableError(fmt.Errorf("Transfer Server (%s) still exists", serverID))
  })
 }
+
+func deleteTransferUsers(conn *transfer.Transfer, serverID string, nextToken *string) error {
+ listOpts := &transfer.ListUsersInput{
+ ServerId: aws.String(serverID),
+ NextToken: nextToken,
+ }
+
+ log.Printf("[DEBUG] List Transfer User Option: %#v", listOpts)
+
+ resp, err := conn.ListUsers(listOpts)
+ if err != nil {
+ return err
+ }
+
+ for _, user := range resp.Users {
+
+ delOpts := &transfer.DeleteUserInput{
+ ServerId: aws.String(serverID),
+ UserName: user.UserName,
+ }
+
+ log.Printf("[DEBUG] Delete Transfer User Option: %#v", delOpts)
+
+ _, err = conn.DeleteUser(delOpts)
+ if err != nil {
+ if isAWSErr(err, transfer.ErrCodeResourceNotFoundException, "") {
+ continue
+ }
+ return fmt.Errorf("error deleting Transfer User (%s) for Server(%s): %s", *user.UserName, serverID, err)
+ }
+ }
+
+ if resp.NextToken != nil {
+ return deleteTransferUsers(conn, serverID, resp.NextToken)
+ }
+
+ return nil
+}

aws/resource_aws_transfer_server_test.go

@@ -6,6 +6,7 @@ import (
  "testing"
 
  "github.com/aws/aws-sdk-go/aws"
+ "github.com/aws/aws-sdk-go/service/iam"
  "github.com/aws/aws-sdk-go/service/transfer"
 
  "github.com/hashicorp/terraform/helper/acctest"
@@ -36,9 +37,10 @@ func TestAccAWSTransferServer_basic(t *testing.T) {
  ),
  },
  {
- ResourceName: "aws_transfer_server.foo",
- ImportState: true,
- ImportStateVerify: true,
+ ResourceName: "aws_transfer_server.foo",
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateVerifyIgnore: []string{"force_destroy"},
  },
  {
  Config: testAccAWSTransferServerConfig_basicUpdate(rName),
@@ -108,6 +110,40 @@ func TestAccAWSTransferServer_disappears(t *testing.T) {
  })
 }
 
+func TestAccAWSTransferServer_forcedestroy(t *testing.T) {
+ var conf transfer.DescribedServer
+ var roleConf iam.GetRoleOutput
+ rName := acctest.RandString(5)
+
+ resource.ParallelTest(t, resource.TestCase{
+ PreCheck: func() { testAccPreCheck(t) },
+ IDRefreshName: "aws_transfer_server.foo",
+ Providers: testAccProviders,
+ CheckDestroy: testAccCheckAWSTransferServerDestroy,
+ Steps: []resource.TestStep{
+ {
+ Config: testAccAWSTransferServerConfig_forcedestroy(rName),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckAWSTransferServerExists("aws_transfer_server.foo", &conf),
+ testAccCheckAWSRoleExists("aws_iam_role.foo", &roleConf),
+ resource.TestCheckResourceAttr(
+ "aws_transfer_server.foo", "identity_provider_type", "SERVICE_MANAGED"),
+ resource.TestCheckResourceAttr(
+ "aws_transfer_server.foo", "force_destroy", "true"),
+ testAccCheckAWSTransferCreateUser(&conf, &roleConf, rName),
+ testAccCheckAWSTransferCreateSshKey(&conf, rName),
+ ),
+ },
+ {
+ ResourceName: "aws_transfer_server.foo",
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateVerifyIgnore: []string{"force_destroy"},
+ },
+ },
+ })
+}
+
 func testAccCheckAWSTransferServerExists(n string, res *transfer.DescribedServer) resource.TestCheckFunc {
  return func(s *terraform.State) error {
  rs, ok := s.RootModule().Resources[n]
@@ -177,6 +213,42 @@ func testAccCheckAWSTransferServerDestroy(s *terraform.State) error {
  return nil
 }
 
+func testAccCheckAWSTransferCreateUser(describedServer *transfer.DescribedServer, getRoleOutput *iam.GetRoleOutput, userName string) resource.TestCheckFunc {
+ return func(s *terraform.State) error {
+ conn := testAccProvider.Meta().(*AWSClient).transferconn
+
+ input := &transfer.CreateUserInput{
+ ServerId: describedServer.ServerId,
+ UserName: aws.String(userName),
+ Role: getRoleOutput.Role.Arn,
+ }
+
+ if _, err := conn.CreateUser(input); err != nil {
+ return fmt.Errorf("error creating Transfer User (%s) on Server (%s): %s", userName, aws.StringValue(describedServer.ServerId), err)
+ }
+
+ return nil
+ }
+}
+
+func testAccCheckAWSTransferCreateSshKey(describedServer *transfer.DescribedServer, userName string) resource.TestCheckFunc {
+ return func(s *terraform.State) error {
+ conn := testAccProvider.Meta().(*AWSClient).transferconn
+
+ input := &transfer.ImportSshPublicKeyInput{
+ ServerId: describedServer.ServerId,
+ UserName: aws.String(userName),
+ SshPublicKeyBody: aws.String("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 phodgson@thoughtworks.com"),
+ }
+
+ if _, err := conn.ImportSshPublicKey(input); err != nil {
+ return fmt.Errorf("error creating Transfer SSH Public Key for (%s/%s): %s", userName, aws.StringValue(describedServer.ServerId), err)
+ }
+
+ return nil
+ }
+}
+
 const testAccAWSTransferServerConfig_basic = `
 resource "aws_transfer_server" "foo" {}
 `
@@ -348,3 +420,50 @@ resource "aws_transfer_server" "foo" {
 `, rName, rName, rName, rName)
 
 }
+
+func testAccAWSTransferServerConfig_forcedestroy(rName string) string {
+ return fmt.Sprintf(`
+resource "aws_transfer_server" "foo" {
+ force_destroy = true
+}
+
+resource "aws_iam_role" "foo" {
+ name = "tf-test-transfer-user-iam-role-%s"
+
+ assume_role_policy = <<EOF
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "transfer.amazonaws.com"
+ },
+ "Action": "sts:AssumeRole"
+ }
+ ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "foo" {
+ name = "tf-test-transfer-user-iam-policy-%s"
+ role = "${aws_iam_role.foo.id}"
+ policy = <<POLICY
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "AllowFullAccesstoS3",
+ "Effect": "Allow",
+ "Action": [
+ "s3:*"
+ ],
+ "Resource": "*"
+ }
+ ]
+}
+POLICY
+}
+`, rName, rName)
+}

website/docs/r/transfer_server.html.markdown

@@ -71,6 +71,7 @@ The following arguments are supported:
 * `url` - (Optional) - URL of the service endpoint used to authenticate users with an `identity_provider_type` of `API_GATEWAY`.
 * `identity_provider_type` - (Optional) The mode of authentication enabled for this service. The default value is `SERVICE_MANAGED`, which allows you to store and access SFTP user credentials within the service. `API_GATEWAY` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice.
 * `logging_role` - (Optional) Amazon Resource Name (ARN) of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
+* `force_destroy` - (Optional) A boolean that indicates all users associated with the server should be deleted so that the Server can be destroyed without error. The default value is `false`.
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
 ## Attributes Reference