[WIP] Add Codepipeline action region support

aws/resource_aws_codepipeline.go

@@ -15,6 +15,43 @@ import (
 )
 
 func resourceAwsCodePipeline() *schema.Resource {
+	var artifactStoreSchema = map[string]*schema.Schema{
+		"location": {
+			Type:     schema.TypeString,
+			Required: true,
+		},
+
+		"type": {
+			Type:     schema.TypeString,
+			Required: true,
+			ValidateFunc: validation.StringInSlice([]string{
+				codepipeline.ArtifactStoreTypeS3,
+			}, false),
+		},
+
+		"encryption_key": {
+			Type:     schema.TypeList,
+			MaxItems: 1,
+			Optional: true,
+			Elem: &schema.Resource{
+				Schema: map[string]*schema.Schema{
+					"id": {
+						Type:     schema.TypeString,
+						Required: true,
+					},
+
+					"type": {
+						Type:     schema.TypeString,
+						Required: true,
+						ValidateFunc: validation.StringInSlice([]string{
+							codepipeline.EncryptionKeyTypeKms,
+						}, false),
+					},
+				},
+			},
+		},
+	}
+
 	return &schema.Resource{
 		Create: resourceAwsCodePipelineCreate,
 		Read:   resourceAwsCodePipelineRead,
@@ -40,48 +77,17 @@ func resourceAwsCodePipeline() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
-
 			"artifact_store": {
 				Type:     schema.TypeList,
-				Required: true,
+				Optional: true,
 				MaxItems: 1,
+				Elem:     artifactStoreSchema,
+			},
+			"artifact_stores": {
+				Type:     schema.TypeMap,
+				Optional: true,
 				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"location": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-
-						"type": {
-							Type:     schema.TypeString,
-							Required: true,
-							ValidateFunc: validation.StringInSlice([]string{
-								codepipeline.ArtifactStoreTypeS3,
-							}, false),
-						},
-
-						"encryption_key": {
-							Type:     schema.TypeList,
-							MaxItems: 1,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"id": {
-										Type:     schema.TypeString,
-										Required: true,
-									},
-
-									"type": {
-										Type:     schema.TypeString,
-										Required: true,
-										ValidateFunc: validation.StringInSlice([]string{
-											codepipeline.EncryptionKeyTypeKms,
-										}, false),
-									},
-								},
-							},
-						},
-					},
+					Schema: artifactStoreSchema,
 				},
 			},
 			"stage": {
@@ -155,6 +161,11 @@ func resourceAwsCodePipeline() *schema.Resource {
 										Optional: true,
 										Computed: true,
 									},
+									"region": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+									},
 								},
 							},
 						},
@@ -195,19 +206,28 @@ func resourceAwsCodePipelineCreate(d *schema.ResourceData, meta interface{}) err
 }
 
 func expandAwsCodePipeline(d *schema.ResourceData) *codepipeline.PipelineDeclaration {
-	pipelineArtifactStore := expandAwsCodePipelineArtifactStore(d)
 	pipelineStages := expandAwsCodePipelineStages(d)
+	pipelineArtifactStore := expandAwsCodePipelineArtifactStore(d)
+	pipelineArtifactStores := expandAwsCodePipelineArtifactStores(d)
 
 	pipeline := codepipeline.PipelineDeclaration{
-		Name:          aws.String(d.Get("name").(string)),
-		RoleArn:       aws.String(d.Get("role_arn").(string)),
-		ArtifactStore: pipelineArtifactStore,
-		Stages:        pipelineStages,
+		Name:           aws.String(d.Get("name").(string)),
+		RoleArn:        aws.String(d.Get("role_arn").(string)),
+		ArtifactStore:  pipelineArtifactStore,
+		ArtifactStores: pipelineArtifactStores,
+		Stages:         pipelineStages,
 	}
+
 	return &pipeline
 }
+
 func expandAwsCodePipelineArtifactStore(d *schema.ResourceData) *codepipeline.ArtifactStore {
 	configs := d.Get("artifact_store").([]interface{})
+
+	if configs == nil {
+		return nil
+	}
+
 	data := configs[0].(map[string]interface{})
 	pipelineArtifactStore := codepipeline.ArtifactStore{
 		Location: aws.String(data["location"].(string)),
@@ -225,6 +245,22 @@ func expandAwsCodePipelineArtifactStore(d *schema.ResourceData) *codepipeline.Ar
 	return &pipelineArtifactStore
 }
 
+func expandAwsCodePipelineArtifactStores(d *schema.ResourceData) map[string]*codepipeline.ArtifactStore {
+	configs := d.Get("artifact_stores").(map[string]*schema.ResourceData)
+
+	if configs == nil {
+		return nil
+	}
+
+	pipelineArtifactStores := make(map[string]*codepipeline.ArtifactStore)
+
+	for region, config := range configs {
+		pipelineArtifactStores[region] = expandAwsCodePipelineArtifactStore(config)
+	}
+
+	return pipelineArtifactStores
+}
+
 func flattenAwsCodePipelineArtifactStore(artifactStore *codepipeline.ArtifactStore) []interface{} {
 	values := map[string]interface{}{}
 	values["type"] = *artifactStore.Type
@@ -313,6 +349,10 @@ func expandAwsCodePipelineActions(s []interface{}) []*codepipeline.ActionDeclara
 		if ro > 0 {
 			action.RunOrder = aws.Int64(int64(ro))
 		}
+		r := data["region"].(string)
+		if r != "" {
+			action.Region = aws.String(r)
+		}
 		actions = append(actions, &action)
 	}
 	return actions
@@ -354,6 +394,10 @@ func flattenAwsCodePipelineStageActions(actions []*codepipeline.ActionDeclaratio
 			values["run_order"] = int(*action.RunOrder)
 		}
 
+		if action.Region != nil {
+			values["region"] = *action.Region
+		}
+
 		actionsList = append(actionsList, values)
 	}
 	return actionsList

aws/resource_aws_codepipeline_test.go

@@ -135,6 +135,34 @@ func TestAccAWSCodePipeline_deployWithServiceRole(t *testing.T) {
 	})
 }
 
+func TestAccAWSCodePipeline_basic_multiregion(t *testing.T) {
+	if os.Getenv("GITHUB_TOKEN") == "" {
+		t.Skip("Environment variable GITHUB_TOKEN is not set")
+	}
+
+	name := acctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSCodePipelineDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSCodePipelineConfig_multiregion(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSCodePipelineExists("aws_codepipeline.bar"),
+					resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.name", "Build"),
+					resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.action.0.region", "eu-west-1"),
+					resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.action.1.region", "eu-central-1"),
+					resource.TestMatchResourceAttr(
+						"aws_codepipeline.bar", "stage.2.action.0.role_arn",
+						regexp.MustCompile("^arn:aws:iam::[0-9]{12}:role/codepipeline-action-role.*")),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSCodePipelineExists(n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -695,3 +723,147 @@ resource "aws_codepipeline" "bar" {
 }
 `, rName, rName, rName, rName)
 }
+
+func testAccAWSCodePipelineConfig_multiregion(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "eu-west-1" {
+  bucket = "tf-test-pipeline-eu-west-1-%s"
+  acl    = "private"
+}
+
+resource "aws_s3_bucket" "eu-central-1" {
+  bucket = "tf-test-pipeline-eu-central-1-%s"
+  acl    = "private"
+}
+
+resource "aws_iam_role" "codepipeline_role" {
+  name = "codepipeline-role-%s"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "codepipeline.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "codepipeline_policy" {
+  name = "codepipeline_policy"
+  role = "${aws_iam_role.codepipeline_role.id}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect":"Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "s3:GetBucketVersioning"
+      ],
+      "Resource": [
+        "${aws_s3_bucket.foo.arn}",
+        "${aws_s3_bucket.foo.arn}/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "codebuild:BatchGetBuilds",
+        "codebuild:StartBuild"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_codepipeline" "bar" {
+  name     = "test-pipeline-%s"
+  role_arn = "${aws_iam_role.codepipeline_role.arn}"
+
+  artifact_stores {
+	  eu-west-1 = {
+			location = "${aws_s3_bucket.eu-west-1.bucket}"
+			type     = "S3"
+
+			encryption_key {
+				id   = "1234"
+				type = "KMS"
+			}
+		}
+
+		eu-central-1 = {
+			location = "${aws_s3_bucket.eu-central-1.bucket}"
+			type     = "S3"
+
+			encryption_key {
+				id   = "1234"
+				type = "KMS"
+			}
+		}
+	}
+
+  stage {
+    name = "Source"
+
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "ThirdParty"
+      provider         = "GitHub"
+      version          = "1"
+      output_artifacts = ["test"]
+
+      configuration = {
+        Owner  = "lifesum-terraform"
+        Repo   = "test"
+        Branch = "master"
+      }
+    }
+  }
+
+  stage {
+    name = "Build"
+
+    action {
+		  region          = "eu-west-1"
+      name            = "EuWest1Build"
+      category        = "Build"
+      owner           = "AWS"
+      provider        = "CodeBuild"
+      input_artifacts = ["test"]
+      version         = "1"
+
+      configuration = {
+        ProjectName = "EuWest1Test"
+      }
+    }
+
+    action {
+		  region          = "eu-central-1"
+      name            = "EuCentral1Build"
+      category        = "Build"
+      owner           = "AWS"
+      provider        = "CodeBuild"
+      input_artifacts = ["test"]
+      version         = "1"
+
+      configuration = {
+        ProjectName = "EuCentral1Test"
+      }
+    }
+  }
+}
+`, rName, rName, rName, rName)
+}

website/docs/r/codepipeline.markdown

@@ -166,6 +166,7 @@ A `action` block supports the following arguments:
 * `output_artifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
 * `role_arn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
 * `run_order` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
 
 ~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.