Implement a subset of IAM resources

Implements support for IAM users, user policies, and access keys. This
is only a subset of what IAM can do (notably missing: roles and instance
profiles and associated policies), but it's a start.

Makes a dent in #28.

builtin/providers/aws/config.go

@@ -10,6 +10,7 @@ import (
  "github.com/hashicorp/aws-sdk-go/gen/autoscaling"
  "github.com/hashicorp/aws-sdk-go/gen/ec2"
  "github.com/hashicorp/aws-sdk-go/gen/elb"
+ "github.com/hashicorp/aws-sdk-go/gen/iam"
  "github.com/hashicorp/aws-sdk-go/gen/rds"
  "github.com/hashicorp/aws-sdk-go/gen/route53"
  "github.com/hashicorp/aws-sdk-go/gen/s3"
@@ -30,6 +31,7 @@ type AWSClient struct {
  r53conn *route53.Route53
  region string
  rdsconn *rds.RDS
+ iamconn *iam.IAM
 }
 
 // Client configures and returns a fully initailized AWSClient
@@ -70,6 +72,8 @@ func (c *Config) Client() (interface{}, error) {
  client.r53conn = route53.New(creds, "us-east-1", nil)
  log.Println("[INFO] Initializing EC2 Connection")
  client.ec2conn = ec2.New(creds, c.Region, nil)
+ log.Println("[INFO] Initializing IAM connection")
+ client.iamconn = iam.New(creds, c.Region, nil)
  }
 
  if len(errs) > 0 {

builtin/providers/aws/provider.go

@@ -52,6 +52,9 @@ func Provider() terraform.ResourceProvider {
  "aws_db_subnet_group": resourceAwsDbSubnetGroup(),
  "aws_eip": resourceAwsEip(),
  "aws_elb": resourceAwsElb(),
+ "aws_iam_access_key": resourceAwsIamAccessKey(),
+ "aws_iam_user_policy": resourceAwsIamUserPolicy(),
+ "aws_iam_user": resourceAwsIamUser(),
  "aws_instance": resourceAwsInstance(),
  "aws_internet_gateway": resourceAwsInternetGateway(),
  "aws_key_pair": resourceAwsKeyPair(),
@@ -61,8 +64,8 @@ func Provider() terraform.ResourceProvider {
  "aws_network_interface": resourceAwsNetworkInterface(),
  "aws_route53_record": resourceAwsRoute53Record(),
  "aws_route53_zone": resourceAwsRoute53Zone(),
- "aws_route_table": resourceAwsRouteTable(),
  "aws_route_table_association": resourceAwsRouteTableAssociation(),
+ "aws_route_table": resourceAwsRouteTable(),
  "aws_s3_bucket": resourceAwsS3Bucket(),
  "aws_security_group": resourceAwsSecurityGroup(),
  "aws_subnet": resourceAwsSubnet(),

builtin/providers/aws/resource_aws_iam_access_key.go

@@ -0,0 +1,116 @@
+package aws
+
+import (
+ "fmt"
+
+ "github.com/hashicorp/aws-sdk-go/aws"
+ "github.com/hashicorp/aws-sdk-go/gen/iam"
+
+ "github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamAccessKey() *schema.Resource {
+ return &schema.Resource{
+ Create: resourceAwsIamAccessKeyCreate,
+ Read: resourceAwsIamAccessKeyRead,
+ Delete: resourceAwsIamAccessKeyDelete,
+
+ Schema: map[string]*schema.Schema{
+ "user": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ "status": &schema.Schema{
+ Type: schema.TypeString,
+ // this could be settable, but goamz does not support the
+ // UpdateAccessKey API yet.
+ Computed: true,
+ },
+ "secret": &schema.Schema{
+ Type: schema.TypeString,
+ Computed: true,
+ },
+ },
+ }
+}
+
+func resourceAwsIamAccessKeyCreate(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.CreateAccessKeyRequest{
+ UserName: aws.String(d.Get("user").(string)),
+ }
+
+ createResp, err := iamconn.CreateAccessKey(request)
+ if err != nil {
+ return fmt.Errorf(
+ "Error creating access key for user %s: %s",
+ request.UserName,
+ err,
+ )
+ }
+
+ if err := d.Set("secret", createResp.AccessKey.SecretAccessKey); err != nil {
+ return err
+ }
+ return resourceAwsIamAccessKeyReadResult(d, &iam.AccessKeyMetadata{
+ AccessKeyID: createResp.AccessKey.AccessKeyID,
+ CreateDate: createResp.AccessKey.CreateDate,
+ Status: createResp.AccessKey.Status,
+ UserName: createResp.AccessKey.UserName,
+ })
+}
+
+func resourceAwsIamAccessKeyRead(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.ListAccessKeysRequest{
+ UserName: aws.String(d.Get("user").(string)),
+ }
+
+ getResp, err := iamconn.ListAccessKeys(request)
+ if err != nil {
+ if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX TEST ME
+ // the user does not exist, so the key can't exist.
+ d.SetId("")
+ return nil
+ }
+ return fmt.Errorf("Error reading IAM acces key: %s", err)
+ }
+
+ for _, key := range getResp.AccessKeyMetadata {
+ if key.AccessKeyID != nil && *key.AccessKeyID == d.Id() {
+ return resourceAwsIamAccessKeyReadResult(d, &key)
+ }
+ }
+
+ // Guess the key isn't around anymore.
+ d.SetId("")
+ return nil
+}
+
+func resourceAwsIamAccessKeyReadResult(d *schema.ResourceData, key *iam.AccessKeyMetadata) error {
+ d.SetId(*key.AccessKeyID)
+ if err := d.Set("user", key.UserName); err != nil {
+ return err
+ }
+ if err := d.Set("status", key.Status); err != nil {
+ return err
+ }
+ return nil
+}
+
+func resourceAwsIamAccessKeyDelete(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.DeleteAccessKeyRequest{
+ AccessKeyID: aws.String(d.Id()),
+ UserName: aws.String(d.Get("user").(string)),
+ }
+
+ if err := iamconn.DeleteAccessKey(request); err != nil {
+ return fmt.Errorf("Error deleting access key %s: %s", d.Id(), err)
+ }
+ return nil
+}

builtin/providers/aws/resource_aws_iam_user.go

@@ -0,0 +1,114 @@
+package aws
+
+import (
+ "fmt"
+
+ "github.com/hashicorp/aws-sdk-go/aws"
+ "github.com/hashicorp/aws-sdk-go/gen/iam"
+
+ "github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamUser() *schema.Resource {
+ return &schema.Resource{
+ Create: resourceAwsIamUserCreate,
+ Read: resourceAwsIamUserRead,
+ // There is an UpdateUser API call, but goamz doesn't support it yet.
+ // XXX but we aren't using goamz anymore.
+ //Update: resourceAwsIamUserUpdate,
+ Delete: resourceAwsIamUserDelete,
+
+ Schema: map[string]*schema.Schema{
+ "arn": &schema.Schema{
+ Type: schema.TypeString,
+ Computed: true,
+ },
+ /*
+ The UniqueID could be used as the Id(), but none of the API
+ calls allow specifying a user by the UniqueID: they require the
+ name. The only way to locate a user by UniqueID is to list them
+ all and that would make this provider unnecessarilly complex
+ and inefficient. Still, there are other reasons one might want
+ the UniqueID, so we can make it availible.
+ */
+ "unique_id": &schema.Schema{
+ Type: schema.TypeString,
+ Computed: true,
+ },
+ "name": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ "path": &schema.Schema{
+ Type: schema.TypeString,
+ Optional: true,
+ Default: "/",
+ ForceNew: true,
+ },
+ },
+ }
+}
+
+func resourceAwsIamUserCreate(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.CreateUserRequest{
+ Path: aws.String(d.Get("path").(string)),
+ UserName: aws.String(d.Get("name").(string)),
+ }
+
+ createResp, err := iamconn.CreateUser(request)
+ if err != nil {
+ return fmt.Errorf("Error creating IAM User %s: %s", request.UserName, err)
+ }
+ return resourceAwsIamUserReadResult(d, createResp.User)
+}
+
+func resourceAwsIamUserRead(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.GetUserRequest{
+ UserName: aws.String(d.Id()),
+ }
+
+ getResp, err := iamconn.GetUser(request)
+ if err != nil {
+ if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+ d.SetId("")
+ return nil
+ }
+ return fmt.Errorf("Error reading IAM User %s: %s", d.Id(), err)
+ }
+ return resourceAwsIamUserReadResult(d, getResp.User)
+}
+
+func resourceAwsIamUserReadResult(d *schema.ResourceData, user *iam.User) error {
+ d.SetId(*user.UserName)
+ if err := d.Set("name", user.UserName); err != nil {
+ return err
+ }
+ if err := d.Set("arn", user.ARN); err != nil {
+ return err
+ }
+ if err := d.Set("path", user.Path); err != nil {
+ return err
+ }
+ if err := d.Set("unique_id", user.UserID); err != nil {
+ return err
+ }
+ return nil
+}
+
+func resourceAwsIamUserDelete(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.DeleteUserRequest{
+ UserName: aws.String(d.Id()),
+ }
+
+ if err := iamconn.DeleteUser(request); err != nil {
+ return fmt.Errorf("Error deleting IAM User %s: %s", d.Id(), err)
+ }
+ return nil
+}

builtin/providers/aws/resource_aws_iam_user_policy.go

@@ -0,0 +1,110 @@
+package aws
+
+import (
+ "fmt"
+ "net/url"
+ "strings"
+
+ "github.com/hashicorp/aws-sdk-go/aws"
+ "github.com/hashicorp/aws-sdk-go/gen/iam"
+
+ "github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIamUserPolicy() *schema.Resource {
+ return &schema.Resource{
+ // PutUserPolicy API is idempotent, so these can be the same.
+ Create: resourceAwsIamUserPolicyPut,
+ Update: resourceAwsIamUserPolicyPut,
+
+ Read: resourceAwsIamUserPolicyRead,
+ Delete: resourceAwsIamUserPolicyDelete,
+
+ Schema: map[string]*schema.Schema{
+ "policy": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ },
+ "name": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ "user": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ },
+ }
+}
+
+func resourceAwsIamUserPolicyPut(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ request := &iam.PutUserPolicyRequest{
+ UserName: aws.String(d.Get("user").(string)),
+ PolicyName: aws.String(d.Get("name").(string)),
+ PolicyDocument: aws.String(d.Get("policy").(string)),
+ }
+
+ if err := iamconn.PutUserPolicy(request); err != nil {
+ return fmt.Errorf("Error putting IAM user policy %s: %s", request.PolicyName, err)
+ }
+
+ d.SetId(fmt.Sprintf("%s:%s", request.UserName, request.PolicyName))
+ return nil
+}
+
+func resourceAwsIamUserPolicyRead(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ user, name := resourceAwsIamUserPolicyParseId(d)
+
+ request := &iam.GetUserPolicyRequest{
+ PolicyName: aws.String(name),
+ UserName: aws.String(user),
+ }
+
+ getResp, err := iamconn.GetUserPolicy(request)
+ if err != nil {
+ if iamerr, ok := err.(aws.APIError); ok && iamerr.Code == "NoSuchEntity" { // XXX test me
+ d.SetId("")
+ return nil
+ }
+ return fmt.Errorf("Error reading IAM policy %s from user %s: %s", name, user, err)
+ }
+
+ if getResp.PolicyDocument == nil {
+ return fmt.Errorf("GetUserPolicy returned a nil policy document")
+ }
+
+ policy, err := url.QueryUnescape(*getResp.PolicyDocument)
+ if err != nil {
+ return err
+ }
+ return d.Set("policy", policy)
+}
+
+func resourceAwsIamUserPolicyDelete(d *schema.ResourceData, meta interface{}) error {
+ iamconn := meta.(*AWSClient).iamconn
+
+ user, name := resourceAwsIamUserPolicyParseId(d)
+
+ request := &iam.DeleteUserPolicyRequest{
+ PolicyName: aws.String(name),
+ UserName: aws.String(user),
+ }
+
+ if err := iamconn.DeleteUserPolicy(request); err != nil {
+ return fmt.Errorf("Error deleting IAM user policy %s: %s", d.Id(), err)
+ }
+ return nil
+}
+
+func resourceAwsIamUserPolicyParseId(d *schema.ResourceData) (userName, policyName string) {
+ parts := strings.SplitN(d.Id(), ":", 2)
+ userName = parts[0]
+ policyName = parts[1]
+ return
+}