provider/aws: New SSM Parameter resource

[tomelliff]

This new resource can be used for creating parameters in AWS' SSM Parameter Store that can then be used by other applications that have access to AWS and necessary IAM permissions.

Acceptance tests are currently passing:

$ make testacc TEST=./builtin/providers/aws TESTARGS="-run=TestAccAWSSSMParameter_"
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/04/27 16:16:06 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSSSMParameter_ -timeout 120m
=== RUN   TestAccAWSSSMParameter_basic
--- PASS: TestAccAWSSSMParameter_basic (33.45s)
=== RUN   TestAccAWSSSMParameter_update
--- PASS: TestAccAWSSSMParameter_update (58.78s)
=== RUN   TestAccAWSSSMParameter_secure
--- PASS: TestAccAWSSSMParameter_secure (32.97s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	125.224s

$ make testacc TEST=./builtin/providers/aws TESTARGS="-run=TestValidateSsmParameterType"
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/04/27 16:13:52 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestValidateSsmParameterType -timeout 120m
=== RUN   TestValidateSsmParameterType
--- PASS: TestValidateSsmParameterType (0.00s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	0.021s

This is my first stab at creating a new resource and I'm not all that used to Go just yet either so I might be missing a whole bunch of things here and would love any feedback I get from this.

This was previously requested in #11433. Would be good to add a data source for this at some point as well but this solves an immediate use case I have right now (providing a secret to a Lambda function that I deploy using Terraform).

TODO:

• Documentation
• Optionally use CMK to encrypt SecureString - might be left to a later date
• Any missing tests?

[tomelliff]

I'm unsure if I should be marking value as Sensitive because it's only really sensitive for SecureStrings. Am I right in thinking this will just hide it from logs but still leave it in plain text in state? And is there a downside to it or should I just do it here because some of the time it will be sensitive?

[tomelliff]

@radeksimko sorry to nag you but is there any chance you could take a look at this as is please? I'm starting a new job on Monday so probably won't get much time for a while to look at this again after this week.

My testing with it seems to do everything I need it to do (including working with the file interpolation which is my main requirement for storing SSH keys in SSM Parameter store) but not sure if it needs any more automated tests at all?

I'm happy without the CMK option for SecureStrings right now but that might be useful to be added in later -
did you want me to raise an issue for this for completeness?

[tyjonesAncestry]

@radeksimko Can you approve and merge this? My org also needs this ASAP.

Thanks!

[tomelliff]

Just noticed that there's merge conflicts on the branch now. I'll sort those as soon as the rest of the code has been reviewed.

EDIT: Conflicts look fine, just need to move this parameter store stuff after aws_ssm_maintenance_window in the provider and website docs and take both sides of the validation files.

[wyaeld]

@tomelliff Would you also be interested to produce a data source version of the parameter_store for reading existing values? I think you already have most of the implementation code

similar to https://www.terraform.io/docs/providers/aws/d/kms_alias.html
eg.

data "aws_ssm_parameter" "db_master_password" {
  name = "some_project/some_environment/rds/master_password"
}

We work in sensitive environments, so use parameter store for generic secrets management since we can pair it with IAM policies that limit application access to them.

[tyjonesAncestry]

+1. If the data source and the ability to create them were in Terraform that would be fantastic.

[tomelliff]

Yeah, happy to add a data source once this has been reviewed and I get some free time. Would like to check if this is missing anything glaring first though.

[radeksimko]

Hi @tomelliff
thank you for submitting this PR.

This looks overall 👌 I just left you a few questions there. Would you mind looking over those?

[radeksimko]

Is it worth marking this field as Sensitive as it may contain sensitive data?

[radeksimko]

Just FYI - there's d.IsNewResource() which can basically tell you whether this is being called from Create() or Update() and therefore you could reduce the number of arguments as you already have *schema.ResourceData there.

[radeksimko]

What exactly is the reason for retrying this operation if there's no retryable error? 🤔

[radeksimko]

Also would you mind rebasing your branch & resolving conflicts? Thanks.

[analytically]

Will this be part of 0.9.7?

[wyaeld]

@tomelliff even if you're busy, could you please prioritize spending a couple of hours and finishing this.

[radeksimko]

#15035 was just merged. @tomelliff thank you for all the initial work and @pmorton for taking it to the finish line 🎉

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.