Support AWS PrivateLink #2515

ewbankkit · 2017-12-01T23:47:17Z

Fixes #2222 and #2460.
Incorporates #2253.

ewbankkit · 2017-12-01T23:48:34Z

Initial commits are just an excuse to write down a task list 😄.

ewbankkit · 2017-12-05T23:41:26Z

There will be no aws_vpc_endpoint_connection_accepter resource as my initial understanding of VPC endpoint connection acceptance was wrong. I think we can add an auto_accept attribute to the aws_vpc_endpoint resource to accept the endpoint connection if the endpoint service is in the same account.

darrenhaken · 2017-12-06T19:39:33Z

Any idea when this might be complete?

ewbankkit · 2017-12-06T22:10:06Z

Need to complete the aws_vpc_endpoint_connection_notification and then make some updates to the aws_vpc_endpoint resource and aws_vpc_endpoint/aws_vpc_endpoint_service data sources.
May well need to merge #2253 in and submit the combined PR for completeness.
Don't want to make promises, but shouldn't be too long.

darrenhaken · 2017-12-06T22:11:41Z

Sure thanks. If you need any help ping me, happy to try and contribute. I haven’t done much Go before but certainly always prepared to roll up my sleeves 😁

…

________________________________ From: Kit Ewbank <notifications@github.com> Sent: Wednesday, December 6, 2017 10:10:11 PM To: terraform-providers/terraform-provider-aws Cc: Darren Haken; Comment Subject: Re: [terraform-providers/terraform-provider-aws] [WIP] Support AWS PrivateLink for Private Connectivity (#2515) Need to complete the aws_vpc_endpoint_connection_notification and then make some updates to the aws_vpc_endpoint resource and aws_vpc_endpoint/aws_vpc_endpoint_service data sources. May well need to merge #2253<#2253> in and submit the combined PR for completeness. Don't want to make promises, but shouldn't be too long. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#2515 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AA6Me1kuVM5917ofOcwTCS9_cNTbMxDFks5s9xDDgaJpZM4QzDyk>.

ewbankkit · 2017-12-10T23:51:43Z

The PR now incorporates the work done in #2253 and support AWS Private Link for both AWS and non-AWS (user defined) services.
I made the decision to combine as completing the non-AWS service work completely built on the work in #2253.

The aws_vpc_endpoint_service has been added as the resource through which non-AWS VPC Endpoint Services are managed.
The associated aws_vpc_endpoint_service_allowed_principal allows whitelisted resources to be added or removed independent of the main resource (e.g. in a separate Terraform state).

In addition to the changes in #2253, the aws_vpc_endpoint resource has been enhanced with the auto_accept attribute which allows a same-account non-AWS VPC Endpoint to be accepted.

ewbankkit · 2017-12-10T23:53:53Z

Acceptance tests:

aws_vpc_endpoint_service data source:

make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsVpcEndpointService_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccDataSourceAwsVpcEndpointService_ -timeout 120m
=== RUN   TestAccDataSourceAwsVpcEndpointService_gateway
--- PASS: TestAccDataSourceAwsVpcEndpointService_gateway (14.77s)
=== RUN   TestAccDataSourceAwsVpcEndpointService_interface
--- PASS: TestAccDataSourceAwsVpcEndpointService_interface (13.73s)
=== RUN   TestAccDataSourceAwsVpcEndpointService_custom
--- PASS: TestAccDataSourceAwsVpcEndpointService_custom (240.52s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	269.032s

aws_vpc_endpoint data source:

make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsVpcEndpoint_'
make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsVpcEndpoint_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccDataSourceAwsVpcEndpoint_ -timeout 120m
=== RUN   TestAccDataSourceAwsVpcEndpoint_gatewayBasic
--- PASS: TestAccDataSourceAwsVpcEndpoint_gatewayBasic (44.07s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_byId
--- PASS: TestAccDataSourceAwsVpcEndpoint_byId (43.84s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_gatewayWithRouteTable
--- PASS: TestAccDataSourceAwsVpcEndpoint_gatewayWithRouteTable (47.68s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_interface
--- PASS: TestAccDataSourceAwsVpcEndpoint_interface (282.24s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	417.844s

aws_vpc_endpoint_service resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointService_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointService_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointService_importBasic
--- PASS: TestAccAwsVpcEndpointService_importBasic (222.59s)
=== RUN   TestAccAwsVpcEndpointService_basic
--- PASS: TestAccAwsVpcEndpointService_basic (395.80s)
=== RUN   TestAccAwsVpcEndpointService_removed
--- PASS: TestAccAwsVpcEndpointService_removed (243.92s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	862.326s

aws_vpc_endpoint_service_allowed_principal resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointServiceAllowedPrincipal_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointServiceAllowedPrincipal_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointServiceAllowedPrincipal_basic
--- PASS: TestAccAwsVpcEndpointServiceAllowedPrincipal_basic (233.62s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	233.631s

aws_vpc_endpoint resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpoint_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpoint_ -timeout 120m
=== RUN   TestAccAwsVpcEndpoint_importBasic
--- PASS: TestAccAwsVpcEndpoint_importBasic (44.37s)
=== RUN   TestAccAwsVpcEndpoint_gatewayBasic
--- PASS: TestAccAwsVpcEndpoint_gatewayBasic (39.30s)
=== RUN   TestAccAwsVpcEndpoint_gatewayWithRouteTableAndPolicy
--- PASS: TestAccAwsVpcEndpoint_gatewayWithRouteTableAndPolicy (73.09s)
=== RUN   TestAccAwsVpcEndpoint_interfaceBasic
--- PASS: TestAccAwsVpcEndpoint_interfaceBasic (58.46s)
=== RUN   TestAccAwsVpcEndpoint_interfaceWithSubnetAndSecurityGroup
--- PASS: TestAccAwsVpcEndpoint_interfaceWithSubnetAndSecurityGroup (383.52s)
=== RUN   TestAccAwsVpcEndpoint_interfaceNonAWSService
--- PASS: TestAccAwsVpcEndpoint_interfaceNonAWSService (290.49s)
=== RUN   TestAccAwsVpcEndpoint_removed
--- PASS: TestAccAwsVpcEndpoint_removed (32.10s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	921.354s

aws_vpc_endpoint_route_table_association resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointRouteTableAssociation_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointRouteTableAssociation_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointRouteTableAssociation_basic
--- PASS: TestAccAwsVpcEndpointRouteTableAssociation_basic (42.73s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	42.743s

aws_vpc_endpoint_subnet_association resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointSubnetAssociation_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointSubnetAssociation_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointSubnetAssociation_basic
--- PASS: TestAccAwsVpcEndpointSubnetAssociation_basic (129.30s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	129.316s

aws_vpc_endpoint_connection_notification resource:

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointConnectionNotification_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointConnectionNotification_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointConnectionNotification_importBasic
--- PASS: TestAccAwsVpcEndpointConnectionNotification_importBasic (244.87s)
=== RUN   TestAccAwsVpcEndpointConnectionNotification_basic
--- PASS: TestAccAwsVpcEndpointConnectionNotification_basic (265.81s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	510.696s

ewbankkit · 2017-12-11T01:03:14Z

Removed WIP.

RyanJarv · 2017-12-22T18:23:12Z

Hey awesome work! Quick observation here, allowed_principals on aws_vpc_endpoint_service doesn't seem to be updated if it is removed in terraform (whitelisted principals stay whitelisted on the endpoint service).

skeller88 · 2018-01-02T21:25:37Z

Any update on when this might be merged? I'm also eagerly awaiting a fix.

ewbankkit · 2018-01-07T21:33:34Z

@RyanJarv By "removed in terraform" do you mean that you removed the allowed_principals attribute (in which case Terraform will no longer manage that value as it's marked as Computed) or set it to the empty list: allowed_principals = []?

allowed_principals is Computed as the set of principals can either be managed via the aws_vpc_endpoint_service resource's allowed_principals attribute or via the aws_vpc_endpoint_service_allowed_principal resource.

RyanJarv · 2018-01-17T19:54:06Z

@ewbankkit looks like I was removing allowed_principals. Setting it to an empty array behaves as expected.

…ervice_allowed_principal resources.

ewbankkit · 2018-01-19T21:18:15Z

Rebased to fix conflicts.

…flicts.

tombooth · 2018-01-26T11:45:20Z

@jen20 @radeksimko what's holding this up? having to run a forked version of this provider for the moment

jen20 · 2018-01-26T13:14:55Z

My mistake, I've been busy with other things. I'll try to pick this up today unless another maintainer does before me.

sverze · 2018-01-27T17:22:17Z

Any ETA on when this will be merged?

Add documentation for aws_vpc_endpoint_service and aws_vpc_endpoint_service_allowed_principal resources. Normalize 'not found' resource log lines on read. Use 'ConflictsWith' in schema. Use 'helper/validation' package to avoid frequent 'validators.go' conflicts.

stevenayers · 2018-01-30T15:13:58Z

@jen20 @radeksimko Any ETA on when this'll be merged? Thanks.

kjmancuso · 2018-01-30T22:28:00Z

jen20 · 2018-02-03T20:30:59Z

I've rebased and merged this locallly, and it looks good to go - it landed in 35b273e. Thanks for a great PR @ewbankkit.

Sorry for the delay on merging this, but I have limited time to work on outside projects such as Terraform these days.

bflad · 2018-02-09T22:31:22Z

This has been released in terraform-provider-aws version 1.9.0. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

ghost · 2020-04-04T17:20:54Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

radeksimko added the new-resource Introduces a new resource. label Dec 2, 2017

ewbankkit force-pushed the issue-2460 branch from c80d7dc to 6a52b1f Compare December 10, 2017 23:39

ewbankkit mentioned this pull request Dec 10, 2017

Support AWS PrivateLink for AWS Services #2253

Closed

7 tasks

ewbankkit changed the title ~~[WIP] Support AWS PrivateLink for Private Connectivity~~ [WIP] Support AWS PrivateLink Dec 10, 2017

ewbankkit changed the title ~~[WIP] Support AWS PrivateLink~~ Support AWS PrivateLink Dec 11, 2017

ewbankkit force-pushed the issue-2460 branch from 6a52b1f to 1626f84 Compare December 19, 2017 23:00

ewbankkit mentioned this pull request Dec 21, 2017

aws_vpc_endpoint type mismatch for ec2 service_name #2695

Closed

jen20 self-assigned this Dec 29, 2017

radeksimko added enhancement Requests to existing resources that expand the functionality or scope. service/ec2 Issues and PRs that pertain to the ec2 service. labels Jan 16, 2018

ewbankkit added 3 commits January 19, 2018 16:15

Add documentation for aws_vpc_endpoint_service and aws_vpc_endpoint_s…

1cc2c5c

…ervice_allowed_principal resources.

Normalize 'not found' resource log lines on read.

9ae96bf

Use 'ConflictsWith' in schema.

6e59b27

ewbankkit force-pushed the issue-2460 branch from 76ec790 to 6e59b27 Compare January 19, 2018 21:17

Use 'helper/validation' package to avoid frequent 'validators.go' con…

185f045

…flicts.

jen20 closed this Feb 3, 2018

jen20 mentioned this pull request Feb 3, 2018

Feature: Support AWS PrivateLink for AWS Services #2222

Closed

bflad added this to the v1.9.0 milestone Feb 9, 2018

ewbankkit deleted the issue-2460 branch August 3, 2018 14:16

ghost locked and limited conversation to collaborators Apr 4, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support AWS PrivateLink #2515

Support AWS PrivateLink #2515

ewbankkit commented Dec 1, 2017 •

edited

Loading

ewbankkit commented Dec 1, 2017

ewbankkit commented Dec 5, 2017

darrenhaken commented Dec 6, 2017

ewbankkit commented Dec 6, 2017

darrenhaken commented Dec 6, 2017 via email

ewbankkit commented Dec 10, 2017

ewbankkit commented Dec 10, 2017 •

edited

Loading

ewbankkit commented Dec 11, 2017

RyanJarv commented Dec 22, 2017 •

edited

Loading

skeller88 commented Jan 2, 2018

ewbankkit commented Jan 7, 2018 •

edited

Loading

RyanJarv commented Jan 17, 2018

ewbankkit commented Jan 19, 2018

tombooth commented Jan 26, 2018

jen20 commented Jan 26, 2018

sverze commented Jan 27, 2018

stevenayers commented Jan 30, 2018

kjmancuso commented Jan 30, 2018

jen20 commented Feb 3, 2018

bflad commented Feb 9, 2018

ghost commented Apr 4, 2020

Support AWS PrivateLink #2515

Support AWS PrivateLink #2515

Conversation

ewbankkit commented Dec 1, 2017 • edited Loading

ewbankkit commented Dec 1, 2017

ewbankkit commented Dec 5, 2017

darrenhaken commented Dec 6, 2017

ewbankkit commented Dec 6, 2017

darrenhaken commented Dec 6, 2017 via email

ewbankkit commented Dec 10, 2017

ewbankkit commented Dec 10, 2017 • edited Loading

ewbankkit commented Dec 11, 2017

RyanJarv commented Dec 22, 2017 • edited Loading

skeller88 commented Jan 2, 2018

ewbankkit commented Jan 7, 2018 • edited Loading

RyanJarv commented Jan 17, 2018

ewbankkit commented Jan 19, 2018

tombooth commented Jan 26, 2018

jen20 commented Jan 26, 2018

sverze commented Jan 27, 2018

stevenayers commented Jan 30, 2018

kjmancuso commented Jan 30, 2018

jen20 commented Feb 3, 2018

bflad commented Feb 9, 2018

ghost commented Apr 4, 2020

ewbankkit commented Dec 1, 2017 •

edited

Loading

ewbankkit commented Dec 10, 2017 •

edited

Loading

RyanJarv commented Dec 22, 2017 •

edited

Loading

ewbankkit commented Jan 7, 2018 •

edited

Loading