Merge pull request #29460 from brittandeyoung/f-aws_lightsail_bucket_…

…resource_access

New Resource: `aws_lightsail_bucket_resource_access`

.changelog/29460.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_lightsail_bucket_resource_access
+```

internal/provider/provider.go

@@ -1711,6 +1711,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 
 			"aws_lightsail_bucket":                               lightsail.ResourceBucket(),
 			"aws_lightsail_bucket_access_key":                    lightsail.ResourceBucketAccessKey(),
+			"aws_lightsail_bucket_resource_access":               lightsail.ResourceBucketResourceAccess(),
 			"aws_lightsail_certificate":                          lightsail.ResourceCertificate(),
 			"aws_lightsail_container_service":                    lightsail.ResourceContainerService(),
 			"aws_lightsail_container_service_deployment_version": lightsail.ResourceContainerServiceDeploymentVersion(),

internal/service/lightsail/bucket_resource_access.go

@@ -0,0 +1,147 @@
+package lightsail
+
+import (
+	"context"
+	"errors"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/lightsail"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+const (
+	BucketResourceAccessIdPartsCount = 2
+)
+
+func ResourceBucketResourceAccess() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceBucketResourceAccessCreate,
+		ReadWithoutTimeout:   resourceBucketResourceAccessRead,
+		DeleteWithoutTimeout: resourceBucketResourceAccessDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"bucket_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$`), "Invalid Bucket name. Must match regex: ^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$"),
+			},
+			"resource_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringMatch(regexp.MustCompile(`\w[\w\-]*\w`), "Invalid resource name. Must match regex: \\w[\\w\\-]*\\w"),
+			},
+		},
+	}
+}
+
+func resourceBucketResourceAccessCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).LightsailConn()
+
+	in := lightsail.SetResourceAccessForBucketInput{
+		BucketName:   aws.String(d.Get("bucket_name").(string)),
+		ResourceName: aws.String(d.Get("resource_name").(string)),
+		Access:       aws.String(lightsail.ResourceBucketAccessAllow),
+	}
+
+	out, err := conn.SetResourceAccessForBucketWithContext(ctx, &in)
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, lightsail.OperationTypeSetResourceAccessForBucket, ResBucketResourceAccess, d.Get("bucket_name").(string), err)
+	}
+
+	if len(out.Operations) == 0 {
+		return create.DiagError(names.Lightsail, lightsail.OperationTypeSetResourceAccessForBucket, ResBucketResourceAccess, d.Get("bucket_name").(string), errors.New("No operations found for request"))
+	}
+
+	op := out.Operations[0]
+
+	err = waitOperation(ctx, conn, op.Id)
+	if err != nil {
+		return create.DiagError(names.Lightsail, lightsail.OperationTypeSetResourceAccessForBucket, ResBucketResourceAccess, d.Get("bucket_name").(string), errors.New("Error waiting for request operation"))
+	}
+
+	idParts := []string{d.Get("bucket_name").(string), d.Get("resource_name").(string)}
+	id, err := flex.FlattenResourceId(idParts, BucketResourceAccessIdPartsCount)
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, create.ErrActionFlatteningResourceId, ResBucketResourceAccess, d.Get("bucket_name").(string), err)
+	}
+
+	d.SetId(id)
+
+	return resourceBucketResourceAccessRead(ctx, d, meta)
+}
+
+func resourceBucketResourceAccessRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).LightsailConn()
+
+	out, err := FindBucketResourceAccessById(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		create.LogNotFoundRemoveState(names.Lightsail, create.ErrActionReading, ResBucketResourceAccess, d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, create.ErrActionReading, ResBucketResourceAccess, d.Id(), err)
+	}
+
+	parts, err := flex.ExpandResourceId(d.Id(), BucketResourceAccessIdPartsCount)
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, create.ErrActionExpandingResourceId, ResBucketResourceAccess, d.Id(), err)
+	}
+
+	d.Set("bucket_name", parts[0])
+	d.Set("resource_name", out.Name)
+
+	return nil
+}
+
+func resourceBucketResourceAccessDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).LightsailConn()
+	parts, err := flex.ExpandResourceId(d.Id(), BucketResourceAccessIdPartsCount)
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, create.ErrActionExpandingResourceId, ResBucketResourceAccess, d.Id(), err)
+	}
+
+	out, err := conn.SetResourceAccessForBucketWithContext(ctx, &lightsail.SetResourceAccessForBucketInput{
+		BucketName:   aws.String(parts[0]),
+		ResourceName: aws.String(parts[1]),
+		Access:       aws.String(lightsail.ResourceBucketAccessDeny),
+	})
+
+	if err != nil && tfawserr.ErrCodeEquals(err, lightsail.ErrCodeNotFoundException) {
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, lightsail.OperationTypeSetResourceAccessForBucket, ResBucketResourceAccess, d.Id(), err)
+	}
+
+	op := out.Operations[0]
+
+	err = waitOperation(ctx, conn, op.Id)
+
+	if err != nil {
+		return create.DiagError(names.Lightsail, lightsail.OperationTypeSetResourceAccessForBucket, ResBucketResourceAccess, d.Id(), err)
+	}
+
+	return nil
+}

internal/service/lightsail/bucket_resource_access_test.go

@@ -0,0 +1,169 @@
+package lightsail_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/lightsail"
+	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tflightsail "github.com/hashicorp/terraform-provider-aws/internal/service/lightsail"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccLightsailBucketResourceAccess_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lightsail_bucket_resource_access.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(t)
+			acctest.PreCheckPartitionHasService(lightsail.EndpointsID, t)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, lightsail.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBucketResourceAccessDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBucketResourceAccessConfig_basic(rName, bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketResourceAccessExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "bucket_name", bucketName),
+					resource.TestCheckResourceAttr(resourceName, "resource_name", rName),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccLightsailBucketResourceAccess_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lightsail_bucket_resource_access.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(t)
+			acctest.PreCheckPartitionHasService(lightsail.EndpointsID, t)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, lightsail.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBucketResourceAccessDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBucketResourceAccessConfig_basic(rName, bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketResourceAccessExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tflightsail.ResourceBucketResourceAccess(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckBucketResourceAccessExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("Resource not found: %s", resourceName)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).LightsailConn()
+
+		out, err := tflightsail.FindBucketResourceAccessById(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		if out == nil {
+			return fmt.Errorf("BucketResourceAccess %q does not exist", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckBucketResourceAccessDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).LightsailConn()
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_lightsail_bucket_access_key" {
+				continue
+			}
+
+			_, err := tflightsail.FindBucketResourceAccessById(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.Lightsail, create.ErrActionCheckingDestroyed, tflightsail.ResBucketResourceAccess, rs.Primary.ID, errors.New("still exists"))
+		}
+
+		return nil
+	}
+}
+
+func testAccBucketResourceAccessConfig_base(bucketName string) string {
+	return fmt.Sprintf(`
+resource "aws_lightsail_bucket" "test" {
+  name      = %[1]q
+  bundle_id = "small_1_0"
+}
+data "aws_availability_zones" "available" {
+  state = "available"
+  filter {
+    name   = "opt-in-status"
+    values = ["opt-in-not-required"]
+  }
+}
+
+
+`, bucketName)
+}
+
+func testAccBucketResourceAccessConfig_basic(rName string, bucketName string) string {
+	return acctest.ConfigCompose(testAccBucketResourceAccessConfig_base(bucketName), fmt.Sprintf(`
+resource "aws_lightsail_instance" "test" {
+  name              = %[1]q
+  availability_zone = data.aws_availability_zones.available.names[0]
+  blueprint_id      = "amazon_linux_2"
+  bundle_id         = "nano_1_0"
+}
+
+resource "aws_lightsail_bucket_resource_access" "test" {
+  bucket_name   = aws_lightsail_bucket.test.id
+  resource_name = aws_lightsail_instance.test.id
+}
+
+
+`, rName))
+}

internal/service/lightsail/consts.go

@@ -3,6 +3,7 @@ package lightsail
 const (
 	ResBucket                             = "Bucket"
 	ResBucketAccessKey                    = "Bucket Access Key"
+	ResBucketResourceAccess               = "Bucket Resource Access"
 	ResCertificate                        = "Certificate"
 	ResDatabase                           = "Database"
 	ResDisk                               = "Disk"

internal/service/lightsail/find.go

@@ -492,3 +492,51 @@ func FindBucketAccessKeyById(ctx context.Context, conn *lightsail.Lightsail, id
 
 	return entry, nil
 }
+
+func FindBucketResourceAccessById(ctx context.Context, conn *lightsail.Lightsail, id string) (*lightsail.ResourceReceivingAccess, error) {
+	parts, err := flex.ExpandResourceId(id, BucketAccessKeyIdPartsCount)
+
+	if err != nil {
+		return nil, err
+	}
+
+	in := &lightsail.GetBucketsInput{
+		BucketName:                aws.String(parts[0]),
+		IncludeConnectedResources: aws.Bool(true),
+	}
+
+	out, err := conn.GetBucketsWithContext(ctx, in)
+
+	if tfawserr.ErrCodeEquals(err, lightsail.ErrCodeNotFoundException) {
+		return nil, &resource.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || len(out.Buckets) == 0 || out.Buckets[0] == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	bucket := out.Buckets[0]
+	var entry *lightsail.ResourceReceivingAccess
+	entryExists := false
+
+	for _, n := range bucket.ResourcesReceivingAccess {
+		if parts[1] == aws.StringValue(n.Name) {
+			entry = n
+			entryExists = true
+			break
+		}
+	}
+
+	if !entryExists {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return entry, nil
+}