Skip to content

Commit

Permalink
r/aws_acm_certificate: Update options in place
Browse files Browse the repository at this point in the history
  • Loading branch information
@mattburgess
mattburgess committed Mar 2, 2023
1 parent 9453b99 commit 93ceb56
Show file tree
Hide file tree
Showing 2 changed files with 157 additions and 10 deletions.
24 changes: 14 additions & 10 deletions internal/service/acm/certificate.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -137,28 +137,19 @@ func ResourceCertificate() *schema.Resource {
"options": {
Type: schema.TypeList,
Optional: true,
Computed: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"certificate_transparency_logging_preference": {
Type: schema.TypeString,
Optional: true,
ForceNew: true,
Default: acm.CertificateTransparencyLoggingPreferenceEnabled,
ValidateFunc: validation.StringInSlice(acm.CertificateTransparencyLoggingPreference_Values(), false),
ConflictsWith: []string{"certificate_body", "certificate_chain", "private_key"},
},
},
},
DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
if _, ok := d.GetOk("private_key"); ok {
// ignore diffs for imported certs; they have a different logging preference
// default to requested certs which can't be changed by the ImportCertificate API
return true
}
// behave just like verify.SuppressMissingOptionalConfigurationBlock() for requested certs
return old == "1" && new == "0"
},
},
"pending_renewal": {
Type: schema.TypeBool,
Expand Down Expand Up @@ -545,6 +536,19 @@ func resourceCertificateUpdate(ctx context.Context, d *schema.ResourceData, meta
}
}

if d.HasChange("options") {
_, n := d.GetChange("options")

log.Printf("[INFO] Updating Certificate Options (%s)", d.Id())
_, err := conn.UpdateCertificateOptionsWithContext(ctx, &acm.UpdateCertificateOptionsInput{
CertificateArn: aws.String(d.Get("arn").(string)),
Options: expandCertificateOptions(n.([]interface{})[0].(map[string]interface{})),
})
if err != nil {
return diag.Errorf("updating certificate options (%s): %s", d.Id(), err)
}
}

if d.HasChange("tags_all") {
o, n := d.GetChange("tags_all")

Expand Down
143 changes: 143 additions & 0 deletions internal/service/acm/certificate_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1391,6 +1391,97 @@ func TestAccACMCertificate_disableCTLogging(t *testing.T) {
})
}

func TestAccACMCertificate_disableReenableCTLogging(t *testing.T) {
ctx := acctest.Context(t)
resourceName := "aws_acm_certificate.test"
rootDomain := acctest.ACMCertificateDomainFromEnv(t)
var v acm.CertificateDetail

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { acctest.PreCheck(t) },
ErrorCheck: acctest.ErrorCheck(t, acm.EndpointsID),
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
CheckDestroy: testAccCheckCertificateDestroy(ctx),
Steps: []resource.TestStep{
{
Config: testAccCertificateConfig_optionsWithValidation(rootDomain, acm.ValidationMethodDns, "ENABLED"),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckCertificateExists(ctx, resourceName, &v),
acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
"domain_name": rootDomain,
"resource_record_type": "CNAME",
}),
resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
resource.TestCheckTypeSetElemAttr(resourceName, "subject_alternative_names.*", rootDomain),
resource.TestCheckResourceAttr(resourceName, "status", acm.CertificateStatusIssued),
resource.TestCheckResourceAttr(resourceName, "validation_emails.#", "0"),
resource.TestCheckResourceAttr(resourceName, "validation_method", acm.ValidationMethodDns),
resource.TestCheckResourceAttr(resourceName, "options.#", "1"),
resource.TestCheckResourceAttr(resourceName, "options.0.certificate_transparency_logging_preference", acm.CertificateTransparencyLoggingPreferenceEnabled),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
},
{
Config: testAccCertificateConfig_optionsWithValidation(rootDomain, acm.ValidationMethodDns, "DISABLED"),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckCertificateExists(ctx, resourceName, &v),
acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
"domain_name": rootDomain,
"resource_record_type": "CNAME",
}),
resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
resource.TestCheckTypeSetElemAttr(resourceName, "subject_alternative_names.*", rootDomain),
resource.TestCheckResourceAttr(resourceName, "status", acm.CertificateStatusIssued),
resource.TestCheckResourceAttr(resourceName, "validation_emails.#", "0"),
resource.TestCheckResourceAttr(resourceName, "validation_method", acm.ValidationMethodDns),
resource.TestCheckResourceAttr(resourceName, "options.#", "1"),
resource.TestCheckResourceAttr(resourceName, "options.0.certificate_transparency_logging_preference", acm.CertificateTransparencyLoggingPreferenceDisabled),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
},
{
Config: testAccCertificateConfig_optionsWithValidation(rootDomain, acm.ValidationMethodDns, "ENABLED"),
Check: resource.ComposeAggregateTestCheckFunc(
testAccCheckCertificateExists(ctx, resourceName, &v),
acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
"domain_name": rootDomain,
"resource_record_type": "CNAME",
}),
resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
resource.TestCheckTypeSetElemAttr(resourceName, "subject_alternative_names.*", rootDomain),
resource.TestCheckResourceAttr(resourceName, "status", acm.CertificateStatusIssued),
resource.TestCheckResourceAttr(resourceName, "validation_emails.#", "0"),
resource.TestCheckResourceAttr(resourceName, "validation_method", acm.ValidationMethodDns),
resource.TestCheckResourceAttr(resourceName, "options.#", "1"),
resource.TestCheckResourceAttr(resourceName, "options.0.certificate_transparency_logging_preference", acm.CertificateTransparencyLoggingPreferenceEnabled),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
},
},
})
}

// lintignore:AT002
func TestAccACMCertificate_Imported_domainName(t *testing.T) {
ctx := acctest.Context(t)
Expand Down Expand Up @@ -1918,6 +2009,58 @@ resource "aws_acm_certificate" "test" {
`, domainName, validationMethod)
}

func testAccCertificateConfig_optionsWithValidation(domainName, validationMethod, loggingPreference string) string {
return fmt.Sprintf(`
resource "aws_acm_certificate" "test" {
domain_name = %[1]q
validation_method = %[2]q
options {
certificate_transparency_logging_preference = %[3]q
}
}
data "aws_route53_zone" "test" {
name = %[1]q
private_zone = false
}
# for_each acceptance testing requires SDKv2
#
# resource "aws_route53_record" "test" {
# for_each = {
# for dvo in aws_acm_certificate.test.domain_validation_options : dvo.domain_name => {
# name = dvo.resource_record_name
# record = dvo.resource_record_value
# type = dvo.resource_record_type
# }
# }
# allow_overwrite = true
# name = each.value.name
# records = [each.value.record]
# ttl = 60
# type = each.value.type
# zone_id = data.aws_route53_zone.test.zone_id
# }
resource "aws_route53_record" "test" {
allow_overwrite = true
name = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_name
records = [tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_value]
ttl = 60
type = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_type
zone_id = data.aws_route53_zone.test.zone_id
}
resource "aws_acm_certificate_validation" "test" {
depends_on = [aws_route53_record.test]
certificate_arn = aws_acm_certificate.test.arn
}
`, domainName, validationMethod, loggingPreference)
}

func testAccCertificateConfig_keyAlgorithm(domainName, validationMethod, keyAlgorithm string) string {
return fmt.Sprintf(`
resource "aws_acm_certificate" "test" {
Expand Down

0 comments on commit 93ceb56

Please sign in to comment.