Skip to content

Commit fa497c9

Browse files
ewbankkitewbankkit
authored
Merge pull request #43139 from acwwat/f-aws_cloudwatch_event_archive-add_kms_key_identifier_arg
feat: Add kms_key_identifier arg to aws_cloudwatch_event_archive
2 parents 5e93e6e + 475a1bf commit fa497c9

File tree

4 files changed

+306
-38
lines changed

4 files changed

+306
-38
lines changed

‎.changelog/43139.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/aws_cloudwatch_event_archive: Add `kms_key_identifier` argument
3+
```

‎internal/service/events/archive.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"context"
88
"log"
99

10+
"github.com/YakDriver/regexache"
1011
"github.com/aws/aws-sdk-go-v2/aws"
1112
"github.com/aws/aws-sdk-go-v2/service/eventbridge"
1213
"github.com/aws/aws-sdk-go-v2/service/eventbridge/types"
@@ -60,6 +61,14 @@ func resourceArchive() *schema.Resource {
6061
ForceNew: true,
6162
ValidateFunc: verify.ValidARN,
6263
},
64+
"kms_key_identifier": {
65+
Type: schema.TypeString,
66+
Optional: true,
67+
ValidateFunc: validation.All(
68+
validation.StringLenBetween(0, 2048),
69+
validation.StringMatch(regexache.MustCompile(`^[a-zA-Z0-9_\-/:]*$`), ""),
70+
),
71+
},
6372
names.AttrName: {
6473
Type: schema.TypeString,
6574
Required: true,
@@ -97,6 +106,10 @@ func resourceArchiveCreate(ctx context.Context, d *schema.ResourceData, meta any
97106
input.EventPattern = aws.String(v)
98107
}
99108

109+
if v, ok := d.GetOk("kms_key_identifier"); ok {
110+
input.KmsKeyIdentifier = aws.String(v.(string))
111+
}
112+
100113
if v, ok := d.GetOk("retention_days"); ok {
101114
input.RetentionDays = aws.Int32(int32(v.(int)))
102115
}
@@ -132,6 +145,7 @@ func resourceArchiveRead(ctx context.Context, d *schema.ResourceData, meta any)
132145
d.Set(names.AttrDescription, output.Description)
133146
d.Set("event_pattern", output.EventPattern)
134147
d.Set("event_source_arn", output.EventSourceArn)
148+
d.Set("kms_key_identifier", output.KmsKeyIdentifier)
135149
d.Set(names.AttrName, output.ArchiveName)
136150
d.Set("retention_days", output.RetentionDays)
137151

@@ -159,6 +173,10 @@ func resourceArchiveUpdate(ctx context.Context, d *schema.ResourceData, meta any
159173
input.EventPattern = aws.String(v)
160174
}
161175

176+
if v, ok := d.GetOk("kms_key_identifier"); ok {
177+
input.KmsKeyIdentifier = aws.String(v.(string))
178+
}
179+
162180
if v, ok := d.GetOk("retention_days"); ok {
163181
input.RetentionDays = aws.Int32(int32(v.(int)))
164182
}

‎internal/service/events/archive_test.go

Lines changed: 210 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ func TestAccEventsArchive_basic(t *testing.T) {
4040
acctest.CheckResourceAttrRegionalARN(ctx, resourceName, names.AttrARN, "events", fmt.Sprintf("archive/%s", archiveName)),
4141
resource.TestCheckResourceAttr(resourceName, names.AttrDescription, ""),
4242
resource.TestCheckResourceAttr(resourceName, "event_pattern", ""),
43+
resource.TestCheckResourceAttr(resourceName, "kms_key_identifier", ""),
4344
),
4445
},
4546
{
@@ -106,6 +107,91 @@ func TestAccEventsArchive_disappears(t *testing.T) {
106107
})
107108
}
108109

110+
func TestAccEventsArchive_kmsKeyIdentifier(t *testing.T) {
111+
ctx := acctest.Context(t)
112+
var v1 eventbridge.DescribeArchiveOutput
113+
archiveName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
114+
resourceName := "aws_cloudwatch_event_archive.test"
115+
116+
resource.ParallelTest(t, resource.TestCase{
117+
PreCheck: func() { acctest.PreCheck(ctx, t) },
118+
ErrorCheck: acctest.ErrorCheck(t, names.EventsServiceID),
119+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
120+
CheckDestroy: testAccCheckArchiveDestroy(ctx),
121+
Steps: []resource.TestStep{
122+
{
123+
Config: testAccArchiveConfig_kmsKeyIdentifier(archiveName, "${aws_kms_key.test_1.id}"),
124+
Check: resource.ComposeTestCheckFunc(
125+
testAccCheckArchiveExists(ctx, resourceName, &v1),
126+
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
127+
resource.TestCheckResourceAttrPair(resourceName, "kms_key_identifier", "aws_kms_key.test_1", names.AttrID),
128+
),
129+
},
130+
{
131+
ResourceName: resourceName,
132+
ImportState: true,
133+
ImportStateVerify: true,
134+
},
135+
{
136+
Config: testAccArchiveConfig_kmsKeyIdentifier(archiveName, "${aws_kms_key.test_2.arn}"),
137+
Check: resource.ComposeTestCheckFunc(
138+
testAccCheckArchiveExists(ctx, resourceName, &v1),
139+
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
140+
resource.TestCheckResourceAttrPair(resourceName, "kms_key_identifier", "aws_kms_key.test_2", names.AttrARN),
141+
),
142+
},
143+
{
144+
Config: testAccArchiveConfig_kmsKeyIdentifier(archiveName, "${aws_kms_alias.test_1.name}"),
145+
Check: resource.ComposeTestCheckFunc(
146+
testAccCheckArchiveExists(ctx, resourceName, &v1),
147+
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
148+
resource.TestCheckResourceAttrPair(resourceName, "kms_key_identifier", "aws_kms_alias.test_1", names.AttrName),
149+
),
150+
},
151+
{
152+
Config: testAccArchiveConfig_kmsKeyIdentifier(archiveName, "${aws_kms_alias.test_1.arn}"),
153+
Check: resource.ComposeTestCheckFunc(
154+
testAccCheckArchiveExists(ctx, resourceName, &v1),
155+
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
156+
resource.TestCheckResourceAttrPair(resourceName, "kms_key_identifier", "aws_kms_alias.test_1", names.AttrARN),
157+
),
158+
},
159+
},
160+
})
161+
}
162+
163+
func TestAccEventsArchive_retentionSetOnCreation(t *testing.T) {
164+
ctx := acctest.Context(t)
165+
var v1 eventbridge.DescribeArchiveOutput
166+
archiveName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
167+
resourceName := "aws_cloudwatch_event_archive.test"
168+
169+
resource.ParallelTest(t, resource.TestCase{
170+
PreCheck: func() { acctest.PreCheck(ctx, t) },
171+
ErrorCheck: acctest.ErrorCheck(t, names.EventsServiceID),
172+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
173+
CheckDestroy: testAccCheckArchiveDestroy(ctx),
174+
Steps: []resource.TestStep{
175+
{
176+
Config: testAccArchiveConfig_retentionOnCreation(archiveName),
177+
Check: resource.ComposeTestCheckFunc(
178+
testAccCheckArchiveExists(ctx, resourceName, &v1),
179+
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
180+
resource.TestCheckResourceAttr(resourceName, "retention_days", "1"),
181+
acctest.CheckResourceAttrRegionalARN(ctx, resourceName, names.AttrARN, "events", fmt.Sprintf("archive/%s", archiveName)),
182+
resource.TestCheckResourceAttr(resourceName, names.AttrDescription, ""),
183+
resource.TestCheckResourceAttr(resourceName, "event_pattern", ""),
184+
),
185+
},
186+
{
187+
ResourceName: resourceName,
188+
ImportState: true,
189+
ImportStateVerify: true,
190+
},
191+
},
192+
})
193+
}
194+
109195
func testAccCheckArchiveDestroy(ctx context.Context) resource.TestCheckFunc {
110196
return func(s *terraform.State) error {
111197
conn := acctest.Provider.Meta().(*conns.AWSClient).EventsClient(ctx)
@@ -153,38 +239,6 @@ func testAccCheckArchiveExists(ctx context.Context, n string, v *eventbridge.Des
153239
}
154240
}
155241

156-
func TestAccEventsArchive_retentionSetOnCreation(t *testing.T) {
157-
ctx := acctest.Context(t)
158-
var v1 eventbridge.DescribeArchiveOutput
159-
archiveName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
160-
resourceName := "aws_cloudwatch_event_archive.test"
161-
162-
resource.ParallelTest(t, resource.TestCase{
163-
PreCheck: func() { acctest.PreCheck(ctx, t) },
164-
ErrorCheck: acctest.ErrorCheck(t, names.EventsServiceID),
165-
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
166-
CheckDestroy: testAccCheckArchiveDestroy(ctx),
167-
Steps: []resource.TestStep{
168-
{
169-
Config: testAccArchiveConfig_retentionOnCreation(archiveName),
170-
Check: resource.ComposeTestCheckFunc(
171-
testAccCheckArchiveExists(ctx, resourceName, &v1),
172-
resource.TestCheckResourceAttr(resourceName, names.AttrName, archiveName),
173-
resource.TestCheckResourceAttr(resourceName, "retention_days", "1"),
174-
acctest.CheckResourceAttrRegionalARN(ctx, resourceName, names.AttrARN, "events", fmt.Sprintf("archive/%s", archiveName)),
175-
resource.TestCheckResourceAttr(resourceName, names.AttrDescription, ""),
176-
resource.TestCheckResourceAttr(resourceName, "event_pattern", ""),
177-
),
178-
},
179-
{
180-
ResourceName: resourceName,
181-
ImportState: true,
182-
ImportStateVerify: true,
183-
},
184-
},
185-
})
186-
}
187-
188242
func testAccArchiveConfig_basic(name string) string {
189243
return fmt.Sprintf(`
190244
resource "aws_cloudwatch_event_bus" "test" {
@@ -218,6 +272,130 @@ PATTERN
218272
`, name)
219273
}
220274

275+
func testAccArchiveConfig_kmsKeyIdentifier(name, kmsKeyIdentifier string) string {
276+
return fmt.Sprintf(`
277+
data "aws_caller_identity" "current" {}
278+
data "aws_partition" "current" {}
279+
280+
resource "aws_cloudwatch_event_bus" "test" {
281+
name = %[1]q
282+
}
283+
284+
resource "aws_kms_key" "test_1" {
285+
deletion_window_in_days = 7
286+
policy = jsonencode({
287+
Version = "2012-10-17"
288+
Id = "key-policy-example"
289+
Statement = [
290+
{
291+
Sid = "Enable IAM User Permissions"
292+
Effect = "Allow"
293+
Principal = {
294+
AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
295+
},
296+
Action = "kms:*"
297+
Resource = "*"
298+
},
299+
{
300+
Sid = "Allow describing of the key"
301+
Effect = "Allow"
302+
Principal = {
303+
Service = "events.amazonaws.com"
304+
},
305+
Action = [
306+
"kms:DescribeKey"
307+
],
308+
Resource = "*"
309+
},
310+
{
311+
Sid = "Allow use of the key"
312+
Effect = "Allow"
313+
Principal = {
314+
Service = "events.amazonaws.com"
315+
},
316+
Action = [
317+
"kms:GenerateDataKey",
318+
"kms:Decrypt",
319+
"kms:ReEncrypt*"
320+
],
321+
Resource = "*"
322+
Condition = {
323+
StringEquals = {
324+
"kms:EncryptionContext:aws:events:event-bus:arn" = aws_cloudwatch_event_bus.test.arn
325+
}
326+
}
327+
}
328+
]
329+
})
330+
tags = {
331+
EventBridgeApiDestinations = "true"
332+
}
333+
}
334+
335+
resource "aws_kms_alias" "test_1" {
336+
name = "alias/test-1"
337+
target_key_id = aws_kms_key.test_1.key_id
338+
}
339+
340+
resource "aws_kms_key" "test_2" {
341+
deletion_window_in_days = 7
342+
policy = jsonencode({
343+
Version = "2012-10-17"
344+
Id = "key-policy-example"
345+
Statement = [
346+
{
347+
Sid = "Enable IAM User Permissions"
348+
Effect = "Allow"
349+
Principal = {
350+
AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
351+
},
352+
Action = "kms:*"
353+
Resource = "*"
354+
},
355+
{
356+
Sid = "Allow describing of the key"
357+
Effect = "Allow"
358+
Principal = {
359+
Service = "events.amazonaws.com"
360+
},
361+
Action = [
362+
"kms:DescribeKey"
363+
],
364+
Resource = "*"
365+
},
366+
{
367+
Sid = "Allow use of the key"
368+
Effect = "Allow"
369+
Principal = {
370+
Service = "events.amazonaws.com"
371+
},
372+
Action = [
373+
"kms:GenerateDataKey",
374+
"kms:Decrypt",
375+
"kms:ReEncrypt*"
376+
],
377+
Resource = "*"
378+
Condition = {
379+
StringEquals = {
380+
"kms:EncryptionContext:aws:events:event-bus:arn" = aws_cloudwatch_event_bus.test.arn
381+
}
382+
}
383+
}
384+
]
385+
})
386+
tags = {
387+
EventBridgeApiDestinations = "true"
388+
}
389+
}
390+
391+
resource "aws_cloudwatch_event_archive" "test" {
392+
name = %[1]q
393+
event_source_arn = aws_cloudwatch_event_bus.test.arn
394+
kms_key_identifier = %[2]q
395+
}
396+
`, name, kmsKeyIdentifier)
397+
}
398+
221399
func testAccArchiveConfig_retentionOnCreation(name string) string {
222400
return fmt.Sprintf(`
223401
resource "aws_cloudwatch_event_bus" "test" {

0 commit comments

Comments
 (0)