-
Notifications
You must be signed in to change notification settings - Fork 9.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add 'aws_cloudtrail_service_account' data source.
- Loading branch information
1 parent
c162ebb
commit 3177675
Showing
5 changed files
with
184 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/hashicorp/terraform/helper/schema" | ||
| ) | ||
|
|
||
| // See http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-regions.html | ||
| var cloudTrailServiceAccountPerRegionMap = map[string]string{ | ||
| "us-east-1": "086441151436", | ||
| "us-east-2": "475085895292", | ||
| "us-west-1": "388731089494", | ||
| "us-west-2": "113285607260", | ||
| "ap-south-1": "977081816279", | ||
| "ap-northeast-2": "492519147666", | ||
| "ap-southeast-1": "903692715234", | ||
| "ap-southeast-2": "284668455005", | ||
| "ap-northeast-1": "216624486486", | ||
| "ca-central-1": "819402241893", | ||
| "eu-central-1": "035351147821", | ||
| "eu-west-1": "859597730677", | ||
| "eu-west-2": "282025262664", | ||
| "sa-east-1": "814480443879", | ||
| } | ||
|
|
||
| func dataSourceAwsCloudTrailServiceAccount() *schema.Resource { | ||
| return &schema.Resource{ | ||
| Read: dataSourceAwsCloudTrailServiceAccountRead, | ||
|
|
||
| Schema: map[string]*schema.Schema{ | ||
| "region": &schema.Schema{ | ||
| Type: schema.TypeString, | ||
| Optional: true, | ||
| }, | ||
| "arn": { | ||
| Type: schema.TypeString, | ||
| Computed: true, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func dataSourceAwsCloudTrailServiceAccountRead(d *schema.ResourceData, meta interface{}) error { | ||
| region := meta.(*AWSClient).region | ||
| if v, ok := d.GetOk("region"); ok { | ||
| region = v.(string) | ||
| } | ||
|
|
||
| if accid, ok := cloudTrailServiceAccountPerRegionMap[region]; ok { | ||
| d.SetId(accid) | ||
| d.Set("arn", iamArnString(meta.(*AWSClient).partition, accid, "root")) | ||
| return nil | ||
| } | ||
|
|
||
| return fmt.Errorf("Unknown region (%q)", region) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/terraform/helper/resource" | ||
| ) | ||
|
|
||
| func TestAccAWSCloudTrailServiceAccount_basic(t *testing.T) { | ||
| resource.Test(t, resource.TestCase{ | ||
| PreCheck: func() { testAccPreCheck(t) }, | ||
| Providers: testAccProviders, | ||
| Steps: []resource.TestStep{ | ||
| resource.TestStep{ | ||
| Config: testAccCheckAwsCloudTrailServiceAccountConfig, | ||
| Check: resource.ComposeTestCheckFunc( | ||
| resource.TestCheckResourceAttr("data.aws_cloudtrail_service_account.main", "id", "113285607260"), | ||
| resource.TestCheckResourceAttr("data.aws_cloudtrail_service_account.main", "arn", "arn:aws:iam::113285607260:root"), | ||
| ), | ||
| }, | ||
| resource.TestStep{ | ||
| Config: testAccCheckAwsCloudTrailServiceAccountExplicitRegionConfig, | ||
| Check: resource.ComposeTestCheckFunc( | ||
| resource.TestCheckResourceAttr("data.aws_cloudtrail_service_account.regional", "id", "282025262664"), | ||
| resource.TestCheckResourceAttr("data.aws_cloudtrail_service_account.regional", "arn", "arn:aws:iam::282025262664:root"), | ||
| ), | ||
| }, | ||
| }, | ||
| }) | ||
| } | ||
|
|
||
| const testAccCheckAwsCloudTrailServiceAccountConfig = ` | ||
| data "aws_cloudtrail_service_account" "main" { } | ||
| ` | ||
|
|
||
| const testAccCheckAwsCloudTrailServiceAccountExplicitRegionConfig = ` | ||
| data "aws_cloudtrail_service_account" "regional" { | ||
| region = "eu-west-2" | ||
| } | ||
| ` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| --- | ||
| layout: "aws" | ||
| page_title: "AWS: aws_cloudtrail_service_account" | ||
| sidebar_current: "docs-aws-datasource-cloudtrail-service-account" | ||
| description: |- | ||
| Get AWS CloudTrail Service Account ID for storing trail data in S3. | ||
| --- | ||
|
|
||
| # aws_cloudtrail_service_account | ||
|
|
||
| Use this data source to get the Account ID of the [AWS CloudTrail Service Account](http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-regions.html) | ||
| in a given region for the purpose of allowing CloudTrail to store trail data in S3. | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```hcl | ||
| data "aws_cloudtrail_service_account" "main" {} | ||
| resource "aws_s3_bucket" "bucket" { | ||
| bucket = "tf-cloudtrail-logging-test-bucket" | ||
| force_destroy = true | ||
| policy = <<EOF | ||
| { | ||
| "Version": "2008-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Sid": "Put bucket policy needed for trails", | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "AWS": "${data.aws_cloudtrail_service_account.main.arn}" | ||
| }, | ||
| "Action": "s3:PutObject", | ||
| "Resource": "arn:aws:s3:::tf-cloudtrail-logging-test-bucket/*" | ||
| }, | ||
| { | ||
| "Sid": "Get bucket policy needed for trails", | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "AWS": "${data.aws_cloudtrail_service_account.main.arn}" | ||
| }, | ||
| "Action": "s3:GetBucketAcl", | ||
| "Resource": "arn:aws:s3:::tf-cloudtrail-logging-test-bucket" | ||
| } | ||
| ] | ||
| } | ||
| EOF | ||
| } | ||
| ``` | ||
|
|
||
| ## Argument Reference | ||
|
|
||
| * `region` - (Optional) Name of the region whose AWS CloudTrail account ID is desired. | ||
| Defaults to the region from the AWS provider configuration. | ||
|
|
||
|
|
||
| ## Attributes Reference | ||
|
|
||
| * `id` - The ID of the AWS CloudTrail service account in the selected region. | ||
| * `arn` - The ARN of the AWS CloudTrail service account in the selected region. |