Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IAM: Only set policy if actually changed #22067

Merged
merged 16 commits into from
Dec 7, 2021
Merged

Conversation

YakDriver
Copy link
Member

@YakDriver YakDriver commented Dec 6, 2021

Community Note

  • Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates #21968
Relates #19444
Relates #19245
Releates hashicorp/awspolicyequivalence#7
Closes #21016
Closes #438

Output from acceptance testing (GovCloud):

--- PASS: TestAccIAMPolicy_disappears (16.22s)
--- PASS: TestAccIAMPolicy_description (23.95s)
--- PASS: TestAccIAMPolicy_namePrefix (23.97s)
--- PASS: TestAccIAMPolicy_path (23.97s)
--- PASS: TestAccIAMPolicy_basic (23.98s)
--- PASS: TestAccIAMPolicy_policy (38.30s)
--- PASS: TestAccIAMPolicy_tags (50.37s)

--- PASS: TestAccIAMGroupPolicy_disappears (16.72s)
--- PASS: TestAccIAMGroupPolicy_generatedName (31.88s)
--- PASS: TestAccIAMGroupPolicy_namePrefix (31.95s)
--- PASS: TestAccIAMGroupPolicy_basic (34.36s)

--- PASS: TestAccIAMRolePolicy_invalidJSON (3.20s)
--- PASS: TestAccIAMRolePolicy_Policy_invalidResource (13.73s)
--- PASS: TestAccIAMRolePolicy_disappears (21.89s)
--- PASS: TestAccIAMRolePolicy_policyOrder (33.38s)
--- PASS: TestAccIAMRolePolicy_namePrefix (40.47s)
--- PASS: TestAccIAMRolePolicy_generatedName (40.47s)
--- PASS: TestAccIAMRolePolicy_basic (40.83s)

--- PASS: TestAccIAMUserPolicy_disappears (18.68s)
--- PASS: TestAccIAMUserPolicy_policyOrder (29.39s)
--- PASS: TestAccIAMUserPolicy_basic (37.38s)
--- PASS: TestAccIAMUserPolicy_namePrefix (37.43s)
--- PASS: TestAccIAMUserPolicy_generatedName (37.52s)
--- PASS: TestAccIAMUserPolicy_multiplePolicies (63.15s)

--- PASS: TestAccIAMRole_badJSON (5.31s)
--- PASS: TestAccIAMRole_disappears (22.07s)
--- PASS: TestAccIAMRole_InlinePolicy_empty (25.95s)
--- PASS: TestAccIAMRole_basic (30.19s)
--- PASS: TestAccIAMRole_namePrefix (30.88s)
--- PASS: TestAccIAMRole_policiesForceDetach (32.61s)
--- FAIL: TestAccIAMRole_InlinePolicy_ignoreOrder (33.77s) (* expected)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored (42.46s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty (46.02s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved (46.06s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty (46.06s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved (46.51s)
--- PASS: TestAccIAMRole_tags (50.10s)
--- PASS: TestAccIAMRole_nameGenerated (28.03s)
--- PASS: TestAccIAMRole_testNameChange (50.26s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack (44.95s)
--- PASS: TestAccIAMRole_maxSessionDuration (52.80s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack (53.16s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored (56.23s)
--- PASS: TestAccIAMRole_InlinePolicy_basic (64.19s)
--- PASS: TestAccIAMRole_ManagedPolicy_basic (68.21s)
--- PASS: TestAccIAMRole_basicWithDescription (52.73s)
--- PASS: TestAccIAMRole_permissionsBoundary (87.88s)

Output from acceptance testing (us-west-2):

--- PASS: TestAccIAMPolicy_disappears (11.89s)
--- PASS: TestAccIAMPolicy_namePrefix (15.41s)
--- PASS: TestAccIAMPolicy_path (15.41s)
--- PASS: TestAccIAMPolicy_description (15.52s)
--- PASS: TestAccIAMPolicy_basic (15.63s)
--- PASS: TestAccIAMPolicy_policy (23.51s)
--- PASS: TestAccIAMPolicy_tags (30.99s)

--- PASS: TestAccIAMGroupPolicy_disappears (11.01s)
--- PASS: TestAccIAMGroupPolicy_namePrefix (20.59s)
--- PASS: TestAccIAMGroupPolicy_generatedName (20.62s)
--- PASS: TestAccIAMGroupPolicy_basic (21.95s)

--- PASS: TestAccIAMRolePolicy_invalidJSON (7.16s)
--- PASS: TestAccIAMRolePolicy_Policy_invalidResource (13.66s)
--- PASS: TestAccIAMRolePolicy_disappears (18.95s)
--- PASS: TestAccIAMRolePolicy_policyOrder (26.08s)
--- PASS: TestAccIAMRolePolicy_namePrefix (31.22s)
--- PASS: TestAccIAMRolePolicy_basic (31.68s)
--- PASS: TestAccIAMRolePolicy_generatedName (32.70s)

--- PASS: TestAccIAMUserPolicy_disappears (14.38s)
--- PASS: TestAccIAMUserPolicy_policyOrder (20.11s)
--- PASS: TestAccIAMUserPolicy_basic (24.76s)
--- PASS: TestAccIAMUserPolicy_namePrefix (24.76s)
--- PASS: TestAccIAMUserPolicy_generatedName (24.84s)
--- PASS: TestAccIAMUserPolicy_multiplePolicies (40.34s)

--- PASS: TestAccIAMRole_badJSON (8.35s)
--- PASS: TestAccIAMRole_disappears (28.83s)
--- PASS: TestAccIAMRole_nameGenerated (39.13s)
--- PASS: TestAccIAMRole_namePrefix (41.08s)
--- PASS: TestAccIAMRole_basic (41.08s)
--- PASS: TestAccIAMRole_policiesForceDetach (42.74s)
--- FAIL: TestAccIAMRole_InlinePolicy_ignoreOrder (45.00s) (*expected)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored (55.12s)
--- PASS: TestAccIAMRole_InlinePolicy_empty (26.30s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty (58.81s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty (58.81s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved (59.18s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack (59.47s)
--- PASS: TestAccIAMRole_tags (60.73s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack (61.71s)
--- PASS: TestAccIAMRole_maxSessionDuration (63.13s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved (63.32s)
--- PASS: TestAccIAMRole_testNameChange (65.57s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored (69.97s)
--- PASS: TestAccIAMRole_InlinePolicy_basic (79.67s)
--- PASS: TestAccIAMRole_ManagedPolicy_basic (74.01s)
--- PASS: TestAccIAMRole_basicWithDescription (54.28s)
--- PASS: TestAccIAMRole_permissionsBoundary (104.26s)

@github-actions github-actions bot added service/iam Issues and PRs that pertain to the iam service. size/XS Managed by automation to categorize the size of a PR. labels Dec 6, 2021
@github-actions github-actions bot added tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. size/M Managed by automation to categorize the size of a PR. and removed size/XS Managed by automation to categorize the size of a PR. labels Dec 6, 2021
@github-actions github-actions bot added size/L Managed by automation to categorize the size of a PR. and removed size/M Managed by automation to categorize the size of a PR. labels Dec 6, 2021
@github-actions github-actions bot added size/XL Managed by automation to categorize the size of a PR. and removed size/L Managed by automation to categorize the size of a PR. labels Dec 6, 2021
@YakDriver YakDriver added this to the Roadmap milestone Dec 6, 2021
Copy link
Contributor

@ewbankkit ewbankkit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀.

% make testacc PKG_NAME=internal/service/iam TESTARGS='-run=TestAccIAMPolicy_\|TestAccIAMGroupPolicy_\|TestAccIAMRolePolicy_\|TestAccIAMUserPolicy_\|TestAccIAMRole_' ACCTEST_PARALLELISM=2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/iam/... -v -count 1 -parallel 2 -run=TestAccIAMPolicy_\|TestAccIAMGroupPolicy_\|TestAccIAMRolePolicy_\|TestAccIAMUserPolicy_\|TestAccIAMRole_ -timeout 180m
=== RUN   TestAccIAMGroupPolicy_basic
=== PAUSE TestAccIAMGroupPolicy_basic
=== RUN   TestAccIAMGroupPolicy_disappears
=== PAUSE TestAccIAMGroupPolicy_disappears
=== RUN   TestAccIAMGroupPolicy_namePrefix
=== PAUSE TestAccIAMGroupPolicy_namePrefix
=== RUN   TestAccIAMGroupPolicy_generatedName
=== PAUSE TestAccIAMGroupPolicy_generatedName
=== RUN   TestAccIAMPolicy_basic
=== PAUSE TestAccIAMPolicy_basic
=== RUN   TestAccIAMPolicy_description
=== PAUSE TestAccIAMPolicy_description
=== RUN   TestAccIAMPolicy_tags
=== PAUSE TestAccIAMPolicy_tags
=== RUN   TestAccIAMPolicy_disappears
=== PAUSE TestAccIAMPolicy_disappears
=== RUN   TestAccIAMPolicy_namePrefix
=== PAUSE TestAccIAMPolicy_namePrefix
=== RUN   TestAccIAMPolicy_path
=== PAUSE TestAccIAMPolicy_path
=== RUN   TestAccIAMPolicy_policy
=== PAUSE TestAccIAMPolicy_policy
=== RUN   TestAccIAMRolePolicy_basic
=== PAUSE TestAccIAMRolePolicy_basic
=== RUN   TestAccIAMRolePolicy_disappears
=== PAUSE TestAccIAMRolePolicy_disappears
=== RUN   TestAccIAMRolePolicy_policyOrder
=== PAUSE TestAccIAMRolePolicy_policyOrder
=== RUN   TestAccIAMRolePolicy_namePrefix
=== PAUSE TestAccIAMRolePolicy_namePrefix
=== RUN   TestAccIAMRolePolicy_generatedName
=== PAUSE TestAccIAMRolePolicy_generatedName
=== RUN   TestAccIAMRolePolicy_invalidJSON
=== PAUSE TestAccIAMRolePolicy_invalidJSON
=== RUN   TestAccIAMRolePolicy_Policy_invalidResource
=== PAUSE TestAccIAMRolePolicy_Policy_invalidResource
=== RUN   TestAccIAMRole_basic
=== PAUSE TestAccIAMRole_basic
=== RUN   TestAccIAMRole_basicWithDescription
=== PAUSE TestAccIAMRole_basicWithDescription
=== RUN   TestAccIAMRole_nameGenerated
=== PAUSE TestAccIAMRole_nameGenerated
=== RUN   TestAccIAMRole_namePrefix
=== PAUSE TestAccIAMRole_namePrefix
=== RUN   TestAccIAMRole_testNameChange
=== PAUSE TestAccIAMRole_testNameChange
=== RUN   TestAccIAMRole_badJSON
=== PAUSE TestAccIAMRole_badJSON
=== RUN   TestAccIAMRole_disappears
=== PAUSE TestAccIAMRole_disappears
=== RUN   TestAccIAMRole_policiesForceDetach
=== PAUSE TestAccIAMRole_policiesForceDetach
=== RUN   TestAccIAMRole_maxSessionDuration
=== PAUSE TestAccIAMRole_maxSessionDuration
=== RUN   TestAccIAMRole_permissionsBoundary
=== PAUSE TestAccIAMRole_permissionsBoundary
=== RUN   TestAccIAMRole_tags
=== PAUSE TestAccIAMRole_tags
=== RUN   TestAccIAMRole_InlinePolicy_basic
=== PAUSE TestAccIAMRole_InlinePolicy_basic
=== RUN   TestAccIAMRole_InlinePolicy_ignoreOrder
=== PAUSE TestAccIAMRole_InlinePolicy_ignoreOrder
=== RUN   TestAccIAMRole_InlinePolicy_empty
=== PAUSE TestAccIAMRole_InlinePolicy_empty
=== RUN   TestAccIAMRole_ManagedPolicy_basic
=== PAUSE TestAccIAMRole_ManagedPolicy_basic
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
=== RUN   TestAccIAMUserPolicy_basic
=== PAUSE TestAccIAMUserPolicy_basic
=== RUN   TestAccIAMUserPolicy_disappears
=== PAUSE TestAccIAMUserPolicy_disappears
=== RUN   TestAccIAMUserPolicy_namePrefix
=== PAUSE TestAccIAMUserPolicy_namePrefix
=== RUN   TestAccIAMUserPolicy_generatedName
=== PAUSE TestAccIAMUserPolicy_generatedName
=== RUN   TestAccIAMUserPolicy_multiplePolicies
=== PAUSE TestAccIAMUserPolicy_multiplePolicies
=== RUN   TestAccIAMUserPolicy_policyOrder
=== PAUSE TestAccIAMUserPolicy_policyOrder
=== CONT  TestAccIAMGroupPolicy_basic
=== CONT  TestAccIAMRole_disappears
--- PASS: TestAccIAMRole_disappears (12.40s)
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
--- PASS: TestAccIAMGroupPolicy_basic (23.69s)
=== CONT  TestAccIAMUserPolicy_policyOrder
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved (20.86s)
=== CONT  TestAccIAMUserPolicy_multiplePolicies
--- PASS: TestAccIAMUserPolicy_policyOrder (15.36s)
=== CONT  TestAccIAMUserPolicy_generatedName
--- PASS: TestAccIAMUserPolicy_generatedName (20.63s)
=== CONT  TestAccIAMUserPolicy_namePrefix
--- PASS: TestAccIAMUserPolicy_multiplePolicies (39.28s)
=== CONT  TestAccIAMUserPolicy_disappears
--- PASS: TestAccIAMUserPolicy_namePrefix (21.22s)
=== CONT  TestAccIAMUserPolicy_basic
--- PASS: TestAccIAMUserPolicy_disappears (10.01s)
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
--- PASS: TestAccIAMUserPolicy_basic (20.15s)
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty (19.03s)
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored (17.69s)
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty (19.01s)
=== CONT  TestAccIAMRole_InlinePolicy_ignoreOrder
--- FAIL: TestAccIAMRole_InlinePolicy_ignoreOrder (16.72s) <== Expected
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored (28.90s)
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved (21.36s)
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack (20.16s)
=== CONT  TestAccIAMRole_ManagedPolicy_basic
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack (29.32s)
=== CONT  TestAccIAMRole_InlinePolicy_empty
--- PASS: TestAccIAMRole_InlinePolicy_empty (10.19s)
=== CONT  TestAccIAMRolePolicy_disappears
--- PASS: TestAccIAMRolePolicy_disappears (10.29s)
=== CONT  TestAccIAMRole_badJSON
--- PASS: TestAccIAMRole_badJSON (1.62s)
=== CONT  TestAccIAMRole_testNameChange
--- PASS: TestAccIAMRole_ManagedPolicy_basic (41.91s)
=== CONT  TestAccIAMRole_namePrefix
--- PASS: TestAccIAMRole_namePrefix (12.36s)
=== CONT  TestAccIAMRole_nameGenerated
--- PASS: TestAccIAMRole_testNameChange (23.98s)
=== CONT  TestAccIAMRole_basicWithDescription
--- PASS: TestAccIAMRole_nameGenerated (12.23s)
=== CONT  TestAccIAMRole_basic
--- PASS: TestAccIAMRole_basic (14.37s)
=== CONT  TestAccIAMRolePolicy_Policy_invalidResource
--- PASS: TestAccIAMRolePolicy_Policy_invalidResource (5.89s)
=== CONT  TestAccIAMRolePolicy_invalidJSON
--- PASS: TestAccIAMRolePolicy_invalidJSON (0.83s)
=== CONT  TestAccIAMRolePolicy_generatedName
--- PASS: TestAccIAMRole_basicWithDescription (30.70s)
=== CONT  TestAccIAMRolePolicy_namePrefix
--- PASS: TestAccIAMRolePolicy_generatedName (21.56s)
=== CONT  TestAccIAMRolePolicy_policyOrder
--- PASS: TestAccIAMRolePolicy_namePrefix (22.31s)
=== CONT  TestAccIAMPolicy_tags
--- PASS: TestAccIAMRolePolicy_policyOrder (18.22s)
=== CONT  TestAccIAMRolePolicy_basic
--- PASS: TestAccIAMPolicy_tags (30.47s)
=== CONT  TestAccIAMPolicy_policy
--- PASS: TestAccIAMRolePolicy_basic (22.88s)
=== CONT  TestAccIAMPolicy_path
--- PASS: TestAccIAMPolicy_path (11.63s)
=== CONT  TestAccIAMPolicy_namePrefix
--- PASS: TestAccIAMPolicy_policy (21.07s)
=== CONT  TestAccIAMPolicy_disappears
--- PASS: TestAccIAMPolicy_namePrefix (11.15s)
=== CONT  TestAccIAMRole_permissionsBoundary
--- PASS: TestAccIAMPolicy_disappears (8.56s)
=== CONT  TestAccIAMRole_InlinePolicy_basic
--- PASS: TestAccIAMRole_InlinePolicy_basic (35.35s)
=== CONT  TestAccIAMRole_tags
--- PASS: TestAccIAMRole_permissionsBoundary (49.81s)
=== CONT  TestAccIAMGroupPolicy_generatedName
--- PASS: TestAccIAMRole_tags (21.39s)
=== CONT  TestAccIAMPolicy_description
--- PASS: TestAccIAMGroupPolicy_generatedName (19.38s)
=== CONT  TestAccIAMPolicy_basic
--- PASS: TestAccIAMPolicy_description (11.45s)
=== CONT  TestAccIAMGroupPolicy_namePrefix
--- PASS: TestAccIAMPolicy_basic (11.85s)
=== CONT  TestAccIAMGroupPolicy_disappears
--- PASS: TestAccIAMGroupPolicy_disappears (11.61s)
=== CONT  TestAccIAMRole_maxSessionDuration
--- PASS: TestAccIAMGroupPolicy_namePrefix (22.02s)
=== CONT  TestAccIAMRole_policiesForceDetach
--- PASS: TestAccIAMRole_policiesForceDetach (13.79s)
--- PASS: TestAccIAMRole_maxSessionDuration (24.14s)

@YakDriver YakDriver merged commit cba4e74 into main Dec 7, 2021
@github-actions
Copy link

This functionality has been released in v3.69.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

@github-actions
Copy link

github-actions bot commented Jun 3, 2022

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 3, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
service/iam Issues and PRs that pertain to the iam service. size/XL Managed by automation to categorize the size of a PR. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure.
Projects
None yet
3 participants