-
Notifications
You must be signed in to change notification settings - Fork 9.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
New Resource: aws_securityhub_member (#6975)
Output from acceptance testing: ``` --- PASS: TestAccAWSSecurityHub (89.60s) --- PASS: TestAccAWSSecurityHub/Account (12.62s) --- PASS: TestAccAWSSecurityHub/Account/basic (12.62s) --- PASS: TestAccAWSSecurityHub/Member (19.02s) --- PASS: TestAccAWSSecurityHub/Member/basic (9.65s) --- PASS: TestAccAWSSecurityHub/Member/invite (9.37s) --- PASS: TestAccAWSSecurityHub/ProductSubscription (20.25s) --- PASS: TestAccAWSSecurityHub/ProductSubscription/basic (20.25s) --- PASS: TestAccAWSSecurityHub/StandardsSubscription (37.71s) --- PASS: TestAccAWSSecurityHub/StandardsSubscription/basic (37.71s) ```
- Loading branch information
Showing
6 changed files
with
356 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,158 @@ | ||
package aws | ||
|
||
import ( | ||
"fmt" | ||
"log" | ||
|
||
"github.com/aws/aws-sdk-go/aws" | ||
"github.com/aws/aws-sdk-go/service/securityhub" | ||
"github.com/hashicorp/terraform-plugin-sdk/helper/schema" | ||
) | ||
|
||
const ( | ||
SecurityHubMemberStatusCreated = "Created" | ||
SecurityHubMemberStatusInvited = "Invited" | ||
SecurityHubMemberStatusAssociated = "Associated" | ||
SecurityHubMemberStatusResigned = "Resigned" | ||
SecurityHubMemberStatusRemoved = "Removed" | ||
) | ||
|
||
func resourceAwsSecurityHubMember() *schema.Resource { | ||
return &schema.Resource{ | ||
Create: resourceAwsSecurityHubMemberCreate, | ||
Read: resourceAwsSecurityHubMemberRead, | ||
Delete: resourceAwsSecurityHubMemberDelete, | ||
Importer: &schema.ResourceImporter{ | ||
State: schema.ImportStatePassthrough, | ||
}, | ||
|
||
Schema: map[string]*schema.Schema{ | ||
"account_id": { | ||
Type: schema.TypeString, | ||
Required: true, | ||
ForceNew: true, | ||
ValidateFunc: validateAwsAccountId, | ||
}, | ||
"email": { | ||
Type: schema.TypeString, | ||
Required: true, | ||
ForceNew: true, | ||
}, | ||
"invite": { | ||
Type: schema.TypeBool, | ||
Optional: true, | ||
ForceNew: true, | ||
}, | ||
"master_id": { | ||
Type: schema.TypeString, | ||
Computed: true, | ||
}, | ||
"member_status": { | ||
Type: schema.TypeString, | ||
Computed: true, | ||
}, | ||
}, | ||
} | ||
} | ||
|
||
func resourceAwsSecurityHubMemberCreate(d *schema.ResourceData, meta interface{}) error { | ||
conn := meta.(*AWSClient).securityhubconn | ||
log.Printf("[DEBUG] Creating Security Hub member %s", d.Get("account_id").(string)) | ||
|
||
resp, err := conn.CreateMembers(&securityhub.CreateMembersInput{ | ||
AccountDetails: []*securityhub.AccountDetails{ | ||
{ | ||
AccountId: aws.String(d.Get("account_id").(string)), | ||
Email: aws.String(d.Get("email").(string)), | ||
}, | ||
}, | ||
}) | ||
|
||
if err != nil { | ||
return fmt.Errorf("Error creating Security Hub member %s: %s", d.Get("account_id").(string), err) | ||
} | ||
|
||
if len(resp.UnprocessedAccounts) > 0 { | ||
return fmt.Errorf("Error creating Security Hub member %s: UnprocessedAccounts is not empty", d.Get("account_id").(string)) | ||
} | ||
|
||
d.SetId(d.Get("account_id").(string)) | ||
|
||
if d.Get("invite").(bool) { | ||
log.Printf("[INFO] Inviting Security Hub member %s", d.Id()) | ||
iresp, err := conn.InviteMembers(&securityhub.InviteMembersInput{ | ||
AccountIds: []*string{aws.String(d.Get("account_id").(string))}, | ||
}) | ||
|
||
if err != nil { | ||
return fmt.Errorf("Error inviting Security Hub member %s: %s", d.Id(), err) | ||
} | ||
|
||
if len(iresp.UnprocessedAccounts) > 0 { | ||
return fmt.Errorf("Error inviting Security Hub member %s: UnprocessedAccounts is not empty", d.Id()) | ||
} | ||
} | ||
|
||
return resourceAwsSecurityHubMemberRead(d, meta) | ||
} | ||
|
||
func resourceAwsSecurityHubMemberRead(d *schema.ResourceData, meta interface{}) error { | ||
conn := meta.(*AWSClient).securityhubconn | ||
|
||
log.Printf("[DEBUG] Reading Security Hub member %s", d.Id()) | ||
resp, err := conn.GetMembers(&securityhub.GetMembersInput{ | ||
AccountIds: []*string{aws.String(d.Id())}, | ||
}) | ||
|
||
if err != nil { | ||
if isAWSErr(err, securityhub.ErrCodeResourceNotFoundException, "") { | ||
log.Printf("[WARN] Security Hub member (%s) not found, removing from state", d.Id()) | ||
d.SetId("") | ||
return nil | ||
} | ||
return err | ||
} | ||
|
||
if len(resp.Members) == 0 { | ||
log.Printf("[WARN] Security Hub member (%s) not found, removing from state", d.Id()) | ||
d.SetId("") | ||
return nil | ||
} | ||
|
||
member := resp.Members[0] | ||
|
||
d.Set("account_id", member.AccountId) | ||
d.Set("email", member.Email) | ||
d.Set("master_id", member.MasterId) | ||
|
||
status := aws.StringValue(member.MemberStatus) | ||
d.Set("member_status", status) | ||
|
||
invited := status == SecurityHubMemberStatusInvited || status == SecurityHubMemberStatusAssociated || status == SecurityHubMemberStatusResigned | ||
d.Set("invite", invited) | ||
|
||
return nil | ||
} | ||
|
||
func resourceAwsSecurityHubMemberDelete(d *schema.ResourceData, meta interface{}) error { | ||
conn := meta.(*AWSClient).securityhubconn | ||
log.Printf("[DEBUG] Deleting Security Hub member: %s", d.Id()) | ||
|
||
resp, err := conn.DeleteMembers(&securityhub.DeleteMembersInput{ | ||
AccountIds: []*string{aws.String(d.Id())}, | ||
}) | ||
|
||
if err != nil { | ||
if isAWSErr(err, securityhub.ErrCodeResourceNotFoundException, "") { | ||
log.Printf("[WARN] Security Hub member (%s) not found", d.Id()) | ||
return nil | ||
} | ||
return fmt.Errorf("Error deleting Security Hub member %s: %s", d.Id(), err) | ||
} | ||
|
||
if len(resp.UnprocessedAccounts) > 0 { | ||
return fmt.Errorf("Error deleting Security Hub member %s: UnprocessedAccounts is not empty", d.Get("account_id").(string)) | ||
} | ||
|
||
return nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,142 @@ | ||
package aws | ||
|
||
import ( | ||
"fmt" | ||
"testing" | ||
|
||
"github.com/aws/aws-sdk-go/aws" | ||
"github.com/aws/aws-sdk-go/service/securityhub" | ||
"github.com/hashicorp/terraform-plugin-sdk/helper/resource" | ||
"github.com/hashicorp/terraform-plugin-sdk/terraform" | ||
) | ||
|
||
func testAccAWSSecurityHubMember_basic(t *testing.T) { | ||
var member securityhub.Member | ||
resourceName := "aws_securityhub_member.example" | ||
|
||
resource.Test(t, resource.TestCase{ | ||
PreCheck: func() { testAccPreCheck(t) }, | ||
Providers: testAccProviders, | ||
CheckDestroy: testAccCheckAWSSecurityHubMemberDestroy, | ||
Steps: []resource.TestStep{ | ||
{ | ||
Config: testAccAWSSecurityHubMemberConfig_basic("111111111111", "example@example.com"), | ||
Check: resource.ComposeTestCheckFunc( | ||
testAccCheckAWSSecurityHubMemberExists(resourceName, &member), | ||
), | ||
}, | ||
{ | ||
ResourceName: resourceName, | ||
ImportState: true, | ||
ImportStateVerify: true, | ||
}, | ||
}, | ||
}) | ||
} | ||
|
||
func testAccAWSSecurityHubMember_invite(t *testing.T) { | ||
var member securityhub.Member | ||
resourceName := "aws_securityhub_member.example" | ||
|
||
resource.Test(t, resource.TestCase{ | ||
PreCheck: func() { testAccPreCheck(t) }, | ||
Providers: testAccProviders, | ||
CheckDestroy: testAccCheckAWSSecurityHubMemberDestroy, | ||
Steps: []resource.TestStep{ | ||
{ | ||
Config: testAccAWSSecurityHubMemberConfig_invite("111111111111", "example@example.com", true), | ||
Check: resource.ComposeTestCheckFunc( | ||
testAccCheckAWSSecurityHubMemberExists(resourceName, &member), | ||
resource.TestCheckResourceAttr(resourceName, "member_status", "Invited"), | ||
resource.TestCheckResourceAttr(resourceName, "invite", "true"), | ||
), | ||
}, | ||
{ | ||
ResourceName: resourceName, | ||
ImportState: true, | ||
ImportStateVerify: true, | ||
}, | ||
}, | ||
}) | ||
} | ||
|
||
func testAccCheckAWSSecurityHubMemberExists(n string, member *securityhub.Member) resource.TestCheckFunc { | ||
return func(s *terraform.State) error { | ||
rs, ok := s.RootModule().Resources[n] | ||
if !ok { | ||
return fmt.Errorf("Not found: %s", n) | ||
} | ||
|
||
conn := testAccProvider.Meta().(*AWSClient).securityhubconn | ||
|
||
resp, err := conn.GetMembers(&securityhub.GetMembersInput{ | ||
AccountIds: []*string{aws.String(rs.Primary.ID)}, | ||
}) | ||
|
||
if err != nil { | ||
return err | ||
} | ||
|
||
if len(resp.Members) == 0 { | ||
return fmt.Errorf("Security Hub member %s not found", rs.Primary.ID) | ||
} | ||
|
||
member = resp.Members[0] | ||
|
||
return nil | ||
} | ||
} | ||
|
||
func testAccCheckAWSSecurityHubMemberDestroy(s *terraform.State) error { | ||
conn := testAccProvider.Meta().(*AWSClient).securityhubconn | ||
|
||
for _, rs := range s.RootModule().Resources { | ||
if rs.Type != "aws_securityhub_member" { | ||
continue | ||
} | ||
|
||
resp, err := conn.GetMembers(&securityhub.GetMembersInput{ | ||
AccountIds: []*string{aws.String(rs.Primary.ID)}, | ||
}) | ||
|
||
if err != nil { | ||
if isAWSErr(err, securityhub.ErrCodeResourceNotFoundException, "") { | ||
return nil | ||
} | ||
return err | ||
} | ||
|
||
if len(resp.Members) != 0 { | ||
return fmt.Errorf("Security Hub member still exists") | ||
} | ||
|
||
return nil | ||
} | ||
|
||
return nil | ||
} | ||
|
||
func testAccAWSSecurityHubMemberConfig_basic(accountId, email string) string { | ||
return fmt.Sprintf(` | ||
resource "aws_securityhub_account" "example" {} | ||
resource "aws_securityhub_member" "example" { | ||
depends_on = ["aws_securityhub_account.example"] | ||
account_id = "%s" | ||
email = "%s" | ||
} | ||
`, accountId, email) | ||
} | ||
|
||
func testAccAWSSecurityHubMemberConfig_invite(accountId, email string, invite bool) string { | ||
return fmt.Sprintf(` | ||
resource "aws_securityhub_account" "example" {} | ||
resource "aws_securityhub_member" "example" { | ||
depends_on = ["aws_securityhub_account.example"] | ||
account_id = "%s" | ||
email = "%s" | ||
invite = %t | ||
} | ||
`, accountId, email, invite) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,48 @@ | ||
--- | ||
subcategory: "Security Hub" | ||
layout: "aws" | ||
page_title: "AWS: aws_securityhub_member" | ||
description: |- | ||
Provides a Security Hub member resource. | ||
--- | ||
|
||
# Resource: aws_securityhub_member | ||
|
||
Provides a Security Hub member resource. | ||
|
||
## Example Usage | ||
|
||
```hcl | ||
resource "aws_securityhub_account" "example" {} | ||
resource "aws_securityhub_member" "example" { | ||
depends_on = ["aws_securityhub_account.example"] | ||
account_id = "123456789012" | ||
email = "example@example.com" | ||
invite = true | ||
} | ||
``` | ||
|
||
## Argument Reference | ||
|
||
The following arguments are supported: | ||
|
||
* `account_id` - (Required) The ID of the member AWS account. | ||
* `email` - (Required) The email of the member AWS account. | ||
* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`. | ||
|
||
## Attributes Reference | ||
|
||
The following attributes are exported in addition to the arguments listed above: | ||
|
||
* `id` - The ID of the member AWS account (matches `account_id`). | ||
* `master_id` - The ID of the master Security Hub AWS account. | ||
* `member_status` - The status of the relationship between the member account and its master account. | ||
|
||
## Import | ||
|
||
Security Hub members can be imported using their account ID, e.g. | ||
|
||
``` | ||
$ terraform import aws_securityhub_member.example 123456789012 | ||
``` |