Add support for Active Directory in AWS Transfer

[toriath]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates #20017

Example:

...

resource "aws_transfer_server" "test" {
  identity_provider_type = "AWS_DIRECTORY_SERVICE"
  directory_id = "${aws_directory_service_directory.test.id}"
  logging_role = aws_iam_role.test.arn  
}

resource "aws_transfer_access" "test" {
  external_id = "S-1-1-12-1234567890-123456789-1234567890-1234"
  server_id = aws_transfer_server.test.id
  role = aws_iam_role.test.arn
  home_directory = "/${aws_s3_bucket.test.id}/"
  home_directory_type = "PATH"		  		 
}

Output from acceptance testing:

$  make testacc TESTARGS='-run=TestAccAWSTransfer_serial/Server/DirectoryService'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSTransfer_serial/Server/DirectoryService -timeout 180m
=== RUN   TestAccAWSTransfer_serial
=== RUN   TestAccAWSTransfer_serial/Server
=== RUN   TestAccAWSTransfer_serial/Server/DirectoryService
--- PASS: TestAccAWSTransfer_serial (1010.79s)
    --- PASS: TestAccAWSTransfer_serial/Server (1010.79s)
        --- PASS: TestAccAWSTransfer_serial/Server/DirectoryService (1010.79s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       1013.534s


$ make testacc TESTARGS='-run=TestAccAWSTransfer_serial/Access'         
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSTransfer_serial/Access -timeout 180m
=== RUN   TestAccAWSTransfer_serial
=== RUN   TestAccAWSTransfer_serial/Access
=== RUN   TestAccAWSTransfer_serial/Access/s3Basic
    resource_aws_transfer_access_test.go:21: Step 3/3 error: After applying this test step, the plan was not empty.
        stdout:
        
        
        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place
        
        Terraform will perform the following actions:
        
          # aws_transfer_access.test will be updated in-place
          ~ resource "aws_transfer_access" "test" {
                id                  = "s-cdb817cc390b44098/S-1-1-12-1234567890-123456789-1234567890-1234"
              + role                = "arn:aws:iam::086003943353:role/tf-acc-test-4452573246414080288"
                # (5 unchanged attributes hidden)
            }
        
        Plan: 0 to add, 1 to change, 0 to destroy.
=== RUN   TestAccAWSTransfer_serial/Access/efsBasic
    resource_aws_transfer_access_test.go:61: Step 3/3 error: Check failed: Check 5/5 error: aws_transfer_access.test: Attribute 'role' expected to be set
=== RUN   TestAccAWSTransfer_serial/Access/s3Policy
--- FAIL: TestAccAWSTransfer_serial (2949.64s)
    --- FAIL: TestAccAWSTransfer_serial/Access (2949.64s)
        --- FAIL: TestAccAWSTransfer_serial/Access/s3Basic (1012.28s)
        --- FAIL: TestAccAWSTransfer_serial/Access/efsBasic (900.14s)
        --- PASS: TestAccAWSTransfer_serial/Access/s3Policy (1037.22s)
FAIL
FAIL    github.com/terraform-providers/terraform-provider-aws/aws       2951.366s
FAIL
make: *** [testacc] Error 1

Notes:

• Test coverage for the aws_transfer_access resource could possibly be extended
• Test are very slow due to the dependency to directory_service
• Role is not persisted / read / imported correctly

[github-actions]

Welcome @tobiaskloss 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[toriath]

I could use some help with the role not being set correctly.

[ewbankkit]

@tobiaskloss If you use the AWS CLI (or Console) to query the Access is the Role returned?
Your code setting role looks OK.

[toriath]

@ewbankkit I've just created a test setup using almost the the same terraform code as my acceptance test and a dev_override to create an access with the provider.

While the tests fail due to the plan not being empty, the plan was empty in my test setup after the apply.

I was able to correctly query the role via. CLI afterwards. aws transfer describe-access

Any idea as to why the role seems to behave strange only during the acceptance tests?

[ewbankkit]

@tobiaskloss Thanks for the contribution 🎉 👏.
In order to get this merged quickly I migrated your changes to #20851 and addressed the merge conflicts.
For the role issue you mentioned - AWS API not returning on Read - I had to make sure that we don't overwrite any existing role specified in configuration during refresh.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.