Add support for Opsworks stack tags

aws/resource_aws_opsworks_stack.go

@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/terraform/helper/schema"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/opsworks"
@@ -34,6 +35,11 @@ func resourceAwsOpsworksStack() *schema.Resource {
 				Computed: true,
 			},
 
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
 			"id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -170,6 +176,8 @@ func resourceAwsOpsworksStack() *schema.Resource {
 				Default:  "Layer_Dependent",
 			},
 
+			"tags": tagsSchema(),
+
 			"use_custom_cookbooks": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -330,6 +338,7 @@ func resourceAwsOpsworksStackRead(d *schema.ResourceData, meta interface{}) erro
 	}
 
 	stack := resp.Stacks[0]
+	d.Set("arn", stack.Arn)
 	d.Set("agent_version", stack.AgentVersion)
 	d.Set("name", stack.Name)
 	d.Set("region", stack.Region)
@@ -529,6 +538,18 @@ func resourceAwsOpsworksStackUpdate(d *schema.ResourceData, meta interface{}) er
 		req.Attributes["Color"] = aws.String(v.(string))
 	}
 
+	arn := arn.ARN{
+		Partition: meta.(*AWSClient).partition,
+		Region:    meta.(*AWSClient).region,
+		Service:   "opsworks",
+		AccountID: meta.(*AWSClient).accountid,
+		Resource:  fmt.Sprintf("stack/%s/", d.Id()),
+	}
+
+	if tagErr := setTagsOpsworks(client, d, arn.String()); tagErr != nil {
+		return tagErr
+	}
+
 	req.ChefConfiguration = &opsworks.ChefConfiguration{
 		BerkshelfVersion: aws.String(d.Get("berkshelf_version").(string)),
 		ManageBerkshelf:  aws.Bool(d.Get("manage_berkshelf").(bool)),

aws/resource_aws_opsworks_stack_test.go

@@ -101,6 +101,36 @@ func TestAccAWSOpsworksStackVpc(t *testing.T) {
 	})
 }
 
+func TestAccAWSOpsworksStackNoVpcCreateTags(t *testing.T) {
+	stackName := fmt.Sprintf("tf-opsworks-acc-%d", acctest.RandInt())
+	var opsstack opsworks.Stack
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAwsOpsworksStackDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsOpsworksStackConfigNoVpcCreateTags(stackName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSOpsworksStackExists(
+						"aws_opsworks_stack.tf-acc", false, &opsstack),
+					resource.TestCheckResourceAttr("aws_opsworks_stack.tf-acc", "tags.%", "1"),
+					resource.TestCheckResourceAttr("aws_opsworks_stack.tf-acc", "tags.foo", "bar"),
+				),
+			},
+			{
+				Config: testAccAwsOpsworksStackConfigNoVpcUpdateTags(stackName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSOpsworksStackExists(
+						"aws_opsworks_stack.tf-acc", false, &opsstack),
+					resource.TestCheckResourceAttr("aws_opsworks_stack.tf-acc", "tags.%", "1"),
+					resource.TestCheckResourceAttr("aws_opsworks_stack.tf-acc", "tags.wut", "asdf"),
+				),
+			},
+		},
+	})
+}
+
 // Tests the addition of regional endpoints and supporting the classic link used
 // to create Stack's prior to v0.9.0.
 // See https://github.com/hashicorp/terraform/issues/12842
@@ -662,6 +692,180 @@ resource "aws_iam_instance_profile" "opsworks_instance" {
 }`, name, name, name, name, name)
 }
 
+func testAccAwsOpsworksStackConfigNoVpcCreateTags(name string) string {
+	return fmt.Sprintf(`
+provider "aws" {
+  region = "us-west-2"
+}
+resource "aws_opsworks_stack" "tf-acc" {
+  name = "%s"
+  region = "us-west-2"
+  service_role_arn = "${aws_iam_role.opsworks_service.arn}"
+  default_instance_profile_arn = "${aws_iam_instance_profile.opsworks_instance.arn}"
+  default_availability_zone = "us-west-2a"
+  default_os = "Amazon Linux 2016.09"
+  default_root_device_type = "ebs"
+  custom_json = "{\"key\": \"value\"}"
+  configuration_manager_version = "11.10"
+  use_opsworks_security_groups = false
+  tags {
+    foo = "bar"
+  }
+}
+
+resource "aws_iam_role" "opsworks_service" {
+    name = "%s_opsworks_service"
+    assume_role_policy = <<EOT
+{
+  "Version": "2008-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "opsworks.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_role_policy" "opsworks_service" {
+    name = "%s_opsworks_service"
+    role = "${aws_iam_role.opsworks_service.id}"
+    policy = <<EOT
+{
+  "Statement": [
+    {
+      "Action": [
+        "ec2:*",
+        "iam:PassRole",
+        "cloudwatch:GetMetricStatistics",
+        "elasticloadbalancing:*",
+        "rds:*"
+      ],
+      "Effect": "Allow",
+      "Resource": ["*"]
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_role" "opsworks_instance" {
+    name = "%s_opsworks_instance"
+    assume_role_policy = <<EOT
+{
+  "Version": "2008-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_instance_profile" "opsworks_instance" {
+    name = "%s_opsworks_instance"
+    roles = ["${aws_iam_role.opsworks_instance.name}"]
+}`, name, name, name, name, name)
+}
+
+func testAccAwsOpsworksStackConfigNoVpcUpdateTags(name string) string {
+	return fmt.Sprintf(`
+provider "aws" {
+  region = "us-west-2"
+}
+resource "aws_opsworks_stack" "tf-acc" {
+  name = "%s"
+  region = "us-west-2"
+  service_role_arn = "${aws_iam_role.opsworks_service.arn}"
+  default_instance_profile_arn = "${aws_iam_instance_profile.opsworks_instance.arn}"
+  default_availability_zone = "us-west-2a"
+  default_os = "Amazon Linux 2016.09"
+  default_root_device_type = "ebs"
+  custom_json = "{\"key\": \"value\"}"
+  configuration_manager_version = "11.10"
+  use_opsworks_security_groups = false
+  tags {
+    wut = "asdf"
+  }
+}
+
+resource "aws_iam_role" "opsworks_service" {
+    name = "%s_opsworks_service"
+    assume_role_policy = <<EOT
+{
+  "Version": "2008-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "opsworks.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_role_policy" "opsworks_service" {
+    name = "%s_opsworks_service"
+    role = "${aws_iam_role.opsworks_service.id}"
+    policy = <<EOT
+{
+  "Statement": [
+    {
+      "Action": [
+        "ec2:*",
+        "iam:PassRole",
+        "cloudwatch:GetMetricStatistics",
+        "elasticloadbalancing:*",
+        "rds:*"
+      ],
+      "Effect": "Allow",
+      "Resource": ["*"]
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_role" "opsworks_instance" {
+    name = "%s_opsworks_instance"
+    assume_role_policy = <<EOT
+{
+  "Version": "2008-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOT
+}
+
+resource "aws_iam_instance_profile" "opsworks_instance" {
+    name = "%s_opsworks_instance"
+    roles = ["${aws_iam_role.opsworks_instance.name}"]
+}`, name, name, name, name, name)
+}
+
 func testAccAwsOpsworksStackConfigNoVpcCreateUpdateServiceRole(name string) string {
 	return fmt.Sprintf(`
 provider "aws" {

aws/tagsOpsworks.go

@@ -0,0 +1,50 @@
+package aws
+
+import (
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opsworks"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+// setTags is a helper to set the tags for a resource. It expects the
+// tags field to be named "tags"
+func setTagsOpsworks(conn *opsworks.OpsWorks, d *schema.ResourceData, arn string) error {
+	if d.HasChange("tags") {
+		oraw, nraw := d.GetChange("tags")
+		o := oraw.(map[string]interface{})
+		n := nraw.(map[string]interface{})
+		create, remove := diffTagsGeneric(o, n)
+
+		// Set tags
+		if len(remove) > 0 {
+			log.Printf("[DEBUG] Removing tags: %#v", remove)
+			keys := make([]*string, 0, len(remove))
+			for k := range remove {
+				keys = append(keys, aws.String(k))
+			}
+
+			_, err := conn.UntagResource(&opsworks.UntagResourceInput{
+				ResourceArn: aws.String(arn),
+				TagKeys:     keys,
+			})
+			if err != nil {
+				return err
+			}
+		}
+		if len(create) > 0 {
+			log.Printf("[DEBUG] Creating tags: %#v", create)
+
+			_, err := conn.TagResource(&opsworks.TagResourceInput{
+				ResourceArn: aws.String(arn),
+				Tags:        create,
+			})
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}

website/docs/r/opsworks_stack.html.markdown

@@ -19,6 +19,10 @@ resource "aws_opsworks_stack" "main" {
   service_role_arn             = "${aws_iam_role.opsworks.arn}"
   default_instance_profile_arn = "${aws_iam_instance_profile.opsworks.arn}"
 
+  tags {
+    Name = "foobar-terraform-stack"
+  }
+
   custom_json = <<EOT
 {
  "foobar": {
@@ -56,6 +60,7 @@ The following arguments are supported:
 * `hostname_theme` - (Optional) Keyword representing the naming scheme that will be used for instance hostnames
   within this stack.
 * `manage_berkshelf` - (Optional) Boolean value controlling whether Opsworks will run Berkshelf for this stack.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
 * `use_custom_cookbooks` - (Optional) Boolean value controlling whether the custom cookbook settings are
   enabled.
 * `use_opsworks_security_groups` - (Optional) Boolean value controlling whether the standard OpsWorks
@@ -84,4 +89,4 @@ OpsWorks stacks can be imported using the `id`, e.g.
 
 ```
 $ terraform import aws_opsworks_stack.bar 00000000-0000-0000-0000-000000000000
-```
+```