New resource for Macie2 Account

.changelog/19069.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_macie2_account
+```

aws/provider.go

@@ -832,6 +832,7 @@ func Provider() *schema.Provider {
 			"aws_load_balancer_backend_server_policy":                 resourceAwsLoadBalancerBackendServerPolicies(),
 			"aws_load_balancer_listener_policy":                       resourceAwsLoadBalancerListenerPolicies(),
 			"aws_lb_ssl_negotiation_policy":                           resourceAwsLBSSLNegotiationPolicy(),
+			"aws_macie2_account":                                      resourceAwsMacie2Account(),
 			"aws_macie_member_account_association":                    resourceAwsMacieMemberAccountAssociation(),
 			"aws_macie_s3_bucket_association":                         resourceAwsMacieS3BucketAssociation(),
 			"aws_main_route_table_association":                        resourceAwsMainRouteTableAssociation(),

aws/resource_aws_macie2_account.go

@@ -0,0 +1,159 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/macie2"
+	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func resourceAwsMacie2Account() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceMacie2AccountCreate,
+		ReadWithoutTimeout:   resourceMacie2AccountRead,
+		UpdateWithoutTimeout: resourceMacie2AccountUpdate,
+		DeleteWithoutTimeout: resourceMacie2AccountDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"finding_publishing_frequency": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringInSlice(macie2.FindingPublishingFrequency_Values(), false),
+			},
+			"status": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringInSlice(macie2.MacieStatus_Values(), false),
+			},
+			"service_role": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"created_at": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"updated_at": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceMacie2AccountCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*AWSClient).macie2conn
+
+	input := &macie2.EnableMacieInput{
+		ClientToken: aws.String(resource.UniqueId()),
+	}
+
+	if v, ok := d.GetOk("finding_publishing_frequency"); ok {
+		input.FindingPublishingFrequency = aws.String(v.(string))
+	}
+	if v, ok := d.GetOk("status"); ok {
+		input.Status = aws.String(v.(string))
+	}
+
+	var err error
+	err = resource.RetryContext(ctx, 4*time.Minute, func() *resource.RetryError {
+		_, err = conn.EnableMacieWithContext(ctx, input)
+		if err != nil {
+			if tfawserr.ErrCodeEquals(err, macie2.ErrorCodeClientError) {
+				return resource.RetryableError(err)
+			}
+
+			return resource.NonRetryableError(err)
+		}
+
+		return nil
+	})
+
+	if isResourceTimeoutError(err) {
+		_, err = conn.EnableMacieWithContext(ctx, input)
+	}
+
+	if err != nil {
+		return diag.FromErr(fmt.Errorf("error enabling Macie Account: %w", err))
+	}
+
+	d.SetId(meta.(*AWSClient).accountid)
+
+	return resourceMacie2AccountRead(ctx, d, meta)
+}
+
+func resourceMacie2AccountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*AWSClient).macie2conn
+
+	input := &macie2.GetMacieSessionInput{}
+
+	resp, err := conn.GetMacieSessionWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, macie2.ErrCodeAccessDeniedException) {
+		log.Printf("[WARN] Macie not enabled for AWS account (%s), removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return diag.FromErr(fmt.Errorf("error reading Macie Account (%s): %w", d.Id(), err))
+	}
+
+	d.Set("status", resp.Status)
+	d.Set("finding_publishing_frequency", resp.FindingPublishingFrequency)
+	d.Set("service_role", resp.ServiceRole)
+	d.Set("created_at", aws.TimeValue(resp.CreatedAt).Format(time.RFC3339))
+	d.Set("updated_at", aws.TimeValue(resp.UpdatedAt).Format(time.RFC3339))
+
+	return nil
+}
+
+func resourceMacie2AccountUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*AWSClient).macie2conn
+
+	input := &macie2.UpdateMacieSessionInput{}
+
+	if d.HasChange("finding_publishing_frequency") {
+		input.FindingPublishingFrequency = aws.String(d.Get("finding_publishing_frequency").(string))
+	}
+
+	if d.HasChange("status") {
+		input.Status = aws.String(d.Get("status").(string))
+	}
+
+	_, err := conn.UpdateMacieSessionWithContext(ctx, input)
+	if err != nil {
+		return diag.FromErr(fmt.Errorf("error updating Macie Account (%s): %w", d.Id(), err))
+	}
+
+	return resourceMacie2AccountRead(ctx, d, meta)
+}
+
+func resourceMacie2AccountDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*AWSClient).macie2conn
+
+	input := &macie2.DisableMacieInput{}
+
+	_, err := conn.DisableMacieWithContext(ctx, input)
+	if err != nil {
+		if tfawserr.ErrCodeEquals(err, macie2.ErrCodeResourceNotFoundException) ||
+			tfawserr.ErrMessageContains(err, macie2.ErrCodeAccessDeniedException, "Macie is not enabled") {
+			return nil
+		}
+		return diag.FromErr(fmt.Errorf("error disabling Macie Account (%s): %w", d.Id(), err))
+	}
+	return nil
+}