Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Codebuild secret preservation #4775

Merged
merged 4 commits into from
Jun 12, 2018
Merged

Codebuild secret preservation #4775

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
03d7bca
Only set aws_codebuild_webhook secret on create
gthole Jun 6, 2018
9bef2d6
Set secret to be sensitive
gthole Jun 7, 2018
bdf75cc
Update tests
gthole Jun 7, 2018
d9a7a90
Add update step to codebuild_webhook GHE test
gthole Jun 7, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions aws/resource_aws_codebuild_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,9 @@ func resourceAwsCodeBuildWebhook() *schema.Resource {
Computed: true,
},
"secret": {
Type: schema.TypeString,
Computed: true,
Type: schema.TypeString,
Computed: true,
Sensitive: true,
},
"url": {
Type: schema.TypeString,
Expand All @@ -48,14 +49,16 @@ func resourceAwsCodeBuildWebhook() *schema.Resource {
func resourceAwsCodeBuildWebhookCreate(d *schema.ResourceData, meta interface{}) error {
conn := meta.(*AWSClient).codebuildconn

_, err := conn.CreateWebhook(&codebuild.CreateWebhookInput{
resp, err := conn.CreateWebhook(&codebuild.CreateWebhookInput{
ProjectName: aws.String(d.Get("project_name").(string)),
BranchFilter: aws.String(d.Get("branch_filter").(string)),
})
if err != nil {
return err
}

// Secret is only returned on create, so capture it at the start
d.Set("secret", resp.Webhook.Secret)
d.SetId(d.Get("project_name").(string))

return resourceAwsCodeBuildWebhookRead(d, meta)
Expand Down Expand Up @@ -84,8 +87,8 @@ func resourceAwsCodeBuildWebhookRead(d *schema.ResourceData, meta interface{}) e
d.Set("branch_filter", project.Webhook.BranchFilter)
d.Set("payload_url", project.Webhook.PayloadUrl)
d.Set("project_name", project.Name)
d.Set("secret", project.Webhook.Secret)
d.Set("url", project.Webhook.Url)
// The secret is never returned after creation, so don't set it here

return nil
}
Expand Down
55 changes: 37 additions & 18 deletions aws/resource_aws_codebuild_webhook_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,15 +29,15 @@ func TestAccAWSCodeBuildWebhook_GitHub(t *testing.T) {
resource.TestCheckResourceAttr(resourceName, "branch_filter", ""),
resource.TestCheckResourceAttr(resourceName, "project_name", rName),
resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
// Checking secret value can be flakey, we may need to wait for its generation
// resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
resource.TestCheckResourceAttr(resourceName, "secret", ""),
resource.TestMatchResourceAttr(resourceName, "url", regexp.MustCompile(`^https://`)),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"secret"},
},
},
})
Expand All @@ -54,21 +54,38 @@ func TestAccAWSCodeBuildWebhook_GitHubEnterprise(t *testing.T) {
CheckDestroy: testAccCheckAWSCodeBuildWebhookDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSCodeBuildWebhookConfig_GitHubEnterprise(rName),
Config: testAccAWSCodeBuildWebhookConfig_GitHubEnterprise(rName, "dev"),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSCodeBuildWebhookExists(resourceName, &webhook),
resource.TestCheckResourceAttr(resourceName, "branch_filter", ""),
resource.TestCheckResourceAttr(resourceName, "branch_filter", "dev"),
resource.TestCheckResourceAttr(resourceName, "project_name", rName),
resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
resource.TestCheckResourceAttr(resourceName, "url", ""),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"secret"},
},
{
Config: testAccAWSCodeBuildWebhookConfig_GitHubEnterprise(rName, "master"),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSCodeBuildWebhookExists(resourceName, &webhook),
resource.TestCheckResourceAttr(resourceName, "branch_filter", "master"),
resource.TestCheckResourceAttr(resourceName, "project_name", rName),
resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
// Checking secret value can be flakey, we may need to wait for its generation
// resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
resource.TestCheckResourceAttr(resourceName, "url", ""),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"secret"},
},
},
})
Expand Down Expand Up @@ -99,9 +116,10 @@ func TestAccAWSCodeBuildWebhook_BranchFilter(t *testing.T) {
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"secret"},
},
},
})
Expand Down Expand Up @@ -179,7 +197,7 @@ resource "aws_codebuild_webhook" "test" {
`)
}

func testAccAWSCodeBuildWebhookConfig_GitHubEnterprise(rName string) string {
func testAccAWSCodeBuildWebhookConfig_GitHubEnterprise(rName string, branchFilter string) string {
return testAccAWSCodeBuildProjectConfig_Base_ServiceRole(rName) + fmt.Sprintf(`
resource "aws_codebuild_project" "test" {
name = "%s"
Expand All @@ -202,9 +220,10 @@ resource "aws_codebuild_project" "test" {
}

resource "aws_codebuild_webhook" "test" {
project_name = "${aws_codebuild_project.test.name}"
project_name = "${aws_codebuild_project.test.name}"
branch_filter = "%s"
}
`, rName)
`, rName, branchFilter)
}

func testAccAWSCodeBuildWebhookConfig_BranchFilter(rName, branchFilter string) string {
Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/codebuild_webhook.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,8 @@ In addition to all arguments above, the following attributes are exported:
* `secret` - The secret token of the associated repository. Not returned for all source types.
* `url` - The URL to the webhook.

~> **Note:** The `secret` attribute is only set on resource creation, so if the secret is manually rotated, terraform will not pick up the change on subsequent runs. In that case, the webhook resource should be tainted and re-created to get the secret back in sync.

## Import

CodeBuild Webhooks can be imported using the CodeBuild Project name, e.g.
Expand Down