Issues #143 - Add aws_iot_policy resource based on work from @jhedev

aws/config.go

@@ -49,6 +49,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/glacier"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/inspector"
+	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/aws/aws-sdk-go/service/kinesis"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/aws/aws-sdk-go/service/lambda"
@@ -174,6 +175,7 @@ type AWSClient struct {
 	ssmconn               *ssm.SSM
 	wafconn               *waf.WAF
 	wafregionalconn       *wafregional.WAFRegional
+	iotconn               *iot.IoT
 }
 
 func (c *AWSClient) S3() *s3.S3 {
@@ -364,6 +366,7 @@ func (c *Config) Client() (interface{}, error) {
 	client.firehoseconn = firehose.New(sess)
 	client.inspectorconn = inspector.New(sess)
 	client.glacierconn = glacier.New(sess)
+	client.iotconn = iot.New(sess)
 	client.kinesisconn = kinesis.New(awsKinesisSess)
 	client.kmsconn = kms.New(awsKmsSess)
 	client.lambdaconn = lambda.New(sess)

aws/provider.go

@@ -351,6 +351,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_inspector_resource_group":                 resourceAWSInspectorResourceGroup(),
 			"aws_instance":                                 resourceAwsInstance(),
 			"aws_internet_gateway":                         resourceAwsInternetGateway(),
+			"aws_iot_policy":                               resourceAwsIotPolicy(),
 			"aws_key_pair":                                 resourceAwsKeyPair(),
 			"aws_kinesis_firehose_delivery_stream":         resourceAwsKinesisFirehoseDeliveryStream(),
 			"aws_kinesis_stream":                           resourceAwsKinesisStream(),

aws/resource_aws_iot_policy.go

@@ -0,0 +1,131 @@
+package aws
+
+import (
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIotPolicy() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIotPolicyCreate,
+		Read:   resourceAwsIotPolicyRead,
+		Update: resourceAwsIotPolicyUpdate,
+		Delete: resourceAwsIotPolicyDelete,
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"default_version_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIotPolicyCreate(d *schema.ResourceData, meta interface{}) error {
+
+	conn := meta.(*AWSClient).iotconn
+
+	out, err := conn.CreatePolicy(&iot.CreatePolicyInput{
+		PolicyName:     aws.String(d.Get("name").(string)),
+		PolicyDocument: aws.String(d.Get("policy").(string)),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+
+	d.SetId(*out.PolicyName)
+
+	return resourceAwsIotPolicyRead(d, meta)
+}
+
+func resourceAwsIotPolicyRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iotconn
+
+	out, err := conn.GetPolicy(&iot.GetPolicyInput{
+		PolicyName: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+
+	d.Set("arn", out.PolicyArn)
+	d.Set("defaultVersionId", out.DefaultVersionId)
+
+	return nil
+}
+
+func resourceAwsIotPolicyUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iotconn
+
+	if d.HasChange("policy") {
+		_, err := conn.CreatePolicyVersion(&iot.CreatePolicyVersionInput{
+			PolicyName:     aws.String(d.Id()),
+			PolicyDocument: aws.String(d.Get("policy").(string)),
+			SetAsDefault:   aws.Bool(true),
+		})
+
+		if err != nil {
+			log.Printf("[ERROR] %s", err)
+			return err
+		}
+	}
+
+	return resourceAwsIotPolicyRead(d, meta)
+}
+
+func resourceAwsIotPolicyDelete(d *schema.ResourceData, meta interface{}) error {
+
+	conn := meta.(*AWSClient).iotconn
+
+	out, err := conn.ListPolicyVersions(&iot.ListPolicyVersionsInput{
+		PolicyName: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	// Delete all non-default versions of the policy
+	for _, ver := range out.PolicyVersions {
+		if !*ver.IsDefaultVersion {
+			_, err = conn.DeletePolicyVersion(&iot.DeletePolicyVersionInput{
+				PolicyName:      aws.String(d.Id()),
+				PolicyVersionId: ver.VersionId,
+			})
+			if err != nil {
+				log.Printf("[ERROR] %s", err)
+				return err
+			}
+		}
+	}
+
+	//Delete default policy version
+	_, err = conn.DeletePolicy(&iot.DeletePolicyInput{
+		PolicyName: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+
+	return nil
+}

aws/resource_aws_iot_policy_test.go

@@ -0,0 +1,109 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"regexp"
+)
+
+func TestAccAWSIoTPolicy_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIoTPolicyDestroy_basic,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSIoTPolicy_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIoTPolicyExists_basic("aws_iot_policy.pubsub"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSIoTPolicy_invalidJson(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIoTPolicyDestroy_basic,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSIoTPolicyInvalidJsonConfig,
+				ExpectError: regexp.MustCompile("MalformedPolicyException.*"),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSIoTPolicyDestroy_basic(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iotconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iot_policy" {
+			continue
+		}
+
+		out, err := conn.ListPolicies(&iot.ListPoliciesInput{})
+
+		if err != nil {
+			return err
+		}
+
+		for _, t := range out.Policies {
+			if *t.PolicyName == rs.Primary.ID {
+				return fmt.Errorf("IoT policy still exists:\n%s", t)
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func testAccCheckAWSIoTPolicyExists_basic(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		return nil
+	}
+}
+
+var testAccAWSIoTPolicy_basic = `
+resource "aws_iot_policy" "pubsub" {
+  name = "PubSubToAnyTopic"
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["iot:*"],
+    "Resource": ["*"]
+  }]
+}
+EOF
+}
+`
+
+var testAccAWSIoTPolicyInvalidJsonConfig = `
+resource "aws_iot_policy" "pubsub" {
+  name = "PubSubToAnyTopic"
+  policy = <<EOF
+	{
+	  "Version": "2012-10-17",
+	  "Statement": [{
+		"Effect": "Allow",
+		"Action": ["iot:*"],
+		"Resource": ["*"]
+	  }]
+	}
+EOF
+}
+`