New resource: ram_resource_share_accepter

[YakDriver]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Fixes #7601

Changes proposed in this pull request:

• r/ram_resource_share_accepter: New resource allowing accepting AWS resource share invitations.

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAwsRamResourceShareAccepter_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -parallel 20 -run=TestAccAwsRamResourceShareAccepter_basic -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccAwsRamResourceShareAccepter_basic
=== PAUSE TestAccAwsRamResourceShareAccepter_basic
=== CONT  TestAccAwsRamResourceShareAccepter_basic
--- PASS: TestAccAwsRamResourceShareAccepter_basic (34.00s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	34.071s

Usage

Example usage:

resource "aws_ram_resource_share_accepter" "example" {
  arn = "arn:aws:ram:us-east-1:999999999999:resource-share-invitation/49510c94-3f65-5949-a939-98900e9a5765"
}

Slightly more complicated example:

resource "aws_ram_resource_share" "test" {
  provider = "aws.alternate"

  name                      = "veryfineshare"
  allow_external_principals = true

  tags = {
	Name = "veryfineshare"
  }
}

resource "aws_ram_principal_association" "test" {
  provider = "aws.alternate"

  principal          = "${data.aws_caller_identity.receiver.account_id}"
  resource_share_arn = "${aws_ram_resource_share.test.arn}"

  depends_on = ["data.aws_caller_identity.receiver"]
}

data "aws_caller_identity" "receiver" {}

resource "aws_ram_resource_share_accepter" "test" {
  share_arn = "${aws_ram_resource_share.test.arn}"

  depends_on = ["aws_ram_resource_share.test", "aws_ram_principal_association.test"]
}

Arguments

One of the following is required:
share_arn - (Optional) Resource share ARN.
invitation_arn - (Optional) Resource share invitation ARN.

Attributes

status - Invitation status (e.g., ACCEPTED, REJECTED).
receiver_account_id - Account ID of resource share receiver.
sender_account_id - Account ID of resource share sender.
share_name - Name of the resource share.
resources - List of ARNs of shared resources.

[lorengordon]

Would love to get this reviewed and merged! Being able to create and accept resource shares in the same config would be awesome (across accounts, especially)!

[bflad]

@YakDriver do you need help with the testing/documentation here?

[YakDriver]

@bflad maybe. not sure how you'd like to handle a multi-account test.

[ewbankkit]

@YakDriver You could take a look at the cross-account tests in resource_aws_dx_gateway_association_test.go from #8528 for usage of the cross-account support available in the acceptance testing framework.

[ewbankkit]

Should we also return the ARNs of the resources shared in the invitation? I think this would help when using other resources that depend on those shared resources.

[YakDriver]

Should we also return the ARNs of the resources shared in the invitation? I think this would help when using other resources that depend on those shared resources.

I added a list resources with the ARNs of resources available through the share.

[YakDriver]

@ewbankkit you asked about delete and update... Here's what I think:

For delete, I've made it leave the resource share on deleting the accepter. The other option is simply remove the accepter from the state and warn that resources still exist. I prefer the leaving option but I can see arguments both ways.

For update, all arguments are force_new so I don't think update makes much sense.

[YakDriver]

In order to make pass though import work (not sure why you'd need to import but...), I've made the ID the invitation ARN.

[ewbankkit]

@YakDriver In my mind this resource is kind of like the aws_vpn_peering_connection_accepter resource where the peering connection (equivalent to the RAM association I think) could be deleted via the AWS API from either the creator or accepter's end but Terraform only allows deletion from the creator's end - Deleting the accepter resource just removes the resource from the state.
Not sure if the RAM association can be deleted from either end but if it can and you choose to allow deletion from the accepter's resource delete method, I think you may find there are problems running end-to-end acceptance tests.

[YakDriver]

@bflad I've completed the adjust. I made these changes on top of your recommended changes:

• I could not figure out a good reason why invitation_arn was an argument. It adds unnecessary complexity since there is no way to even get this value from Terraform. I made it an attribute and it simplified the code.
• Created one function that gets invitations whether they are ACCEPTED or PENDING instead of duplicating in create() and read().

Let me know if there's any other adjust!

[YakDriver]

$ make testacc TESTARGS='-run=TestAccAwsRamResourceShareAccepter_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -parallel 20 -run=TestAccAwsRamResourceShareAccepter_basic -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccAwsRamResourceShareAccepter_basic
=== PAUSE TestAccAwsRamResourceShareAccepter_basic
=== CONT  TestAccAwsRamResourceShareAccepter_basic
--- PASS: TestAccAwsRamResourceShareAccepter_basic (41.76s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	41.842s

[YakDriver]

@bflad Any idea why pr-label, labeler 2.0 says that "resource not accessible by integration?"

[bflad]

Looks good, thanks so much, @YakDriver 🚀

--- PASS: TestAccAwsRamResourceShareAccepter_basic (31.57s)

[bflad]

@bflad Any idea why pr-label, labeler 2.0 says that "resource not accessible by integration?"

Nope haven't seen that yet. We're still new to GitHub Actions v2 ourselves. 😅

[ghost]

This has been released in version 2.24.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!