Merge pull request hashicorp#321 from nazarewk/feature/identity-improvements

Identity improvements

Author: Becca Petrin

vault/provider.go

@@ -150,6 +150,7 @@ func Provider() terraform.ResourceProvider {
 			"vault_identity_entity_alias":                        identityEntityAliasResource(),
 			"vault_identity_group":                               identityGroupResource(),
 			"vault_identity_group_alias":                         identityGroupAliasResource(),
+			"vault_identity_group_policies":                      identityGroupPoliciesResource(),
 			"vault_rabbitmq_secret_backend":                      rabbitmqSecretBackendResource(),
 			"vault_rabbitmq_secret_backend_role":                 rabbitmqSecretBackendRoleResource(),
 			"vault_pki_secret_backend":                           pkiSecretBackendResource(),

vault/resource_identity_entity.go

@@ -18,13 +18,16 @@ func identityEntityResource() *schema.Resource {
 		Read:   identityEntityRead,
 		Delete: identityEntityDelete,
 		Exists: identityEntityExists,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
 
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
-				Required:    true,
 				Description: "Name of the entity.",
-				ForceNew:    true,
+				Optional:    true,
+				Computed:    true,
 			},
 
 			"metadata": {
@@ -50,12 +53,6 @@ func identityEntityResource() *schema.Resource {
 				Optional:    true,
 				Description: "Whether the entity is disabled. Disabled entities' associated tokens cannot be used, but are not revoked.",
 			},
-
-			"id": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: "ID of the entity.",
-			},
 		},
 	}
 }
@@ -98,8 +95,6 @@ func identityEntityCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 	log.Printf("[DEBUG] Wrote IdentityEntity %q", name)
 
-	d.Set("id", resp.Data["id"])
-
 	d.SetId(resp.Data["id"].(string))
 
 	return identityEntityRead(d, meta)
@@ -150,7 +145,7 @@ func identityEntityRead(d *schema.ResourceData, meta interface{}) error {
 
 	for _, k := range []string{"name", "metadata", "disabled", "policies"} {
 		if err := d.Set(k, resp.Data[k]); err != nil {
-			return fmt.Errorf("error reading %s of IdentityEntity %q: %q", k, path, err)
+			return fmt.Errorf("error setting state key \"%s\" on IdentityEntity %q: %s", k, id, err)
 		}
 	}
 	return nil

vault/resource_identity_entity_alias.go

@@ -17,13 +17,15 @@ func identityEntityAliasResource() *schema.Resource {
 		Read:   identityEntityAliasRead,
 		Delete: identityEntityAliasDelete,
 		Exists: identityEntityAliasExists,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
 
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
 				Required:    true,
 				Description: "Name of the entity alias.",
-				ForceNew:    true,
 			},
 
 			"mount_accessor": {
@@ -37,12 +39,6 @@ func identityEntityAliasResource() *schema.Resource {
 				Required:    true,
 				Description: "ID of the entity to which this is an alias.",
 			},
-
-			"id": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: "ID of the entity alias.",
-			},
 		},
 	}
 }
@@ -69,8 +65,6 @@ func identityEntityAliasCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 	log.Printf("[DEBUG] Wrote IdentityEntityAlias %q", name)
 
-	d.Set("id", resp.Data["id"])
-
 	d.SetId(resp.Data["id"].(string))
 
 	return identityEntityAliasRead(d, meta)
@@ -129,8 +123,11 @@ func identityEntityAliasRead(d *schema.ResourceData, meta interface{}) error {
 		return nil
 	}
 
-	for _, k := range []string{"id", "name", "mount_accessor", "canonical_id"} {
-		d.Set(k, resp.Data[k])
+	d.SetId(resp.Data["id"].(string))
+	for _, k := range []string{"name", "mount_accessor", "canonical_id"} {
+		if err := d.Set(k, resp.Data[k]); err != nil {
+			return fmt.Errorf("error setting state key \"%s\" on IdentityEntityAlias %q: %s", k, id, err)
+		}
 	}
 	return nil
 }

vault/resource_identity_entity_test.go

@@ -23,7 +23,7 @@ func TestAccIdentityEntity(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
-				Check:  testAccIdentityEntityCheckAttrs(entity),
+				Check:  testAccIdentityEntityCheckAttrs(),
 			},
 		},
 	})
@@ -39,12 +39,13 @@ func TestAccIdentityEntityUpdate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
-				Check:  testAccIdentityEntityCheckAttrs(entity),
+				Check:  testAccIdentityEntityCheckAttrs(),
 			},
 			{
 				Config: testAccIdentityEntityConfigUpdate(entity),
 				Check: resource.ComposeTestCheckFunc(
-					testAccIdentityEntityCheckAttrs(entity),
+					testAccIdentityEntityCheckAttrs(),
+					resource.TestCheckResourceAttr("vault_identity_entity.entity", "name", fmt.Sprintf("%s-2", entity)),
 					resource.TestCheckResourceAttr("vault_identity_entity.entity", "metadata.version", "2"),
 					resource.TestCheckResourceAttr("vault_identity_entity.entity", "policies.#", "2"),
 					resource.TestCheckResourceAttr("vault_identity_entity.entity", "policies.326271447", "dev"),
@@ -73,7 +74,7 @@ func testAccCheckIdentityEntityDestroy(s *terraform.State) error {
 	return nil
 }
 
-func testAccIdentityEntityCheckAttrs(entity string) resource.TestCheckFunc {
+func testAccIdentityEntityCheckAttrs() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		resourceState := s.Modules[0].Resources["vault_identity_entity.entity"]
 		if resourceState == nil {
@@ -182,7 +183,7 @@ resource "vault_identity_entity" "entity" {
 func testAccIdentityEntityConfigUpdate(entityName string) string {
 	return fmt.Sprintf(`
 resource "vault_identity_entity" "entity" {
-  name = "%s"
+  name = "%s-2"
   policies = ["dev", "test"]
   metadata = {
     version = "2"

vault/resource_identity_group.go

@@ -18,13 +18,16 @@ func identityGroupResource() *schema.Resource {
 		Read:   identityGroupRead,
 		Delete: identityGroupDelete,
 		Exists: identityGroupExists,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
 
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
-				Required:    true,
 				Description: "Name of the group.",
-				ForceNew:    true,
+				Optional:    true,
+				Computed:    true,
 			},
 
 			"type": {
@@ -51,6 +54,16 @@ func identityGroupResource() *schema.Resource {
 					Type: schema.TypeString,
 				},
 				Description: "Policies to be tied to the group.",
+				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+					return d.Get("external_policies").(bool)
+				},
+			},
+
+			"external_policies": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Manage policies externally through `vault_identity_group_policies`, allows using group ID in assigned policies.",
 			},
 
 			"member_group_ids": {
@@ -79,19 +92,19 @@ func identityGroupResource() *schema.Resource {
 					return false
 				},
 			},
-
-			"id": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: "ID of the group.",
-			},
 		},
 	}
 }
 
 func identityGroupUpdateFields(d *schema.ResourceData, data map[string]interface{}) error {
-	if policies, ok := d.GetOk("policies"); ok {
-		data["policies"] = policies.(*schema.Set).List()
+	if name, ok := d.GetOk("name"); ok {
+		data["name"] = name
+	}
+
+	if externalPolicies, ok := d.GetOk("external_policies"); !(ok && externalPolicies.(bool)) {
+		if policies, ok := d.GetOk("policies"); ok {
+			data["policies"] = policies.(*schema.Set).List()
+		}
 	}
 
 	if memberEntityIDs, ok := d.GetOk("member_entity_ids"); ok && d.Get("type").(string) == "internal" {
@@ -133,8 +146,6 @@ func identityGroupCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 	log.Printf("[DEBUG] Wrote IdentityGroup %q", name)
 
-	d.Set("id", resp.Data["id"])
-
 	d.SetId(resp.Data["id"].(string))
 
 	return identityGroupRead(d, meta)
@@ -167,16 +178,13 @@ func identityGroupRead(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*api.Client)
 	id := d.Id()
 
-	path := identityGroupIDPath(id)
-
-	log.Printf("[DEBUG] Reading IdentityGroup %s from %q", id, path)
-	resp, err := client.Logical().Read(path)
+	resp, err := readIdentityGroup(client, id)
 	if err != nil {
 		// We need to check if the secret_id has expired
 		if util.IsExpiredTokenErr(err) {
 			return nil
 		}
-		return fmt.Errorf("error reading AppRole auth backend role SecretID %q: %s", id, err)
+		return fmt.Errorf("error reading IdentityGroup %q: %s", id, err)
 	}
 	log.Printf("[DEBUG] Read IdentityGroup %s", id)
 	if resp == nil {
@@ -185,11 +193,11 @@ func identityGroupRead(d *schema.ResourceData, meta interface{}) error {
 		return nil
 	}
 
-	for _, k := range []string{"name", "type", "metadata", "policies", "member_entity_ids", "member_group_ids"} {
-		if v, ok := resp.Data[k]; ok {
-			if err := d.Set(k, v); err != nil {
-				return fmt.Errorf("error reading %s for Identity Group %q: %q", k, path, err)
-			}
+	readFields := []string{"name", "type", "metadata", "member_entity_ids", "member_group_ids", "policies"}
+
+	for _, k := range readFields {
+		if err := d.Set(k, resp.Data[k]); err != nil {
+			return fmt.Errorf("error setting state key \"%s\" on IdentityGroup %q: %s", k, id, err)
 		}
 	}
 	return nil
@@ -214,30 +222,44 @@ func identityGroupDelete(d *schema.ResourceData, meta interface{}) error {
 func identityGroupExists(d *schema.ResourceData, meta interface{}) (bool, error) {
 	client := meta.(*api.Client)
 	id := d.Id()
-
-	path := identityGroupIDPath(id)
 	key := id
 
-	// use the name if no ID is set
 	if len(id) == 0 {
+		return false, nil
+	} else {
 		key = d.Get("name").(string)
-		path = identityGroupNamePath(key)
 	}
 
 	log.Printf("[DEBUG] Checking if IdentityGroup %q exists", key)
-	resp, err := client.Logical().Read(path)
+	resp, err := readIdentityGroup(client, id)
 	if err != nil {
 		return true, fmt.Errorf("error checking if IdentityGroup %q exists: %s", key, err)
 	}
 	log.Printf("[DEBUG] Checked if IdentityGroup %q exists", key)
-
 	return resp != nil, nil
 }
 
-func identityGroupNamePath(name string) string {
-	return fmt.Sprintf("%s/name/%s", identityGroupPath, name)
-}
-
 func identityGroupIDPath(id string) string {
 	return fmt.Sprintf("%s/id/%s", identityGroupPath, id)
 }
+
+func readIdentityGroupPolicies(client *api.Client, groupId string) ([]interface{}, error) {
+	var presentPolicies []interface{}
+	if resp, err := readIdentityGroup(client, groupId); err != nil {
+		return nil, fmt.Errorf("error reading IdentityGroup policies %q: %s", groupId, err)
+	} else {
+		presentPolicies = resp.Data["policies"].([]interface{})
+	}
+	return presentPolicies, nil
+}
+
+func readIdentityGroup(client *api.Client, groupId string) (*api.Secret, error) {
+	path := identityGroupIDPath(groupId)
+	log.Printf("[DEBUG] Reading IdentityGroup %s from %q", groupId, path)
+
+	if resp, err := client.Logical().Read(path); err != nil {
+		return resp, fmt.Errorf("failed reading IdentityGroup %s from %s", groupId, path)
+	} else {
+		return resp, nil
+	}
+}

vault/resource_identity_group_alias.go

@@ -17,13 +17,15 @@ func identityGroupAliasResource() *schema.Resource {
 		Read:   identityGroupAliasRead,
 		Delete: identityGroupAliasDelete,
 		Exists: identityGroupAliasExists,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
 
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
 				Required:    true,
 				Description: "Name of the group alias.",
-				ForceNew:    true,
 			},
 
 			"mount_accessor": {
@@ -37,12 +39,6 @@ func identityGroupAliasResource() *schema.Resource {
 				Required:    true,
 				Description: "ID of the group to which this is an alias.",
 			},
-
-			"id": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: "ID of the group alias.",
-			},
 		},
 	}
 }
@@ -68,9 +64,6 @@ func identityGroupAliasCreate(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("error writing IdentityGroupAlias to %q: %s", name, err)
 	}
 	log.Printf("[DEBUG] Wrote IdentityGroupAlias %q", name)
-
-	d.Set("id", resp.Data["id"])
-
 	d.SetId(resp.Data["id"].(string))
 
 	return identityGroupAliasRead(d, meta)
@@ -129,8 +122,11 @@ func identityGroupAliasRead(d *schema.ResourceData, meta interface{}) error {
 		return nil
 	}
 
-	for _, k := range []string{"id", "name", "mount_accessor", "canonical_id"} {
-		d.Set(k, resp.Data[k])
+	d.SetId(resp.Data["id"].(string))
+	for _, k := range []string{"name", "mount_accessor", "canonical_id"} {
+		if err := d.Set(k, resp.Data[k]); err != nil {
+			return fmt.Errorf("error setting state key \"%s\" on IdentityGroupAlias %q: %s", k, id, err)
+		}
 	}
 	return nil
 }