github.com/leeprovoost/terraform@v0.6.10-0.20160119085442-96f3f76118e7/builtin/providers/aws/resource_aws_iam_role_policy_test.go (about)

     1  package aws
     2  
     3  import (
     4  	"fmt"
     5  	"testing"
     6  
     7  	"github.com/aws/aws-sdk-go/aws"
     8  	"github.com/aws/aws-sdk-go/aws/awserr"
     9  	"github.com/aws/aws-sdk-go/service/iam"
    10  	"github.com/hashicorp/terraform/helper/resource"
    11  	"github.com/hashicorp/terraform/terraform"
    12  )
    13  
    14  func TestAccAWSIAMRolePolicy_basic(t *testing.T) {
    15  	resource.Test(t, resource.TestCase{
    16  		PreCheck:     func() { testAccPreCheck(t) },
    17  		Providers:    testAccProviders,
    18  		CheckDestroy: testAccCheckIAMRolePolicyDestroy,
    19  		Steps: []resource.TestStep{
    20  			resource.TestStep{
    21  				Config: testAccIAMRolePolicyConfig,
    22  				Check: resource.ComposeTestCheckFunc(
    23  					testAccCheckIAMRolePolicy(
    24  						"aws_iam_role.role",
    25  						"aws_iam_role_policy.foo",
    26  					),
    27  				),
    28  			},
    29  			resource.TestStep{
    30  				Config: testAccIAMRolePolicyConfigUpdate,
    31  				Check: resource.ComposeTestCheckFunc(
    32  					testAccCheckIAMRolePolicy(
    33  						"aws_iam_role.role",
    34  						"aws_iam_role_policy.bar",
    35  					),
    36  				),
    37  			},
    38  		},
    39  	})
    40  }
    41  
    42  func testAccCheckIAMRolePolicyDestroy(s *terraform.State) error {
    43  	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
    44  
    45  	for _, rs := range s.RootModule().Resources {
    46  		if rs.Type != "aws_iam_role_policy" {
    47  			continue
    48  		}
    49  
    50  		role, name := resourceAwsIamRolePolicyParseId(rs.Primary.ID)
    51  
    52  		request := &iam.GetRolePolicyInput{
    53  			PolicyName: aws.String(name),
    54  			RoleName:   aws.String(role),
    55  		}
    56  
    57  		var err error
    58  		getResp, err := iamconn.GetRolePolicy(request)
    59  		if err != nil {
    60  			if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
    61  				// none found, that's good
    62  				return nil
    63  			}
    64  			return fmt.Errorf("Error reading IAM policy %s from role %s: %s", name, role, err)
    65  		}
    66  
    67  		if getResp != nil {
    68  			return fmt.Errorf("Found IAM Role, expected none: %s", getResp)
    69  		}
    70  	}
    71  
    72  	return nil
    73  }
    74  
    75  func testAccCheckIAMRolePolicy(
    76  	iamRoleResource string,
    77  	iamRolePolicyResource string) resource.TestCheckFunc {
    78  	return func(s *terraform.State) error {
    79  		rs, ok := s.RootModule().Resources[iamRoleResource]
    80  		if !ok {
    81  			return fmt.Errorf("Not Found: %s", iamRoleResource)
    82  		}
    83  
    84  		if rs.Primary.ID == "" {
    85  			return fmt.Errorf("No ID is set")
    86  		}
    87  
    88  		policy, ok := s.RootModule().Resources[iamRolePolicyResource]
    89  		if !ok {
    90  			return fmt.Errorf("Not Found: %s", iamRolePolicyResource)
    91  		}
    92  
    93  		iamconn := testAccProvider.Meta().(*AWSClient).iamconn
    94  		role, name := resourceAwsIamRolePolicyParseId(policy.Primary.ID)
    95  		_, err := iamconn.GetRolePolicy(&iam.GetRolePolicyInput{
    96  			RoleName:   aws.String(role),
    97  			PolicyName: aws.String(name),
    98  		})
    99  
   100  		if err != nil {
   101  			return err
   102  		}
   103  
   104  		return nil
   105  	}
   106  }
   107  
   108  const testAccIAMRolePolicyConfig = `
   109  resource "aws_iam_role" "role" {
   110  	name = "test_role"
   111  	path = "/"
   112  	assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Effect\":\"Allow\",\"Sid\":\"\"}]}"
   113  }
   114  
   115  resource "aws_iam_role_policy" "foo" {
   116  	name = "foo_policy"
   117  	role = "${aws_iam_role.role.name}"
   118  	policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"*\",\"Resource\":\"*\"}}"
   119  }
   120  `
   121  
   122  const testAccIAMRolePolicyConfigUpdate = `
   123  resource "aws_iam_role" "role" {
   124  	name = "test_role"
   125  	path = "/"
   126  	assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Effect\":\"Allow\",\"Sid\":\"\"}]}"
   127  }
   128  
   129  resource "aws_iam_role_policy" "foo" {
   130  	name = "foo_policy"
   131  	role = "${aws_iam_role.role.name}"
   132  	policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"*\",\"Resource\":\"*\"}}"
   133  }
   134  
   135  resource "aws_iam_role_policy" "bar" {
   136  	name = "bar_policy"
   137  	role = "${aws_iam_role.role.name}"
   138  	policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"*\",\"Resource\":\"*\"}}"
   139  }
   140  `