Service Catalog PortfolioPrincipalAssociation resource added

aws/provider.go

@@ -845,6 +845,7 @@ func Provider() *schema.Provider {
 			"aws_securityhub_product_subscription":                    resourceAwsSecurityHubProductSubscription(),
 			"aws_securityhub_standards_subscription":                  resourceAwsSecurityHubStandardsSubscription(),
 			"aws_servicecatalog_portfolio":                            resourceAwsServiceCatalogPortfolio(),
+			"aws_servicecatalog_portfolio_principal_association":      resourceAwsServiceCatalogPortfolioPrincipalAssociation(),
 			"aws_service_discovery_http_namespace":                    resourceAwsServiceDiscoveryHttpNamespace(),
 			"aws_service_discovery_private_dns_namespace":             resourceAwsServiceDiscoveryPrivateDnsNamespace(),
 			"aws_service_discovery_public_dns_namespace":              resourceAwsServiceDiscoveryPublicDnsNamespace(),

aws/resource_aws_servicecatalog_portfolio.go

@@ -170,9 +170,19 @@ func resourceAwsServiceCatalogPortfolioDelete(d *schema.ResourceData, meta inter
 	input.Id = aws.String(d.Id())
 
 	log.Printf("[DEBUG] Delete Service Catalog Portfolio: %#v", input)
-	_, err := conn.DeletePortfolio(&input)
+	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
+		_, err := conn.DeletePortfolio(&input)
+		if err != nil {
+			if isAWSErr(err, servicecatalog.ErrCodeResourceInUseException, "") {
+				// delay and retry, other things eg associations might still be getting deleted
+				return resource.RetryableError(err)
+			}
+			return resource.NonRetryableError(err)
+		}
+		return nil
+	})
 	if err != nil {
-		return fmt.Errorf("Deleting Service Catalog Portfolio '%s' failed: %s", *input.Id, err.Error())
+		return fmt.Errorf("Deleting Service Catalog Portfolio '%s' failed: %s", *input.Id, err)
 	}
 	return nil
 }

aws/resource_aws_servicecatalog_portfolio_principal_association.go

@@ -0,0 +1,174 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/servicecatalog"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociation() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsServiceCatalogPortfolioPrincipalAssociationCreate,
+		Read:   resourceAwsServiceCatalogPortfolioPrincipalAssociationRead,
+		Delete: resourceAwsServiceCatalogPortfolioPrincipalAssociationDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+		Schema: map[string]*schema.Schema{
+			"portfolio_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"principal_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validateArn,
+				ForceNew:     true,
+			},
+		},
+	}
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationCreate(d *schema.ResourceData, meta interface{}) error {
+	_, portfolioId, principalArn, err := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	if err != nil {
+		return err
+	}
+	input := servicecatalog.AssociatePrincipalWithPortfolioInput{
+		PortfolioId:   aws.String(portfolioId),
+		PrincipalARN:  aws.String(principalArn),
+		PrincipalType: aws.String(servicecatalog.PrincipalTypeIam),
+	}
+	conn := meta.(*AWSClient).scconn
+	_, err = conn.AssociatePrincipalWithPortfolio(&input)
+	if err != nil {
+		return fmt.Errorf("creating Service Catalog Principal(%s)/Portfolio(%s) Association failed: %s",
+			principalArn, portfolioId, err.Error())
+	}
+
+	return resourceAwsServiceCatalogPortfolioPrincipalAssociationRead(d, meta)
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationRead(d *schema.ResourceData, meta interface{}) error {
+	id, portfolioId, principalArn, err := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	if err != nil {
+		return err
+	}
+	input := servicecatalog.ListPrincipalsForPortfolioInput{
+		PortfolioId: aws.String(portfolioId),
+	}
+	conn := meta.(*AWSClient).scconn
+	isFound := false
+
+	// listing principals for portfolio is a paginated operation
+	// and if a principal has recently been added, it can contain the ID while it is stabilising,
+	// so we retry for up to 1 minute if it is stabilising and the ARN we are looking for is not found
+	err = resource.Retry(1*time.Minute, func() *resource.RetryError {
+		var pageToken = ""
+		for {
+			nonArnFound := false
+			pageOfDetails, nextPageToken, err := resourceAwsServiceCatalogPortfolioPrincipalAssociationListPrincipalsForPortfolioPage(conn, input, &pageToken)
+			if err != nil {
+				return resource.NonRetryableError(err)
+			}
+			for _, principal := range pageOfDetails {
+				if aws.StringValue(principal.PrincipalARN) == principalArn {
+					isFound = true
+					return nil
+				}
+				if !strings.HasPrefix(aws.StringValue(principal.PrincipalARN), "arn:") {
+					nonArnFound = true
+				}
+			}
+			if nextPageToken == nil {
+				if nonArnFound {
+					log.Printf("[DEBUG] Service Catalog Principal(%s)/Portfolio(%s) Association not found, but principals detected as stabilizing",
+						principalArn, portfolioId)
+					return resource.RetryableError(fmt.Errorf("Principals stabilizing"))
+				} else {
+					return nil
+				}
+			}
+			pageToken = aws.StringValue(nextPageToken)
+		}
+	})
+	if err != nil {
+		return err
+	}
+	if isFound {
+		d.SetId(id)
+	} else {
+		log.Printf("[WARN] Service Catalog Principal(%s)/Portfolio(%s) Association not found, removing from state",
+			principalArn, portfolioId)
+		d.SetId("")
+	}
+	d.Set("principal_arn", principalArn)
+	d.Set("portfolio_id", portfolioId)
+	return nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationListPrincipalsForPortfolioPage(conn *servicecatalog.ServiceCatalog, input servicecatalog.ListPrincipalsForPortfolioInput, nextPageToken *string) ([]*servicecatalog.Principal, *string, error) {
+	input.PageToken = nextPageToken
+	var page, err = conn.ListPrincipalsForPortfolio(&input)
+	if err != nil {
+		return nil, nil, fmt.Errorf("retrieving Service Catalog Associations for Principal/Portfolios: %s", err.Error())
+	}
+	principalDetails := page.Principals
+	return principalDetails, page.NextPageToken, nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationDelete(d *schema.ResourceData, meta interface{}) error {
+	_, portfolioId, principalArn, err := resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d)
+	if err != nil {
+		return err
+	}
+	input := servicecatalog.DisassociatePrincipalFromPortfolioInput{
+		PortfolioId:  aws.String(portfolioId),
+		PrincipalARN: aws.String(principalArn),
+	}
+	conn := meta.(*AWSClient).scconn
+	_, err = conn.DisassociatePrincipalFromPortfolio(&input)
+	if err != nil {
+		return fmt.Errorf("deleting Service Catalog Principal(%s)/Portfolio(%s) Association failed: %s",
+			principalArn, portfolioId, err.Error())
+	}
+	return nil
+}
+
+func resourceAwsServiceCatalogPortfolioPrincipalAssociationRequiredParameters(d *schema.ResourceData) (string, string, string, error) {
+	// ":" recommended as separator where multiple fields needed to uniquely identify and import, based on https://www.terraform.io/docs/extend/resources/import.html#importer-state-function
+	// (as in this case where AWS doesn't treat this association as a first class resource; it has no AWS identifier)
+	// this is not a valid "identifier" character according to https://www.terraform.io/docs/configuration/syntax.html#identifiers
+	// but that does not seem to apply to this internal "id"
+	principalArn, ok := d.GetOk("principal_arn")
+	portfolioId, ok2 := d.GetOk("portfolio_id")
+	if ok && ok2 {
+		id := portfolioId.(string) + ":" + principalArn.(string)
+		return id, portfolioId.(string), principalArn.(string), nil
+	} else if ok || ok2 {
+		return "", "", "", fmt.Errorf("Invalid state - principal_arn and portfolio_id must both be set or neither set to infer from ID")
+	} else if d.Id() != "" {
+		return parseServiceCatalogPortfolioPrincipalAssociationResourceId(d.Id())
+	} else {
+		return "", "", "", fmt.Errorf("Invalid state - principal_arn and portfolio_id must be set, or ID set to import")
+	}
+}
+
+func parseServiceCatalogPortfolioPrincipalAssociationResourceId(id string) (string, string, string, error) {
+	s := strings.SplitN(id, ":", 2)
+	if len(s) != 2 {
+		return "", "", "", fmt.Errorf("Invalid ID '%s' - should be of format <portfolio_id>:<principal-arn>", id)
+	}
+	return id, s[0], s[1], nil
+}