Skip to content

Commit 42f0f37

Browse files
oarbusioarbusi
authored
chore: migrate encryption_at_rest resource to new SDK (#1725)
* migrate encryption_at_rest resource to new SDK * check if exists before updating in delete * change cleint to V2 * conflicts * conflicts missing changes
1 parent 8a366c2 commit 42f0f37

File tree

3 files changed

+190
-177
lines changed

3 files changed

+190
-177
lines changed

‎internal/service/encryptionatrest/resource_encryption_at_rest.go

+79-71
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
"github.com/mongodb/terraform-provider-mongodbatlas/internal/common/validate"
2525
"github.com/mongodb/terraform-provider-mongodbatlas/internal/config"
2626
"github.com/mongodb/terraform-provider-mongodbatlas/internal/service/project"
27-
matlas "go.mongodb.org/atlas/mongodbatlas"
27+
"go.mongodb.org/atlas-sdk/v20231115002/admin"
2828
)
2929

3030
const (
@@ -205,7 +205,7 @@ func (r *encryptionAtRestRS) Schema(ctx context.Context, req resource.SchemaRequ
205205
func (r *encryptionAtRestRS) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
206206
var encryptionAtRestPlan *tfEncryptionAtRestRSModel
207207
var encryptionAtRestConfig *tfEncryptionAtRestRSModel
208-
conn := r.Client.Atlas
208+
connV2 := r.Client.AtlasV2
209209

210210
resp.Diagnostics.Append(req.Plan.Get(ctx, &encryptionAtRestPlan)...)
211211
resp.Diagnostics.Append(req.Config.Get(ctx, &encryptionAtRestConfig)...)
@@ -214,23 +214,21 @@ func (r *encryptionAtRestRS) Create(ctx context.Context, req resource.CreateRequ
214214
}
215215

216216
projectID := encryptionAtRestPlan.ProjectID.ValueString()
217-
encryptionAtRestReq := &matlas.EncryptionAtRest{
218-
GroupID: projectID,
219-
}
217+
encryptionAtRestReq := &admin.EncryptionAtRest{}
220218
if encryptionAtRestPlan.AwsKmsConfig != nil {
221-
encryptionAtRestReq.AwsKms = *newAtlasAwsKms(encryptionAtRestPlan.AwsKmsConfig)
219+
encryptionAtRestReq.AwsKms = newAtlasAwsKms(encryptionAtRestPlan.AwsKmsConfig)
222220
}
223221
if encryptionAtRestPlan.AzureKeyVaultConfig != nil {
224-
encryptionAtRestReq.AzureKeyVault = *newAtlasAzureKeyVault(encryptionAtRestPlan.AzureKeyVaultConfig)
222+
encryptionAtRestReq.AzureKeyVault = newAtlasAzureKeyVault(encryptionAtRestPlan.AzureKeyVaultConfig)
225223
}
226224
if encryptionAtRestPlan.GoogleCloudKmsConfig != nil {
227-
encryptionAtRestReq.GoogleCloudKms = *newAtlasGcpKms(encryptionAtRestPlan.GoogleCloudKmsConfig)
225+
encryptionAtRestReq.GoogleCloudKms = newAtlasGcpKms(encryptionAtRestPlan.GoogleCloudKmsConfig)
228226
}
229227

230228
stateConf := &retry.StateChangeConf{
231229
Pending: []string{retrystrategy.RetryStrategyPendingState},
232230
Target: []string{retrystrategy.RetryStrategyCompletedState, retrystrategy.RetryStrategyErrorState},
233-
Refresh: resourceMongoDBAtlasEncryptionAtRestCreateRefreshFunc(ctx, projectID, conn, encryptionAtRestReq),
231+
Refresh: resourceMongoDBAtlasEncryptionAtRestCreateRefreshFunc(ctx, projectID, connV2, encryptionAtRestReq),
234232
Timeout: 1 * time.Minute,
235233
MinTimeout: 1 * time.Second,
236234
Delay: 0,
@@ -243,7 +241,7 @@ func (r *encryptionAtRestRS) Create(ctx context.Context, req resource.CreateRequ
243241
return
244242
}
245243

246-
encryptionAtRestPlanNew := newTFEncryptionAtRestRSModel(ctx, projectID, encryptionResp.(*matlas.EncryptionAtRest), encryptionAtRestPlan)
244+
encryptionAtRestPlanNew := newTFEncryptionAtRestRSModel(ctx, projectID, encryptionResp.(*admin.EncryptionAtRest), encryptionAtRestPlan)
247245
resetDefaultsFromConfigOrState(ctx, encryptionAtRestPlan, encryptionAtRestPlanNew, encryptionAtRestConfig)
248246

249247
// set state to fully populated data
@@ -254,17 +252,16 @@ func (r *encryptionAtRestRS) Create(ctx context.Context, req resource.CreateRequ
254252
}
255253
}
256254

257-
func resourceMongoDBAtlasEncryptionAtRestCreateRefreshFunc(ctx context.Context, projectID string, conn *matlas.Client, encryptionAtRestReq *matlas.EncryptionAtRest) retry.StateRefreshFunc {
255+
func resourceMongoDBAtlasEncryptionAtRestCreateRefreshFunc(ctx context.Context, projectID string, connV2 *admin.APIClient, encryptionAtRestReq *admin.EncryptionAtRest) retry.StateRefreshFunc {
258256
return func() (any, string, error) {
259-
encryptionResp, _, err := conn.EncryptionsAtRest.Create(ctx, encryptionAtRestReq)
257+
encryptionResp, _, err := connV2.EncryptionAtRestUsingCustomerKeyManagementApi.UpdateEncryptionAtRest(ctx, projectID, encryptionAtRestReq).Execute()
260258
if err != nil {
261259
if errors.Is(err, errors.New("CANNOT_ASSUME_ROLE")) ||
262260
errors.Is(err, errors.New("INVALID_AWS_CREDENTIALS")) ||
263261
errors.Is(err, errors.New("CLOUD_PROVIDER_ACCESS_ROLE_NOT_AUTHORIZED")) {
264262
log.Printf("warning issue performing authorize EncryptionsAtRest not done try again: %s \n", err.Error())
265263
log.Println("retrying ")
266264

267-
encryptionAtRestReq.GroupID = projectID
268265
return encryptionResp, retrystrategy.RetryStrategyPendingState, nil
269266
}
270267
return encryptionResp, retrystrategy.RetryStrategyErrorState, err
@@ -290,9 +287,9 @@ func (r *encryptionAtRestRS) Read(ctx context.Context, req resource.ReadRequest,
290287
isImport = true
291288
}
292289

293-
conn := r.Client.Atlas
290+
connV2 := r.Client.AtlasV2
294291

295-
encryptionResp, _, err := conn.EncryptionsAtRest.Get(context.Background(), projectID)
292+
encryptionResp, _, err := connV2.EncryptionAtRestUsingCustomerKeyManagementApi.GetEncryptionAtRest(context.Background(), projectID).Execute()
296293
if err != nil {
297294
resp.Diagnostics.AddError("error when getting encryption at rest resource during read", fmt.Sprintf(errorReadEncryptionAtRest, err.Error()))
298295
return
@@ -314,7 +311,7 @@ func (r *encryptionAtRestRS) Update(ctx context.Context, req resource.UpdateRequ
314311
var encryptionAtRestState *tfEncryptionAtRestRSModel
315312
var encryptionAtRestConfig *tfEncryptionAtRestRSModel
316313
var encryptionAtRestPlan *tfEncryptionAtRestRSModel
317-
conn := r.Client.Atlas
314+
connV2 := r.Client.AtlasV2
318315

319316
// get current config
320317
resp.Diagnostics.Append(req.Config.Get(ctx, &encryptionAtRestConfig)...)
@@ -332,7 +329,7 @@ func (r *encryptionAtRestRS) Update(ctx context.Context, req resource.UpdateRequ
332329
return
333330
}
334331
projectID := encryptionAtRestState.ProjectID.ValueString()
335-
atlasEncryptionAtRest, atlasResp, err := conn.EncryptionsAtRest.Get(context.Background(), projectID)
332+
atlasEncryptionAtRest, atlasResp, err := connV2.EncryptionAtRestUsingCustomerKeyManagementApi.GetEncryptionAtRest(context.Background(), projectID).Execute()
336333
if err != nil {
337334
if resp != nil && atlasResp.StatusCode == http.StatusNotFound {
338335
resp.State.RemoveResource(ctx)
@@ -343,18 +340,16 @@ func (r *encryptionAtRestRS) Update(ctx context.Context, req resource.UpdateRequ
343340
}
344341

345342
if hasAwsKmsConfigChanged(encryptionAtRestPlan.AwsKmsConfig, encryptionAtRestState.AwsKmsConfig) {
346-
atlasEncryptionAtRest.AwsKms = *newAtlasAwsKms(encryptionAtRestPlan.AwsKmsConfig)
343+
atlasEncryptionAtRest.AwsKms = newAtlasAwsKms(encryptionAtRestPlan.AwsKmsConfig)
347344
}
348345
if hasAzureKeyVaultConfigChanged(encryptionAtRestPlan.AzureKeyVaultConfig, encryptionAtRestState.AzureKeyVaultConfig) {
349-
atlasEncryptionAtRest.AzureKeyVault = *newAtlasAzureKeyVault(encryptionAtRestPlan.AzureKeyVaultConfig)
346+
atlasEncryptionAtRest.AzureKeyVault = newAtlasAzureKeyVault(encryptionAtRestPlan.AzureKeyVaultConfig)
350347
}
351348
if hasGcpKmsConfigChanged(encryptionAtRestPlan.GoogleCloudKmsConfig, encryptionAtRestState.GoogleCloudKmsConfig) {
352-
atlasEncryptionAtRest.GoogleCloudKms = *newAtlasGcpKms(encryptionAtRestPlan.GoogleCloudKmsConfig)
349+
atlasEncryptionAtRest.GoogleCloudKms = newAtlasGcpKms(encryptionAtRestPlan.GoogleCloudKmsConfig)
353350
}
354351

355-
atlasEncryptionAtRest.GroupID = projectID
356-
357-
encryptionResp, _, err := conn.EncryptionsAtRest.Create(ctx, atlasEncryptionAtRest)
352+
encryptionResp, _, err := connV2.EncryptionAtRestUsingCustomerKeyManagementApi.UpdateEncryptionAtRest(ctx, projectID, atlasEncryptionAtRest).Execute()
358353
if err != nil {
359354
resp.Diagnostics.AddError("error updating encryption at rest", fmt.Sprintf(errorUpdateEncryptionAtRest, err.Error()))
360355
return
@@ -376,9 +371,22 @@ func (r *encryptionAtRestRS) Delete(ctx context.Context, req resource.DeleteRequ
376371
return
377372
}
378373

379-
conn := r.Client.Atlas
374+
enabled := false
375+
connV2 := r.Client.AtlasV2
380376
projectID := encryptionAtRestState.ProjectID.ValueString()
381-
_, err := conn.EncryptionsAtRest.Delete(ctx, projectID)
377+
378+
_, _, err := connV2.EncryptionAtRestUsingCustomerKeyManagementApi.GetEncryptionAtRest(context.Background(), projectID).Execute()
379+
if err != nil {
380+
resp.Diagnostics.AddError("error when destroying resource", fmt.Sprintf(errorDeleteEncryptionAtRest, projectID, err.Error()))
381+
return
382+
}
383+
384+
softDelete := admin.EncryptionAtRest{
385+
AwsKms: &admin.AWSKMSConfiguration{Enabled: &enabled},
386+
AzureKeyVault: &admin.AzureKeyVault{Enabled: &enabled},
387+
GoogleCloudKms: &admin.GoogleCloudKMS{Enabled: &enabled},
388+
}
389+
_, _, err = connV2.EncryptionAtRestUsingCustomerKeyManagementApi.UpdateEncryptionAtRest(ctx, projectID, &softDelete).Execute()
382390

383391
if err != nil {
384392
resp.Diagnostics.AddError("error when destroying resource", fmt.Sprintf(errorDeleteEncryptionAtRest, projectID, err.Error()))
@@ -468,110 +476,110 @@ func handleAzureKeyVaultConfigDefaults(ctx context.Context, earRSCurrent, earRSN
468476
}
469477
}
470478

471-
func newTFEncryptionAtRestRSModel(ctx context.Context, projectID string, encryptionResp *matlas.EncryptionAtRest, plan *tfEncryptionAtRestRSModel) *tfEncryptionAtRestRSModel {
479+
func newTFEncryptionAtRestRSModel(ctx context.Context, projectID string, encryptionResp *admin.EncryptionAtRest, plan *tfEncryptionAtRestRSModel) *tfEncryptionAtRestRSModel {
472480
return &tfEncryptionAtRestRSModel{
473481
ID: types.StringValue(projectID),
474482
ProjectID: types.StringValue(projectID),
475-
AwsKmsConfig: newTFAwsKmsConfig(ctx, &encryptionResp.AwsKms, plan.AwsKmsConfig),
476-
AzureKeyVaultConfig: newTFAzureKeyVaultConfig(ctx, &encryptionResp.AzureKeyVault, plan.AzureKeyVaultConfig),
477-
GoogleCloudKmsConfig: newTFGcpKmsConfig(ctx, &encryptionResp.GoogleCloudKms, plan.GoogleCloudKmsConfig),
483+
AwsKmsConfig: newTFAwsKmsConfig(ctx, encryptionResp.AwsKms, plan.AwsKmsConfig),
484+
AzureKeyVaultConfig: newTFAzureKeyVaultConfig(ctx, encryptionResp.AzureKeyVault, plan.AzureKeyVaultConfig),
485+
GoogleCloudKmsConfig: newTFGcpKmsConfig(ctx, encryptionResp.GoogleCloudKms, plan.GoogleCloudKmsConfig),
478486
}
479487
}
480488

481-
func newTFAwsKmsConfig(ctx context.Context, awsKms *matlas.AwsKms, currStateSlice []tfAwsKmsConfigModel) []tfAwsKmsConfigModel {
489+
func newTFAwsKmsConfig(ctx context.Context, awsKms *admin.AWSKMSConfiguration, currStateSlice []tfAwsKmsConfigModel) []tfAwsKmsConfigModel {
482490
if awsKms == nil {
483491
return []tfAwsKmsConfigModel{}
484492
}
485493
newState := tfAwsKmsConfigModel{}
486494

487495
newState.Enabled = types.BoolPointerValue(awsKms.Enabled)
488-
newState.CustomerMasterKeyID = types.StringValue(awsKms.CustomerMasterKeyID)
489-
newState.Region = types.StringValue(awsKms.Region)
490-
newState.AccessKeyID = conversion.StringNullIfEmpty(awsKms.AccessKeyID)
491-
newState.SecretAccessKey = conversion.StringNullIfEmpty(awsKms.SecretAccessKey)
492-
newState.RoleID = conversion.StringNullIfEmpty(awsKms.RoleID)
496+
newState.CustomerMasterKeyID = types.StringValue(awsKms.GetCustomerMasterKeyID())
497+
newState.Region = types.StringValue(awsKms.GetRegion())
498+
newState.AccessKeyID = conversion.StringNullIfEmpty(awsKms.GetAccessKeyID())
499+
newState.SecretAccessKey = conversion.StringNullIfEmpty(awsKms.GetSecretAccessKey())
500+
newState.RoleID = conversion.StringNullIfEmpty(awsKms.GetRoleId())
493501

494502
return []tfAwsKmsConfigModel{newState}
495503
}
496504

497-
func newTFAzureKeyVaultConfig(ctx context.Context, az *matlas.AzureKeyVault, currStateSlice []tfAzureKeyVaultConfigModel) []tfAzureKeyVaultConfigModel {
505+
func newTFAzureKeyVaultConfig(ctx context.Context, az *admin.AzureKeyVault, currStateSlice []tfAzureKeyVaultConfigModel) []tfAzureKeyVaultConfigModel {
498506
if az == nil {
499507
return []tfAzureKeyVaultConfigModel{}
500508
}
501509
newState := tfAzureKeyVaultConfigModel{}
502510

503511
newState.Enabled = types.BoolPointerValue(az.Enabled)
504-
newState.ClientID = types.StringValue(az.ClientID)
505-
newState.AzureEnvironment = types.StringValue(az.AzureEnvironment)
506-
newState.SubscriptionID = types.StringValue(az.SubscriptionID)
507-
newState.ResourceGroupName = types.StringValue(az.ResourceGroupName)
508-
newState.KeyVaultName = types.StringValue(az.KeyVaultName)
509-
newState.KeyIdentifier = types.StringValue(az.KeyIdentifier)
510-
newState.TenantID = types.StringValue(az.TenantID)
511-
newState.Secret = conversion.StringNullIfEmpty(az.Secret)
512+
newState.ClientID = types.StringValue(az.GetClientID())
513+
newState.AzureEnvironment = types.StringValue(az.GetAzureEnvironment())
514+
newState.SubscriptionID = types.StringValue(az.GetSubscriptionID())
515+
newState.ResourceGroupName = types.StringValue(az.GetResourceGroupName())
516+
newState.KeyVaultName = types.StringValue(az.GetKeyVaultName())
517+
newState.KeyIdentifier = types.StringValue(az.GetKeyIdentifier())
518+
newState.TenantID = types.StringValue(az.GetTenantID())
519+
newState.Secret = conversion.StringNullIfEmpty(az.GetSecret())
512520

513521
return []tfAzureKeyVaultConfigModel{newState}
514522
}
515523

516-
func newTFGcpKmsConfig(ctx context.Context, gcpKms *matlas.GoogleCloudKms, currStateSlice []tfGcpKmsConfigModel) []tfGcpKmsConfigModel {
524+
func newTFGcpKmsConfig(ctx context.Context, gcpKms *admin.GoogleCloudKMS, currStateSlice []tfGcpKmsConfigModel) []tfGcpKmsConfigModel {
517525
if gcpKms == nil {
518526
return []tfGcpKmsConfigModel{}
519527
}
520528
newState := tfGcpKmsConfigModel{}
521529

522530
newState.Enabled = types.BoolPointerValue(gcpKms.Enabled)
523-
newState.KeyVersionResourceID = types.StringValue(gcpKms.KeyVersionResourceID)
524-
newState.ServiceAccountKey = conversion.StringNullIfEmpty(gcpKms.ServiceAccountKey)
531+
newState.KeyVersionResourceID = types.StringValue(gcpKms.GetKeyVersionResourceID())
532+
newState.ServiceAccountKey = conversion.StringNullIfEmpty(gcpKms.GetServiceAccountKey())
525533

526534
return []tfGcpKmsConfigModel{newState}
527535
}
528536

529-
func newAtlasAwsKms(tfAwsKmsConfigSlice []tfAwsKmsConfigModel) *matlas.AwsKms {
537+
func newAtlasAwsKms(tfAwsKmsConfigSlice []tfAwsKmsConfigModel) *admin.AWSKMSConfiguration {
530538
if tfAwsKmsConfigSlice == nil || len(tfAwsKmsConfigSlice) < 1 {
531-
return &matlas.AwsKms{}
539+
return &admin.AWSKMSConfiguration{}
532540
}
533541
v := tfAwsKmsConfigSlice[0]
534542

535543
awsRegion, _ := conversion.ValRegion(v.Region.ValueString())
536544

537-
return &matlas.AwsKms{
545+
return &admin.AWSKMSConfiguration{
538546
Enabled: v.Enabled.ValueBoolPointer(),
539-
AccessKeyID: v.AccessKeyID.ValueString(),
540-
SecretAccessKey: v.SecretAccessKey.ValueString(),
541-
CustomerMasterKeyID: v.CustomerMasterKeyID.ValueString(),
542-
Region: awsRegion,
543-
RoleID: v.RoleID.ValueString(),
547+
AccessKeyID: v.AccessKeyID.ValueStringPointer(),
548+
SecretAccessKey: v.SecretAccessKey.ValueStringPointer(),
549+
CustomerMasterKeyID: v.CustomerMasterKeyID.ValueStringPointer(),
550+
Region: conversion.StringPtr(awsRegion),
551+
RoleId: v.RoleID.ValueStringPointer(),
544552
}
545553
}
546554

547-
func newAtlasGcpKms(tfGcpKmsConfigSlice []tfGcpKmsConfigModel) *matlas.GoogleCloudKms {
555+
func newAtlasGcpKms(tfGcpKmsConfigSlice []tfGcpKmsConfigModel) *admin.GoogleCloudKMS {
548556
if tfGcpKmsConfigSlice == nil || len(tfGcpKmsConfigSlice) < 1 {
549-
return &matlas.GoogleCloudKms{}
557+
return &admin.GoogleCloudKMS{}
550558
}
551559
v := tfGcpKmsConfigSlice[0]
552560

553-
return &matlas.GoogleCloudKms{
561+
return &admin.GoogleCloudKMS{
554562
Enabled: v.Enabled.ValueBoolPointer(),
555-
ServiceAccountKey: v.ServiceAccountKey.ValueString(),
556-
KeyVersionResourceID: v.KeyVersionResourceID.ValueString(),
563+
ServiceAccountKey: v.ServiceAccountKey.ValueStringPointer(),
564+
KeyVersionResourceID: v.KeyVersionResourceID.ValueStringPointer(),
557565
}
558566
}
559567

560-
func newAtlasAzureKeyVault(tfAzKeyVaultConfigSlice []tfAzureKeyVaultConfigModel) *matlas.AzureKeyVault {
568+
func newAtlasAzureKeyVault(tfAzKeyVaultConfigSlice []tfAzureKeyVaultConfigModel) *admin.AzureKeyVault {
561569
if tfAzKeyVaultConfigSlice == nil || len(tfAzKeyVaultConfigSlice) < 1 {
562-
return &matlas.AzureKeyVault{}
570+
return &admin.AzureKeyVault{}
563571
}
564572
v := tfAzKeyVaultConfigSlice[0]
565573

566-
return &matlas.AzureKeyVault{
574+
return &admin.AzureKeyVault{
567575
Enabled: v.Enabled.ValueBoolPointer(),
568-
ClientID: v.ClientID.ValueString(),
569-
AzureEnvironment: v.AzureEnvironment.ValueString(),
570-
SubscriptionID: v.SubscriptionID.ValueString(),
571-
ResourceGroupName: v.ResourceGroupName.ValueString(),
572-
KeyVaultName: v.KeyVaultName.ValueString(),
573-
KeyIdentifier: v.KeyIdentifier.ValueString(),
574-
Secret: v.Secret.ValueString(),
575-
TenantID: v.TenantID.ValueString(),
576+
ClientID: v.ClientID.ValueStringPointer(),
577+
AzureEnvironment: v.AzureEnvironment.ValueStringPointer(),
578+
SubscriptionID: v.SubscriptionID.ValueStringPointer(),
579+
ResourceGroupName: v.ResourceGroupName.ValueStringPointer(),
580+
KeyVaultName: v.KeyVaultName.ValueStringPointer(),
581+
KeyIdentifier: v.KeyIdentifier.ValueStringPointer(),
582+
Secret: v.Secret.ValueStringPointer(),
583+
TenantID: v.TenantID.ValueStringPointer(),
576584
}
577585
}

0 commit comments

Comments
 (0)