refactor to support multi users

builtin/providers/aws/resource_aws_iam_group_membership.go

@@ -1,11 +1,12 @@
 package aws
 
 import (
+	"fmt"
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -17,12 +18,20 @@ func resourceAwsIamGroupMembership() *schema.Resource {
 		Delete: resourceAwsIamGroupMembershipDelete,
 
 		Schema: map[string]*schema.Schema{
-			"user_name": &schema.Schema{
+			"name": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
-			"group_name": &schema.Schema{
+
+			"users": &schema.Schema{
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+			},
+
+			"group": &schema.Schema{
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
@@ -34,44 +43,47 @@ func resourceAwsIamGroupMembership() *schema.Resource {
 func resourceAwsIamGroupMembershipCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).iamconn
 
-	_, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
-		UserName:  aws.String(d.Get("user_name").(string)),
+	group := d.Get("group").(string)
-		GroupName: aws.String(d.Get("group_name").(string)),
-	})
 
-	if err != nil {
+	for _, u := range userList {
-		return err
+		_, err := conn.AddUserToGroup(&iam.AddUserToGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
 	}
 
-	d.SetId(resource.UniqueId())
+	d.SetId(d.Get("name").(string))
 	return resourceAwsIamGroupMembershipRead(d, meta)
 }
 
 func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).iamconn
-	u := d.Get("user_name").(string)
+	resp, err := conn.GetGroup(&iam.GetGroupInput{
-	resp, err := conn.ListGroupsForUser(&iam.ListGroupsForUserInput{
+		GroupName: aws.String(d.Get("group").(string)),
-		UserName: aws.String(u),
 	})
 
 	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			// aws specific error
+			log.Printf("\n\n------\n AWS Error: %s :::: %s", awsErr.Code(), awsErr.Message())
+			// group not found
+			d.SetId("")
+		}
 		return err
 	}
 
-	d.Set("user_name", u)
+	ul := make([]string, 0, len(resp.Users))
-
+	for _, u := range resp.Users {
-	gn := d.Get("group_name").(string)
+		ul = append(ul, *u.UserName)
-	var group *iam.Group
-	for _, g := range resp.Groups {
-		if gn == *g.GroupName {
-			group = g
-		}
 	}
 
-	if group == nil {
+	if err := d.Set("users", ul); err != nil {
-		// if not found, set to ""
+		return fmt.Errorf("[WARN] Error setting user list from IAM Group Membership (%s), error: %s", err)
-		log.Printf("[DEBUG] Group (%s) not found for User (%s)", u, gn)
-		d.SetId("")
 	}
 
 	return nil
@@ -79,13 +91,18 @@ func resourceAwsIamGroupMembershipRead(d *schema.ResourceData, meta interface{})
 
 func resourceAwsIamGroupMembershipDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).iamconn
-	_, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
+	userList := expandStringList(d.Get("users").(*schema.Set).List())
-		UserName:  aws.String(d.Get("user_name").(string)),
+	group := d.Get("group").(string)
-		GroupName: aws.String(d.Get("group_name").(string)),
-	})
 
-	if err != nil {
+	for _, u := range userList {
-		return err
+		_, err := conn.RemoveUserFromGroup(&iam.RemoveUserFromGroupInput{
+			UserName:  u,
+			GroupName: aws.String(group),
+		})
+
+		if err != nil {
+			return err
+		}
 	}
 
 	d.SetId("")

builtin/providers/aws/resource_aws_iam_group_membership_test.go

@@ -30,7 +30,7 @@ func TestAccAWSGroupMembership_basic(t *testing.T) {
 }
 
 func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error {
-	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
+	conn := testAccProvider.Meta().(*AWSClient).iamconn
 
 	for _, rs := range s.RootModule().Resources {
 		if rs.Type != "aws_iam_group_membership" {
@@ -38,22 +38,17 @@ func testAccCheckAWSGroupMembershipDestroy(s *terraform.State) error {
 		}
 
 		// Try to get user
-		user := rs.Primary.Attributes["user_name"]
+		group := rs.Primary.Attributes["group"]
-		group := rs.Primary.Attributes["group_name"]
 
-		resp, err := iamconn.ListGroupsForUser(&iam.ListGroupsForUserInput{
+		_, err := conn.GetGroup(&iam.GetGroupInput{
-			UserName: aws.String(user),
+			GroupName: aws.String(group),
 		})
 		if err != nil {
 			// might error here
 			return err
 		}
 
-		for _, g := range resp.Groups {
+		return fmt.Errorf("Error: Group (%s) still exists", group)
-			if group == *g.GroupName {
-				return fmt.Errorf("Error: User (%s) is still a memeber of Group (%s)", user, group)
-			}
-		}
 
 	}
 
@@ -71,25 +66,20 @@ func testAccCheckAWSGroupMembershipExists(n string, g *iam.Group) resource.TestC
 			return fmt.Errorf("No User name is set")
 		}
 
-		iamconn := testAccProvider.Meta().(*AWSClient).iamconn
+		conn := testAccProvider.Meta().(*AWSClient).iamconn
-		user := rs.Primary.Attributes["user_name"]
+		gn := rs.Primary.Attributes["group"]
-		gn := rs.Primary.Attributes["group_name"]
 
-		resp, err := iamconn.ListGroupsForUser(&iam.ListGroupsForUserInput{
+		resp, err := conn.GetGroup(&iam.GetGroupInput{
-			UserName: aws.String(user),
+			GroupName: aws.String(gn),
 		})
+
 		if err != nil {
-			return err
+			return fmt.Errorf("Error: Group (%s) not found", gn)
 		}
 
-		for _, i := range resp.Groups {
+		*g = *resp.Group
-			if gn == *i.GroupName {
-				*g = *i
-				return nil
-			}
-		}
 
-		return fmt.Errorf("Error: User (%s) not a member of Group (%s)", user, gn)
+		return nil
 	}
 }
 
@@ -114,7 +104,8 @@ resource "aws_iam_user" "user" {
 }
 
 resource "aws_iam_group_membership" "team" {
-	user_name = "${aws_iam_user.user.name}"
+	name = "tf-testing-group-membership"
-	group_name = "${aws_iam_group.group.name}"
+	users = ["${aws_iam_user.user.name}"]
+	group = "${aws_iam_group.group.name}"
 }
 `