Commit Graph

103 Commits

Author SHA1 Message Date
Brian Flad
ba081aa10a
backend/s3: Updates for Terraform v0.13.0 (#25134)
* deps: Update github.com/hashicorp/aws-sdk-go-base@v0.5.0

Updated via:

```
$ go get github.com/hashicorp/aws-sdk-go-base@v0.5.0
$ go mod tidy
$ go mod vendor
```

* backend/s3: Updates for Terraform v0.13.0

Reference: https://github.com/hashicorp/terraform/issues/13410
Reference: https://github.com/hashicorp/terraform/issues/18774
Reference: https://github.com/hashicorp/terraform/issues/19482
Reference: https://github.com/hashicorp/terraform/issues/20062
Reference: https://github.com/hashicorp/terraform/issues/20599
Reference: https://github.com/hashicorp/terraform/issues/22103
Reference: https://github.com/hashicorp/terraform/issues/22161
Reference: https://github.com/hashicorp/terraform/issues/22601
Reference: https://github.com/hashicorp/terraform/issues/22992
Reference: https://github.com/hashicorp/terraform/issues/24252
Reference: https://github.com/hashicorp/terraform/issues/24253
Reference: https://github.com/hashicorp/terraform/issues/24480
Reference: https://github.com/hashicorp/terraform/issues/25056

Changes:

```
NOTES

* backend/s3: Deprecated `lock_table`, `skip_get_ec2_platforms`, `skip_requesting_account_id` arguments have been removed
* backend/s3: Credential ordering has changed from static, environment, shared credentials, EC2 metadata, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata) to static, environment, shared credentials, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata)
* The `AWS_METADATA_TIMEOUT` environment variable no longer has any effect as we now depend on the default AWS Go SDK EC2 Metadata client timeout of one second with two retries

ENHANCEMENTS

* backend/s3: Always enable shared configuration file support (no longer require `AWS_SDK_LOAD_CONFIG` environment variable)
* backend/s3: Automatically expand `~` prefix for home directories in `shared_credentials_file` argument
* backend/s3: Add `assume_role_duration_seconds`, `assume_role_policy_arns`, `assume_role_tags`, and `assume_role_transitive_tag_keys` arguments

BUG FIXES

* backend/s3: Ensure configured profile is used
* backend/s3: Ensure configured STS endpoint is used during AssumeRole API calls
* backend/s3: Prefer AWS shared configuration over EC2 metadata credentials
* backend/s3: Prefer ECS credentials over EC2 metadata credentials
* backend/s3: Remove hardcoded AWS Provider messaging
```

Output from acceptance testing:

```
--- PASS: TestBackend (16.32s)
--- PASS: TestBackendConfig (0.58s)
--- PASS: TestBackendConfig_AssumeRole (0.02s)
--- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s)
--- PASS: TestBackendConfig_invalidKey (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s)
--- PASS: TestBackendExtraPaths (13.21s)
--- PASS: TestBackendLocked (28.98s)
--- PASS: TestBackendPrefixInWorkspace (5.65s)
--- PASS: TestBackendSSECustomerKey (17.60s)
--- PASS: TestBackend_impl (0.00s)
--- PASS: TestForceUnlock (17.50s)
--- PASS: TestKeyEnv (50.25s)
--- PASS: TestRemoteClient (4.78s)
--- PASS: TestRemoteClientLocks (16.85s)
--- PASS: TestRemoteClient_clientMD5 (12.08s)
--- PASS: TestRemoteClient_impl (0.00s)
--- PASS: TestRemoteClient_stateChecksum (17.92s)
```
2020-06-05 16:41:32 -04:00
Brian Flad
2681ccf87f
deps: github.com/aws/aws-sdk-go@v1.30.12 [master] (#24745)
* update github.com/aws/aws-sdk-go to v1.30.9

* deps: github.com/aws/aws-sdk-go@v1.30.12

Reference: https://github.com/hashicorp/terraform/issues/24710
Reference: https://github.com/hashicorp/terraform/issues/24741

Changes:

```
NOTES:

* backend/s3: Region validation now automatically supports the new `af-south-1` (Africa (Cape Town)) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`).

ENHANCEMENTS:

* backend/s3: Support automatic region validation for `af-south-1`
```

Updated via:

```console
$ go get github.com/aws/aws-sdk-go@v1.30.12
$ go mod tidy
$ go mod vendor
```

Output from acceptance testing:

```console
$ TF_ACC=1 go test -v ./backend/remote-state/s3 | grep '^--- '
--- PASS: TestBackend_impl (0.00s)
--- PASS: TestBackendConfig (1.68s)
--- PASS: TestBackendConfig_invalidKey (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s)
--- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s)
--- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s)
--- PASS: TestBackend (15.07s)
--- PASS: TestBackendLocked (26.40s)
--- PASS: TestBackendSSECustomerKey (16.99s)
--- PASS: TestBackendExtraPaths (12.05s)
--- PASS: TestBackendPrefixInWorkspace (5.55s)
--- PASS: TestKeyEnv (45.07s)
--- PASS: TestRemoteClient_impl (0.00s)
--- PASS: TestRemoteClient (5.39s)
--- PASS: TestRemoteClientLocks (14.30s)
--- PASS: TestForceUnlock (20.08s)
--- PASS: TestRemoteClient_clientMD5 (16.43s)
--- PASS: TestRemoteClient_stateChecksum (24.58s)
```

Co-authored-by: Nicola Senno <nicola.senno@workday.com>
2020-04-24 12:20:04 -04:00
Stas Alekseev
6656104f8f deps: github.com/hashicorp/aws-sdk-go-base@v0.4.0 (#22994) 2019-10-11 12:50:12 -04:00
James Bardin
01f4dd4588 update deps to match the aws provider
Update the aws-sdk-go-base and aws-sdk-go packages to ensure the same
client behavior as the aws provider.
2019-08-07 16:33:57 -04:00
Brian Flad
acf794b07f
deps: github.com/aws/aws-sdk-go@v1.21.7
Notable changes (from Terraform AWS Provider CHANGELOG):

```
NOTES:

* backend/s3: Region validation now automatically supports the new `me-south-1` Middle East (Bahrain) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [previous new region announcement blog post](https://aws.amazon.com/blogs/aws/now-open-aws-asia-pacific-hong-kong-region/). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`).
* backend/s3: After this update, the AWS Go SDK will prefer credentials found via the `AWS_PROFILE` environment variable when both the `AWS_PROFILE` environment variable and the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables are statically defined. Previously the SDK would ignore the `AWS_PROFILE` environment variable, if static environment credentials were also specified. This is listed as a bug fix in the AWS Go SDK release notes.

ENHANCEMENTS:

* backend/s3: Add support for assuming role via web identity token via the `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` environment variables
* backend/s3: Support automatic region validation for `me-south-1`

BUG FIXES:

* backend/s3: Load credentials via the `AWS_PROFILE` environment variable (if available) when `AWS_PROFILE` is defined along with `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`
```

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.21.7
go mod tidy
go mod vendor
```

Verification with this update:

```hcl
terraform {
  backend "s3" {
    bucket = "me-south-1-testing"
    key    = "test"
    region = "me-south-1"
  }
}

output "test" {
  value = timestamp()
}
```

Outputs:

```
$ terraform apply

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

test = 2019-07-30T12:49:19Z
```

If the new region is not properly enabled for the account, errors like the below will be received:

```
$ terraform init

Initializing the backend...

Error: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
```

To use this region before this update:

```hcl
terraform {
  # ... potentially other configuration ...

  backend "s3" {
    # ... other configuration ...

    region                 = "me-south-1"
    skip_region_validation = true
  }
}
```
2019-07-30 08:51:39 -04:00
ajayk
fd8aca539e update to aws-sdk-go-v1.20.19 2019-07-11 17:52:31 -07:00
ajayk
659e364d65 deps: github.com/aws/aws-sdk-go@v1.20.10 2019-06-26 20:11:49 -07:00
Brian Flad
d780cd0f1b
deps: github.com/aws/aws-sdk-go@v1.20.4
Relevant changes:

* backend/s3: Support for chaining assume IAM role from AWS shared configuration files
* backend/s3: Fix AWS shared configuration file credential source not assuming a role with environment and ECS credentials

References:

* https://github.com/aws/aws-sdk-go/releases/tag/v1.20.0
* https://github.com/aws/aws-sdk-go/pull/2579
* https://github.com/aws/aws-sdk-go/issues/2385

Updated via:

```console
$ go get github.com/aws/aws-sdk-go@v1.20.4
$ go mod tidy
$ go mod vendor
```
2019-06-20 00:04:44 -04:00
Brian Flad
f1d7196d10
deps: github.com/aws/aws-sdk-go@v1.19.18
Enables automatic validation for the new `ap-east-1` region. See also: https://github.com/terraform-providers/terraform-provider-aws/pull/8440#pullrequestreview-230896877

Updated via:

```console
$ go get github.com/aws/aws-sdk-go@v1.19.18
$ go mod tidy
$ go mod vendor
```
2019-04-25 18:01:11 -04:00
Brian Flad
1aaac172b0
backend/s3: Switch from github.com/terraform-providers/terraform-provider-aws to github.com/hashicorp/aws-sdk-go-base
Output from acceptance testing (no new failures):

```
--- PASS: TestBackend_impl (0.00s)
--- PASS: TestBackendConfig (0.37s)
--- PASS: TestBackendConfig_invalidKey (0.00s)
--- PASS: TestBackend (3.26s)
--- PASS: TestBackendLocked (6.80s)
--- FAIL: TestBackendExtraPaths (2.32s)
--- PASS: TestBackendPrefixInWorkspace (2.06s)
--- PASS: TestKeyEnv (8.20s)
--- PASS: TestRemoteClient_impl (0.00s)
--- PASS: TestRemoteClient (2.42s)
--- PASS: TestRemoteClientLocks (6.33s)
--- PASS: TestForceUnlock (13.31s)
--- PASS: TestRemoteClient_clientMD5 (11.75s)
--- PASS: TestRemoteClient_stateChecksum (10.07s)
```
2019-02-18 02:30:30 -05:00
Radek Simko
a486cd838e
vendor: github.com/terraform-providers/terraform-provider-aws@v1.58.0 2019-02-12 16:32:22 +00:00
Brian Flad
2979c42c68
deps: github.com/aws/aws-sdk-go@v1.16.4 and github.com/terraform-providers/terraform-provider-aws@v1.52.0
Notable changes:

* backend/s3: Automatic validation of `eu-north-1` region
* backend/s3: Support for `credential_process` handling in AWS configuration file

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.16.4
go get github.com/terraform-providers/terraform-provider-aws@v1.52.0
go mod tidy
go mod vendor
```
2018-12-13 20:30:43 -05:00
Brian Flad
2c59de064b
deps: terraform-providers/terraform-provider-aws@v1.41.0 and aws/aws-sdk-go@v1.15.55
Provides the ability for the S3 backend to read `credential_source` via AWS configuration file.
2018-10-24 21:14:30 -07:00
Martin Atkins
fd77765154 vendor: make some transitive dependencies line up better
After a bunch of recent changes/rebasing our vendored dependencies got a
little out of sync w.r.t transitive dependencies through codebases that
are not themselves Go Modules yet.
2018-10-16 19:14:54 -07:00
Martin Atkins
1bb79696c6 vendor: update to latest github.com/zclconf/go-cty
This includes a bugfix to the cty/msgpack package to ensure correct
decoding of unknown and null values.

This also includes updates to cty's dependencies.
2018-10-16 19:14:11 -07:00
Brian Flad
bbeabcc055 vendor: terraform-providers/terraform-provider-aws@v1.29.0 and aws/aws-sdk-go@v1.14.31 2018-07-30 18:07:29 -04:00
Anthony Stanton
ab6d52a9f8 Bump terraform-provider-aws and aws-sdk-go 2018-04-20 09:47:00 +02:00
Brian Flad
8ee936a068 Deps: Bump terraform-provider-aws@v1.10.0 and aws-sdk-go@v1.12.75 2018-02-24 19:52:10 -08:00
Brian Flad
74598ff9fe deps: Bump terraform-provider-aws@v1.9.0 and aws-sdk-go@v1.12.73 2018-02-13 06:26:02 -05:00
Brian Flad
b924e8cba5 deps: Bump terraform-provider-aws@v1.8.0 and aws-sdk-go@v1.12.70 2018-02-05 20:06:50 -05:00
Brian Flad
8743edc4c9 deps: Bump AWS provider to support cn-northwest-1 state 2018-01-27 03:53:29 -05:00
James Nugent
0a9608c900 deps: Bump AWS provider to add eu-west-3 for state
Also updates github.com/aws/aws-sdk-go and adds github.com/beevik/etree.

Fixes terraform-providers/terraform-provider-aws#3129.
2018-01-25 11:52:20 +00:00
Gauthier Wallet
474c592569 backend/s3: allow named credentials profiles to be used
Here we upgrade the AWS Go SDK to 1.12.27 and AWS provider to include terraform-providers/terraform-provider-aws#1608. 

This includes the capability to use named credentials profiles from the `~/.aws/credentials` file to authenticate to the backend.
2017-12-12 15:27:05 -08:00
Jake Champlin
5d4931cb2e
Update AWS SDK to match AWS provider dep 2017-09-05 09:21:07 -04:00
James Bardin
b37af119e5 govendor remove +unused
let govendor remove everything it thinks is no longer required
2017-06-12 13:43:53 -04:00
Paul Stack
7823ed8eb8 provider/aws: Bump AWS SDK to 1.8.34 (#15072) 2017-06-05 13:39:43 +03:00
Jake Champlin
baa6859bfe
provider/aws: bump sdk version 2017-05-18 08:25:22 -04:00
Jake Champlin
d05fc51aa0
provider/aws: Handle LimitExceededException for subscriber limits
- Updates aws-sdk-go/request for retryer fix
 - Fixes dynamoDB exception handling to catch subscriber limit error

When the `aws-sdk-go` dep releases the next release, we can tag the vendor with the new
release version, and merge this. Until then, soft-updated the vendor solely for the `request` package to post fix.

DynamoDB Fix:
```
aws_dynamodb_table.bar: Creating...
  arn:                       "" => "<computed>"
  attribute.#:               "" => "1"
  attribute.4228504427.name: "" => "id"
  attribute.4228504427.type: "" => "S"
  hash_key:                  "" => "id"
  name:                      "" => "over-cap-test"
  read_capacity:             "" => "5"
  stream_arn:                "" => "<computed>"
  stream_enabled:            "" => "<computed>"
  stream_view_type:          "" => "<computed>"
  write_capacity:            "" => "5"
Error applying plan:

1 error(s) occurred:

* aws_dynamodb_table.bar: 1 error(s) occurred:

* aws_dynamodb_table.bar: AWS Error creating DynamoDB table: LimitExceededException: Subscriber limit exceeded: There is a limit of 256 tables per subscriber
        status code: 400, request id: J2MC7MR060VKBPHP9P6JG5B6Q3VV4KQNSO5AEMVJF66Q9ASUAAJG
```
2017-05-17 08:59:47 -04:00
stack72
c9ef9942c6 provider/aws: Bump vendor package to 1.8.21 2017-05-11 15:14:43 +03:00
Daniel Schmidt
742da65144 provider/aws: add devicefarm sdk 2017-05-09 09:35:41 +02:00
Gareth Oakley
e4c732b34c Add support for IAMDatabaseAuthenticationEnabled 2017-04-29 20:32:21 +01:00
Paul Stack
fa9fc4bfac provider/aws: Bump AWS SDK to 1.8.16 (#13953) 2017-04-27 02:24:20 +12:00
Paul Stack
f5df4422ae provider/aws: Bump AWS SDK to 1.8.13 (#13775) 2017-04-19 20:55:37 +03:00
Gauthier Wallet
3c6287cf3c Vendored AWS CognitoIdentity Service (#13771) 2017-04-19 20:22:36 +03:00
Yusuke Goto
00dca72bde add wafregional dependencies (#13687) 2017-04-16 11:31:39 +01:00
Paul Stack
f2a2c28163 provider/aws: Bump SDK to 1.8.10 (#13459) 2017-04-07 17:26:16 +03:00
Paul Stack
98623ecaed provider/aws: Bump SDK version to 1.8.8 (#13354) 2017-04-05 08:45:27 +01:00
Clint
9b2292d5ee provider/aws: Bump aws/sdk to 1.7.9. Fixes at least 1 RDS bug (#12680) 2017-03-14 10:13:44 -05:00
Paul Stack
79736577ba provider/aws: Bump SDK to 1.7.7 (#12591)
Required for ACM and API Gateway integration
2017-03-10 19:44:21 +02:00
Paul Stack
0491638343 provider/aws: Bump SDK to 1.7.5 (#12535) 2017-03-08 21:15:05 +02:00
Paul Stack
d10ec314bf provider/aws: Bump AWS SDK to 1.7.3 (#12325)
This allows the creation of Organisations
2017-03-03 20:48:24 +02:00
Erik Jansson
62aa2c583a provider/aws: New resource codepipeline (#11814)
* provider/aws: New resource codepipeline

* Vendor aws/codepipeline

* Add tests

* Add docs

* Bump codepipeline to v1.6.25

* Adjustments based on feedback

* Force new resource on ID change

* Improve tests

* Switch update to read

Since we don't require a second pass, only do a read.

* Skip tests if GITHUB_TOKEN is not set
2017-02-22 19:31:24 +02:00
Paul Stack
8e41f57694 provider/aws: Bump SDK to 1.6.25 (#12084) 2017-02-20 19:20:36 +02:00
Paul Stack
cae76db1ba provider/aws: Bump SDK version fo 1.6.22 (#11968)
Adds support for EBS Elastic Volumes
2017-02-15 16:49:14 +00:00
Gauthier Wallet
045bb1039f Bumped AWS SDK to 1.6.20 (#11846) 2017-02-10 11:32:17 +00:00
Paul Stack
bfbd5ad4e6 provider/aws: Bump SDK version to 1.6.19 (#11775) 2017-02-08 13:02:41 +00:00
liamjbennett
281bbfc1cc
Vendor aws codebuild service 2017-02-02 16:13:51 +00:00
Jack Bruno
be56c7d2f6 provider/aws: Add AWS DMS (data migration service) resources (#11122)
* Add aws dms vendoring

* Add aws dms endpoint resource

* Add aws dms replication instance resource

* Add aws dms replication subnet group resource

* Add aws dms replication task resource

* Fix aws dms resource go vet errors

* Review fixes: Add id validators for all resources. Add validator for endpoint engine_name.

* Add aws dms resources to importability list

* Review fixes: Add aws dms iam role dependencies to test cases

* Review fixes: Adjustments for handling input values

* Add aws dms replication subnet group tagging

* Fix aws dms subnet group doesn't use standard error for resource not found

* Missed update of aws dms vendored version

* Add aws dms certificate resource

* Update aws dms resources to force new for immutable attributes

* Fix tests failing on subnet deletion by adding explicit dependencies. Combine import tests with basic tests to cut down runtime.
2017-02-02 10:30:05 +00:00
Paul Stack
5411e7d36b provider/aws: Bump SDK version to 1.6.18 (#11514) 2017-01-30 14:18:29 +00:00
Radek Simko
083f8b29cc vendor: Add github.com/aws/aws-sdk-go/service/configservice (#11408) 2017-01-25 19:50:26 +02:00