diff --git a/.changelog/38641.txt b/.changelog/38641.txt new file mode 100644 index 00000000000..9952876c979 --- /dev/null +++ b/.changelog/38641.txt @@ -0,0 +1,3 @@ +```release-note:new-resource +aws_ebs_snapshot_block_public_access +``` \ No newline at end of file diff --git a/internal/service/ec2/ebs_snapshot_block_public_access.go b/internal/service/ec2/ebs_snapshot_block_public_access.go new file mode 100644 index 00000000000..23342a0e00b --- /dev/null +++ b/internal/service/ec2/ebs_snapshot_block_public_access.go @@ -0,0 +1,91 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +package ec2 + +import ( + "context" + + "github.com/aws/aws-sdk-go-v2/service/ec2" + "github.com/aws/aws-sdk-go-v2/service/ec2/types" + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-provider-aws/internal/conns" + "github.com/hashicorp/terraform-provider-aws/internal/enum" + "github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag" + "github.com/hashicorp/terraform-provider-aws/names" +) + +// @SDKResource("aws_ebs_snapshot_block_public_access", name="EBS Snapshot Block Public Access") +func resourceEBSSnapshotBlockPublicAccess() *schema.Resource { + return &schema.Resource{ + CreateWithoutTimeout: resourceEBSSnapshotBlockPublicAccessPut, + ReadWithoutTimeout: resourceEBSSnapshotBlockPublicAccessRead, + UpdateWithoutTimeout: resourceEBSSnapshotBlockPublicAccessPut, + DeleteWithoutTimeout: resourceEBSSnapshotBlockPublicAccessDelete, + + Importer: &schema.ResourceImporter{ + StateContext: schema.ImportStatePassthroughContext, + }, + + Schema: map[string]*schema.Schema{ + names.AttrState: { + Type: schema.TypeString, + Required: true, + ValidateDiagFunc: enum.Validate[types.SnapshotBlockPublicAccessState](), + }, + }, + } +} + +func resourceEBSSnapshotBlockPublicAccessPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + var diags diag.Diagnostics + conn := meta.(*conns.AWSClient).EC2Client(ctx) + + state := d.Get(names.AttrState).(string) + input := &ec2.EnableSnapshotBlockPublicAccessInput{ + State: types.SnapshotBlockPublicAccessState(state), + } + + _, err := conn.EnableSnapshotBlockPublicAccess(ctx, input) + + if err != nil { + return sdkdiag.AppendErrorf(diags, "enabling EBS Snapshot Block Public Access (%s): %s", state, err) + } + + if d.IsNewResource() { + d.SetId(meta.(*conns.AWSClient).Region) + } + + return append(diags, resourceEBSSnapshotBlockPublicAccessRead(ctx, d, meta)...) +} + +func resourceEBSSnapshotBlockPublicAccessRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + var diags diag.Diagnostics + conn := meta.(*conns.AWSClient).EC2Client(ctx) + + input := &ec2.GetSnapshotBlockPublicAccessStateInput{} + output, err := conn.GetSnapshotBlockPublicAccessState(ctx, input) + + if err != nil { + return sdkdiag.AppendErrorf(diags, "reading EBS Snapshot Block Public Access: %s", err) + } + + d.Set(names.AttrState, output.State) + + return diags +} + +func resourceEBSSnapshotBlockPublicAccessDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + var diags diag.Diagnostics + conn := meta.(*conns.AWSClient).EC2Client(ctx) + + // Removing the resource disables blocking of EBS snapshot sharing. + _, err := conn.DisableSnapshotBlockPublicAccess(ctx, &ec2.DisableSnapshotBlockPublicAccessInput{}) + + if err != nil { + return sdkdiag.AppendErrorf(diags, "disabling EBS Snapshot Block Public Access: %s", err) + } + + return diags +} diff --git a/internal/service/ec2/ebs_snapshot_block_public_access_test.go b/internal/service/ec2/ebs_snapshot_block_public_access_test.go new file mode 100644 index 00000000000..5f7c7514271 --- /dev/null +++ b/internal/service/ec2/ebs_snapshot_block_public_access_test.go @@ -0,0 +1,75 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +package ec2_test + +import ( + "context" + "fmt" + "testing" + + "github.com/aws/aws-sdk-go-v2/service/ec2" + "github.com/aws/aws-sdk-go-v2/service/ec2/types" + "github.com/hashicorp/terraform-plugin-testing/helper/resource" + "github.com/hashicorp/terraform-plugin-testing/terraform" + "github.com/hashicorp/terraform-provider-aws/internal/acctest" + "github.com/hashicorp/terraform-provider-aws/internal/conns" + "github.com/hashicorp/terraform-provider-aws/names" +) + +func TestAccEC2EBSSnapshotBlockPublicAccess_basic(t *testing.T) { + ctx := acctest.Context(t) + resourceName := "aws_ebs_snapshot_block_public_access.test" + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acctest.PreCheck(ctx, t) }, + ErrorCheck: acctest.ErrorCheck(t, names.EC2ServiceID), + ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories, + WorkingDir: "/tmp", + CheckDestroy: testAccCheckEBSSnapshotBlockAccessDestroy(ctx), + Steps: []resource.TestStep{ + { + ResourceName: resourceName, + Config: testAccEBSSnapshotBlockPublicAccess_basic(string(types.SnapshotBlockPublicAccessStateBlockAllSharing)), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr(resourceName, names.AttrState, "block-all-sharing"), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + { + ResourceName: resourceName, + Config: testAccEBSSnapshotBlockPublicAccess_basic(string(types.SnapshotBlockPublicAccessStateBlockNewSharing)), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr(resourceName, names.AttrState, "block-new-sharing"), + ), + }, + }, + }) +} + +func testAccCheckEBSSnapshotBlockAccessDestroy(ctx context.Context) resource.TestCheckFunc { + return func(s *terraform.State) error { + conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx) + response, err := conn.GetSnapshotBlockPublicAccessState(ctx, &ec2.GetSnapshotBlockPublicAccessStateInput{}) + if err != nil { + return err + } + + if response.State != types.SnapshotBlockPublicAccessStateUnblocked { + return fmt.Errorf("EBS encryption by default is not in expected state (%s)", types.SnapshotBlockPublicAccessStateUnblocked) + } + return nil + } +} + +func testAccEBSSnapshotBlockPublicAccess_basic(state string) string { + return fmt.Sprintf(` +resource "aws_ebs_snapshot_block_public_access" "test" { + state = %[1]q +} +`, state) +} diff --git a/internal/service/ec2/service_package_gen.go b/internal/service/ec2/service_package_gen.go index 04d5d5977c8..2673423d186 100644 --- a/internal/service/ec2/service_package_gen.go +++ b/internal/service/ec2/service_package_gen.go @@ -635,6 +635,11 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka IdentifierAttribute: names.AttrID, }, }, + { + Factory: resourceEBSSnapshotBlockPublicAccess, + TypeName: "aws_ebs_snapshot_block_public_access", + Name: "EBS Snapshot Block Public Access", + }, { Factory: resourceEBSSnapshotCopy, TypeName: "aws_ebs_snapshot_copy", diff --git a/website/docs/r/ebs_snapshot_block_public_access.html.markdown b/website/docs/r/ebs_snapshot_block_public_access.html.markdown new file mode 100644 index 00000000000..c286e1645b1 --- /dev/null +++ b/website/docs/r/ebs_snapshot_block_public_access.html.markdown @@ -0,0 +1,48 @@ +--- +subcategory: "EBS (EC2)" +layout: "aws" +page_title: "AWS: aws_ebs_snapshot_block_public_access" +description: |- + Manages EBS snapshot public access block configuration. +--- + +# Resource: aws_ebs_snapshot_block_public_access + +Provides a resource to manage the state of the "Block public access for snapshots" setting on region level. + +~> **NOTE:** Removing this Terraform resource disables blocking. + +## Example Usage + +```terraform +resource "aws_ebs_snapshot_block_public_access" "example" { + state = "block-all-sharing" +} +``` + +## Argument Reference + +This resource supports the following arguments: + +* `state` - (Required) The mode in which to enable "Block public access for snapshots" for the region. Allowed values are `block-all`, `block-new-sharing`, `unblocked`. + +## Attribute Reference + +This resource exports no additional attributes. + +## Import + +In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current state. For example: + +```terraform +import { + to = aws_ebs_snapshot_block_public_access.example + id = "default" +} +``` + +Using `terraform import`, import the state. For example: + +```console +% terraform import aws_ebs_snapshot_block_public_access.example default +```