Skip to content

Commit 42b8bb6

Browse files
remyleoneCodelax
remyleone
and
Codelax
authored
feat(iam): add support for condition (#2674)
* feat(iam): add support for condition * update doc * update doc * markdown lint --------- Co-authored-by: Jules Casteran <[email protected]>
1 parent 120a9c1 commit 42b8bb6

File tree

5 files changed

+1701
-0
lines changed

5 files changed

+1701
-0
lines changed

‎docs/resources/iam_policy.md

+22
Original file line numberDiff line numberDiff line change
@@ -90,12 +90,34 @@ resource "scaleway_iam_policy" "iam_tf_storage_policy" {
9090
}
9191
```
9292

93+
### Create a policy with a particular condition
94+
95+
IAM policy rule can use a condition to be applied.
96+
The following variables are available:
97+
98+
- `request.ip`
99+
- `request.user_agent`
100+
- `request.time`
101+
102+
```terraform
103+
resource "scaleway_iam_policy" "main" {
104+
name = "tf_tests_policy_condition"
105+
no_principal = true
106+
rule {
107+
organization_id = "%s"
108+
permission_set_names = ["AllProductsFullAccess"]
109+
condition = "request.user_agent == 'My User Agent'"
110+
}
111+
}
112+
```
113+
93114
## Argument Reference
94115

95116
The following arguments are supported:
96117

97118
- `name` - (Optional) The name of the IAM policy.
98119
- `description` - (Optional) The description of the IAM policy.
120+
- `condition` - (Optional) The condition of the IAM policy.
99121
- `tags` - (Optional) The tags associated with the IAM policy.
100122
- `organization_id` - (Defaults to [provider](../index.md#organization_d) `organization_id`) The ID of the organization the policy is associated with.
101123
- `user_id` - ID of the user the policy will be linked to

‎internal/services/iam/policy.go

+5
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,11 @@ func ResourcePolicy() *schema.Resource {
108108
Type: schema.TypeString,
109109
},
110110
},
111+
"condition": {
112+
Type: schema.TypeString,
113+
Description: "Conditions of the policy",
114+
Optional: true,
115+
},
111116
},
112117
},
113118
},

‎internal/services/iam/policy_test.go

+94
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,100 @@ func TestAccPolicy_ProjectID(t *testing.T) {
409409
})
410410
}
411411

412+
func TestAccPolicy_Condition(t *testing.T) {
413+
tt := acctest.NewTestTools(t)
414+
defer tt.Cleanup()
415+
ctx := context.Background()
416+
project, iamAPIKey, terminateFakeSideProject, err := acctest.CreateFakeIAMManager(tt)
417+
require.NoError(t, err)
418+
419+
resource.ParallelTest(t, resource.TestCase{
420+
ProviderFactories: acctest.FakeSideProjectProviders(ctx, tt, project, iamAPIKey),
421+
CheckDestroy: resource.ComposeAggregateTestCheckFunc(
422+
func(_ *terraform.State) error {
423+
return terminateFakeSideProject()
424+
},
425+
testAccCheckIamPolicyDestroy(tt),
426+
),
427+
Steps: []resource.TestStep{
428+
{
429+
Config: fmt.Sprintf(`
430+
resource "scaleway_iam_policy" "main" {
431+
name = "tf_tests_policy_condition"
432+
description = "a description"
433+
no_principal = true
434+
rule {
435+
organization_id = "%s"
436+
permission_set_names = ["AllProductsFullAccess"]
437+
condition = "1 == 1"
438+
}
439+
provider = side
440+
}
441+
`, project.OrganizationID),
442+
Check: resource.ComposeTestCheckFunc(
443+
testAccCheckIamPolicyExists(tt, "scaleway_iam_policy.main"),
444+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "name", "tf_tests_policy_condition"),
445+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "description", "a description"),
446+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "no_principal", "true"),
447+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.organization_id", project.OrganizationID),
448+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.#", "1"),
449+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.condition", "1 == 1"),
450+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.0", "AllProductsFullAccess"),
451+
),
452+
},
453+
{
454+
Config: fmt.Sprintf(`
455+
resource "scaleway_iam_policy" "main" {
456+
name = "tf_tests_policy_condition"
457+
description = "a description"
458+
no_principal = true
459+
rule {
460+
project_ids = ["%s"]
461+
permission_set_names = ["AllProductsFullAccess"]
462+
condition = "request.user_agent == 'terraform-test'"
463+
}
464+
provider = side
465+
}
466+
`, project.OrganizationID),
467+
Check: resource.ComposeTestCheckFunc(
468+
testAccCheckIamPolicyExists(tt, "scaleway_iam_policy.main"),
469+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "name", "tf_tests_policy_condition"),
470+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "description", "a description"),
471+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "no_principal", "true"),
472+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.organization_id", ""),
473+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.#", "1"),
474+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.condition", "request.user_agent == 'terraform-test'"),
475+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.0", "AllProductsFullAccess"),
476+
),
477+
},
478+
{
479+
Config: fmt.Sprintf(`
480+
resource "scaleway_iam_policy" "main" {
481+
name = "tf_tests_policy_condition"
482+
description = "a description"
483+
no_principal = true
484+
rule {
485+
project_ids = ["%s"]
486+
permission_set_names = ["AllProductsFullAccess"]
487+
}
488+
provider = side
489+
}
490+
`, project.OrganizationID),
491+
Check: resource.ComposeTestCheckFunc(
492+
testAccCheckIamPolicyExists(tt, "scaleway_iam_policy.main"),
493+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "name", "tf_tests_policy_condition"),
494+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "description", "a description"),
495+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "no_principal", "true"),
496+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.organization_id", ""),
497+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.#", "1"),
498+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.condition", ""),
499+
resource.TestCheckResourceAttr("scaleway_iam_policy.main", "rule.0.permission_set_names.0", "AllProductsFullAccess"),
500+
),
501+
},
502+
},
503+
})
504+
}
505+
412506
func TestAccPolicy_ChangeRulePrincipal(t *testing.T) {
413507
tt := acctest.NewTestTools(t)
414508
defer tt.Cleanup()

0 commit comments

Comments
 (0)