35 Commits (03f6c650ca9e78fc0d80d430ca1ec2a52c262da4)

Author	SHA1	Message	Date
Jake Champlin	a2792f46c2	provider/aws: Fix SecurityGroupRule regression ... A security_group_rule can also be created from a `prefix_list_id`. Introduced in #11809 ``` $ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSSecurityGroupRule_PrefixListEgress' ==> Checking that code complies with gofmt requirements... go generate $(go list ./... | grep -v /terraform/vendor/) 2017/02/10 12:41:40 Generated command/internal_plugin_list.go TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSSecurityGroupRule_PrefixListEgress -timeout 120m === RUN TestAccAWSSecurityGroupRule_PrefixListEgress --- PASS: TestAccAWSSecurityGroupRule_PrefixListEgress (33.94s) PASS ok github.com/hashicorp/terraform/builtin/providers/aws 33.970s ```	9 years ago
Jake Champlin	6fa0946571	provider/aws: Fix AWS Security Group Rule Timeout ... An AWS Security Group Rule requires at least one of `cidr_blocks`, `self`, or `source_security_group_id` in order to be successfully created. If the `aws_security_group_rule` doesn't contain one of these attributes, the AWS API will still return a `200` response, and not report any error in the response. Example response from the API on a malformed submission: ``` 2017/02/08 16:04:33 [DEBUG] plugin: terraform: ----------------------------------------------------- 2017/02/08 16:04:33 [DEBUG] plugin: terraform: aws-provider (internal) 2017/02/08 16:04:33 [DEBUG] [aws-sdk-go] DEBUG: Response ec2/AuthorizeSecurityGroupIngress Details: 2017/02/08 16:04:33 [DEBUG] plugin: terraform: ---[ RESPONSE ]-------------------------------------- 2017/02/08 16:04:33 [DEBUG] plugin: terraform: HTTP/1.1 200 OK 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Connection: close 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Transfer-Encoding: chunked 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Content-Type: text/xml;charset=UTF-8 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Date: Wed, 08 Feb 2017 21:04:33 GMT 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Server: AmazonEC2 2017/02/08 16:04:33 [DEBUG] plugin: terraform: Vary: Accept-Encoding 2017/02/08 16:04:33 [DEBUG] plugin: terraform: 2017/02/08 16:04:33 [DEBUG] plugin: terraform: 102 2017/02/08 16:04:33 [DEBUG] plugin: terraform: <?xml version="1.0" encoding="UTF-8"?> 2017/02/08 16:04:33 [DEBUG] plugin: terraform: <AuthorizeSecurityGroupIngressResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/"> 2017/02/08 16:04:33 [DEBUG] plugin: terraform: <requestId>ac08c33f-8043-46d4-b637-4c4b2fc7a094</requestId> 2017/02/08 16:04:33 [DEBUG] plugin: terraform: <return>true</return> 2017/02/08 16:04:33 [DEBUG] plugin: terraform: </AuthorizeSecurityGroupIngressResponse> 2017/02/08 16:04:33 [DEBUG] plugin: terraform: 0 2017/02/08 16:04:33 [DEBUG] plugin: terraform: 2017/02/08 16:04:33 [DEBUG] plugin: terraform: 2017/02/08 16:04:33 [DEBUG] plugin: terraform: ----------------------------------------------------- ``` This previously caused Terraform to wait until the security_group_rule propagated, which never happened due to the silent failure. The changeset ensures that one of the required attributes are set prior to creating the aws_security_group_rule. Also catches the error returned from the retry function. Previously the error was ignored, and only logged at the `DEBUG` level.	9 years ago
Ninir	d126570712	provider/aws: Added a validation for security group rule types (#10864)	9 years ago
Radek Simko	2ad84a51df	provider/aws: Fix misspelled words	10 years ago
Clint	740b8bb9cb	provider/aws: Run errcheck in tests (#8579) ... * provider/aws: Add errcheck to Makefile, error on unchecked errors * more exceptions * updates for errcheck to pass * reformat and spilt out the ignore statements * narrow down ignores * fix typo, only ignore Close and Write, instead of close or write	10 years ago
Clint	4d126aaf6f	provider/aws: Fix regression in Security Group Rules with self reference (#7706) ... * provider/aws: Failing test for #7670 * provider/aws: Fix security group rule regression with self (#7670)	10 years ago
David Tolnay	db627798e6	provider/aws: Handle spurious failures in resourceAwsSecurityGroupRuleRead (#7377) ... Previously, any old HTTP error would be treated as the security_group_rule being deleted. In reality there are only a few cases where this is the right assumption.	10 years ago
stevehorsfield	03c2c4408f	Add support for 'prefix_list_ids' to AWS VPC security group rules ... Prefix list IDs are used when allowing egress to an AWS VPC Endpoint. See http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html#vpc-endpoints-routing	10 years ago
Clint	2ba1b0fb01	provider/aws: Populate self in Security Group Rule imports (#7164) ... * provider/aws: Populate self in Security Group Rule imports * provider/aws: Add regression test for SG Rule import	10 years ago
David Glasser	b3425447e5	provider/aws: fix aws_security_group_rule refresh (#6730) ... When two rules differ only in source security group, EC2 APIs return them as a single rule, but Terraform requires separate aws_security_group_rule resources. 6bdab07174 changed Read to set source_security_group_id (and cidr_blocks) from the rule returned from EC2 and chose the first source_security_group_id arbitrarily, which is wrong. Makes TestAccAWSSecurityGroupRule_PartialMatching_Source pass again. Also adds a comment noting that there is a bug in the new resource importing feature. Fixes #6728.	10 years ago
Mitchell Hashimoto	6bdab07174	providers/aws: security group import imports rules	10 years ago
Justin Nauman	7f738bebd3	provider/aws: Support eventually consistent aws_security_group_rule (#6325) ... * TF-6256 - SG Rule Retry - Preferring slower but consistent runs when AWS API calls do not properly return the SG Rule in the list of ingress/egress rules. - Testing has shown that several times that we had to exceed 20 attempts before the SG was actually returned * TF-6256 - Refactor of rule lookup - Adjusting to use resource.Retry - Extract lookup method for matching ipPermissions set	10 years ago
clint shryock	e98d7d706f	provider/aws: Convert protocols to standard format for Security Groups ... Convert network protocols to their names for keys/state, fixing issue(s) when using them interchangeably.	10 years ago
James Nugent	3adae0216c	provider/aws: Fix crash creating rules in aws SGs ... This commit uses Group Name in preference to Group ID where appropriate in the aws_security_group_rule resource. This fixes the crash reported in #5310. Fixes #5310.	10 years ago
James Nugent	69272f3113	provider/aws: error with empty list item on sg ... This addresses the case where `compact` has not been used on a list passed into security group as cidr_block. See #3786. Compact is still the correct answer there, but we should prefer returning an error to a panic. Fixes #3786.	11 years ago
clint shryock	e9cb722471	providers/aws: Fix issue recreating security group rule if it has been destroyed	11 years ago
Paul Hinze	6b6b5a43c3	provider/aws: serialize SG rule access to fix race condition ... Because `aws_security_group_rule` resources are an abstraction on top of Security Groups, they must interact with the AWS Security Group APIs in a pattern that often results in lots of parallel requests interacting with the same security group. We've found that this pattern can trigger race conditions resulting in inconsistent behavior, including: * Rules that report as created but don't actually exist on AWS's side * Rules that show up in AWS but don't register as being created locally, resulting in follow up attempts to authorize the rule failing w/ Duplicate errors Here, we introduce a per-SG mutex that must be held by any security group before it is allowed to interact with AWS APIs. This protects the space between `DescribeSecurityGroup` and `Authorize*` / `Revoke*` calls, ensuring that no other rules interact with the SG during that span. The included test exposes the race by applying a security group with lots of rules, which based on the dependency graph can all be handled in parallel. This fails most of the time without the new locking behavior. I've omitted the mutex from `Read`, since it is only called during the Refresh walk when no changes are being made, meaning a bunch of parallel `DescribeSecurityGroup` API calls should be consistent in that case.	11 years ago
Clint Shryock	9f3a17e9b4	update sg rule ids	11 years ago
Clint Shryock	03aac9f42b	Expand on an error case with more descriptive error	11 years ago
Clint Shryock	d3c5c0d85f	provider/aws: Update Security Group Rules to Version 2	11 years ago
Clint Shryock	0c2f189d08	provider/aws: Update to aws-sdk 0.9.0 rc1	11 years ago
Clint Shryock	f4fb053982	provider/aws: Fix issue in Security Group Rules where the Security Group is not found	11 years ago
Clint Shryock	579ccbefea	provider/aws: Update source to comply with upstream breaking change	11 years ago
Mitchell Hashimoto	fef5741ded	providers/aws: fix another crash case	11 years ago
Mitchell Hashimoto	b0169adf02	providers/aws: more guards against crashy cases [GH-2308]	11 years ago
Paul Hinze	e0fccf2dcc	provider/aws: fix sg rule crash ... Fixes crash in #2431 Decided that `findResourceSecurityGroup` should return an error when the SG is not found, since the callers cannot happily continue with a `nil` SG Also passes through a few error cases that were being swallowed. /cc @catsby	11 years ago
Clint Shryock	44eb55f8f6	update link to actually work	11 years ago
Clint Shryock	645a5aa55b	add warning message to explain scenario of conflicting rules	11 years ago
Clint Shryock	640836ee58	rename method, update docs	11 years ago
Clint Shryock	359826be26	clean up some conflicts with	11 years ago
Jesse Szwedko	7e0a340baf	Consider security groups with source security groups when hashing ... Previously they would conflict you had multiple security group rules with the same ingress or egress ports but different source security groups because only the CIDR blocks were considered (which are empty when using source security groups). Updated to include migrations (from clint@ctshryock.com) Signed-off-by: Clint Shryock <clint@ctshryock.com>	11 years ago
Clint Shryock	5c50ba0c2a	provider/aws: Fix SG rule self reference bug	11 years ago
Paul Hinze	b71fa3d0ae	provider/aws: handle upstream aws-sdk-go repo move ... `awslabs/aws-sdk-go => aws/aws-sdk-go` Congrats to upstream on the promotion. :)	11 years ago
Paul Hinze	31258e06c6	provider/aws: fix breakages from awserr refactor ... This landed in aws-sdk-go yesterday, breaking the AWS provider in many places: 3c259c9586 Here, with much sedding, grepping, and manual massaging, we attempt to catch Terraform up to the new `awserr.Error` interface world.	11 years ago
Clint Shryock	885efa0837	provider/aws: Add Security Group Rule as a top level resource ... - document conflict with sg rules and sg in-line rules - for this to work, ingress rules need to be computed	11 years ago