| // Copyright (c) HashiCorp, Inc. |
| // SPDX-License-Identifier: BUSL-1.1 |
| |
| package s3 |
| |
| import ( |
| "context" |
| "encoding/base64" |
| "fmt" |
| "os" |
| "regexp" |
| "strings" |
| "time" |
| "unicode" |
| "unicode/utf8" |
| |
| "github.com/aws/aws-sdk-go-v2/aws" |
| "github.com/aws/aws-sdk-go-v2/feature/ec2/imds" |
| "github.com/aws/aws-sdk-go-v2/service/dynamodb" |
| "github.com/aws/aws-sdk-go-v2/service/s3" |
| awsbase "github.com/hashicorp/aws-sdk-go-base/v2" |
| baselogging "github.com/hashicorp/aws-sdk-go-base/v2/logging" |
| "github.com/hashicorp/aws-sdk-go-base/v2/validation" |
| "github.com/zclconf/go-cty/cty" |
| "github.com/zclconf/go-cty/cty/gocty" |
| |
| "github.com/hashicorp/terraform/internal/backend" |
| "github.com/hashicorp/terraform/internal/configs/configschema" |
| "github.com/hashicorp/terraform/internal/tfdiags" |
| "github.com/hashicorp/terraform/version" |
| ) |
| |
| func New() backend.Backend { |
| return &Backend{} |
| } |
| |
| type Backend struct { |
| awsConfig aws.Config |
| s3Client *s3.Client |
| dynClient *dynamodb.Client |
| |
| bucketName string |
| keyName string |
| serverSideEncryption bool |
| customerEncryptionKey []byte |
| acl string |
| kmsKeyID string |
| ddbTable string |
| useLockFile bool |
| workspaceKeyPrefix string |
| skipS3Checksum bool |
| } |
| |
| // ConfigSchema returns a description of the expected configuration |
| // structure for the receiving backend. |
| func (b *Backend) ConfigSchema() *configschema.Block { |
| return &configschema.Block{ |
| Attributes: map[string]*configschema.Attribute{ |
| "bucket": { |
| Type: cty.String, |
| Required: true, |
| Description: "The name of the S3 bucket", |
| }, |
| "key": { |
| Type: cty.String, |
| Required: true, |
| Description: "The path to the state file inside the bucket", |
| }, |
| "region": { |
| Type: cty.String, |
| Optional: true, |
| Description: "AWS region of the S3 Bucket and DynamoDB Table (if used).", |
| }, |
| "allowed_account_ids": { |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "List of allowed AWS account IDs.", |
| }, |
| "dynamodb_endpoint": { |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the DynamoDB API", |
| Deprecated: true, |
| }, |
| "ec2_metadata_service_endpoint": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Address of the EC2 metadata service (IMDS) endpoint to use.", |
| }, |
| "ec2_metadata_service_endpoint_mode": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Mode to use in communicating with the metadata service.", |
| }, |
| "endpoint": { |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the S3 API", |
| Deprecated: true, |
| }, |
| |
| "endpoints": endpointsSchema.SchemaAttribute(), |
| |
| "forbidden_account_ids": { |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "List of forbidden AWS account IDs.", |
| }, |
| "iam_endpoint": { |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the IAM API", |
| Deprecated: true, |
| }, |
| "sts_endpoint": { |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the STS API", |
| Deprecated: true, |
| }, |
| "sts_region": { |
| Type: cty.String, |
| Optional: true, |
| Description: "AWS region for STS.", |
| }, |
| "encrypt": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Whether to enable server side encryption of the state file", |
| }, |
| "acl": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Canned ACL to be applied to the state file", |
| }, |
| "access_key": { |
| Type: cty.String, |
| Optional: true, |
| Description: "AWS access key", |
| }, |
| "secret_key": { |
| Type: cty.String, |
| Optional: true, |
| Description: "AWS secret key", |
| }, |
| "kms_key_id": { |
| Type: cty.String, |
| Optional: true, |
| Description: "The ARN of a KMS Key to use for encrypting the state", |
| }, |
| "dynamodb_table": { |
| Type: cty.String, |
| Optional: true, |
| Description: "DynamoDB table for state locking and consistency", |
| Deprecated: true, |
| }, |
| "use_lockfile": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Whether to use a lockfile for locking the state file.", |
| }, |
| "profile": { |
| Type: cty.String, |
| Optional: true, |
| Description: "AWS profile name", |
| }, |
| "retry_mode": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Specifies how retries are attempted.", |
| }, |
| "shared_config_files": { |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "List of paths to shared config files", |
| }, |
| "shared_credentials_file": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Path to a shared credentials file", |
| Deprecated: true, |
| }, |
| "shared_credentials_files": { |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "List of paths to shared credentials files", |
| }, |
| "token": { |
| Type: cty.String, |
| Optional: true, |
| Description: "MFA token", |
| }, |
| "skip_credentials_validation": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Skip the credentials validation via STS API. Useful for testing and for AWS API implementations that do not have STS available.", |
| }, |
| "skip_requesting_account_id": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Skip the requesting account ID. Useful for AWS API implementations that do not have the IAM, STS API, or metadata API.", |
| }, |
| "skip_metadata_api_check": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Skip the AWS Metadata API check.", |
| }, |
| "skip_region_validation": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Skip static validation of region name.", |
| }, |
| "skip_s3_checksum": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Do not include checksum when uploading S3 Objects. Useful for some S3-Compatible APIs.", |
| }, |
| "sse_customer_key": { |
| Type: cty.String, |
| Optional: true, |
| Description: "The base64-encoded encryption key to use for server-side encryption with customer-provided keys (SSE-C).", |
| Sensitive: true, |
| }, |
| |
| "workspace_key_prefix": { |
| Type: cty.String, |
| Optional: true, |
| Description: "The prefix applied to the non-default state path inside the bucket.", |
| }, |
| |
| "force_path_style": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Enable path-style S3 URLs.", |
| Deprecated: true, |
| }, |
| |
| "use_path_style": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Enable path-style S3 URLs.", |
| }, |
| |
| "max_retries": { |
| Type: cty.Number, |
| Optional: true, |
| Description: "The maximum number of times an AWS API request is retried on retryable failure.", |
| }, |
| |
| "assume_role": assumeRoleSchema.SchemaAttribute(), |
| |
| "assume_role_with_web_identity": assumeRoleWithWebIdentitySchema.SchemaAttribute(), |
| |
| "custom_ca_bundle": { |
| Type: cty.String, |
| Optional: true, |
| Description: "File containing custom root and intermediate certificates.", |
| }, |
| |
| "http_proxy": { |
| Type: cty.String, |
| Optional: true, |
| Description: "URL of a proxy to use for HTTP requests when accessing the AWS API.", |
| }, |
| |
| "https_proxy": { |
| Type: cty.String, |
| Optional: true, |
| Description: "URL of a proxy to use for HTTPS requests when accessing the AWS API.", |
| }, |
| |
| "no_proxy": { |
| Type: cty.String, |
| Optional: true, |
| Description: "Comma-separated list of hosts that should not use HTTP or HTTPS proxies.", |
| }, |
| |
| "insecure": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Whether to explicitly allow the backend to perform insecure SSL requests.", |
| }, |
| "use_fips_endpoint": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Force the backend to resolve endpoints with FIPS capability.", |
| }, |
| "use_dualstack_endpoint": { |
| Type: cty.Bool, |
| Optional: true, |
| Description: "Force the backend to resolve endpoints with DualStack capability.", |
| }, |
| }, |
| } |
| } |
| |
| var assumeRoleSchema = singleNestedAttribute{ |
| Attributes: map[string]schemaAttribute{ |
| "role_arn": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Required: true, |
| Description: "The role to be assumed.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| validateARN( |
| validateIAMRoleARN, |
| ), |
| }, |
| }, |
| }, |
| |
| "duration": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "The duration, between 15 minutes and 12 hours, of the role session. Valid time units are ns, us (or µs), ms, s, h, or m.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateDuration( |
| validateDurationBetween(15*time.Minute, 12*time.Hour), |
| ), |
| }, |
| }, |
| }, |
| |
| "external_id": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "The external ID to use when assuming the role", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLenBetween(2, 1224), |
| validateStringMatches( |
| regexp.MustCompile(`^[\w+=,.@:\/\-]*$`), |
| `Value can only contain letters, numbers, or the following characters: =,.@/-`, |
| ), |
| }, |
| }, |
| }, |
| |
| "policy": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| validateIAMPolicyDocument, |
| }, |
| }, |
| }, |
| |
| "policy_arns": setAttribute{ |
| configschema.Attribute{ |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.", |
| }, |
| validateSet{ |
| Validators: []setValidator{ |
| validateSetStringElements( |
| validateARN( |
| validateIAMPolicyARN, |
| ), |
| ), |
| }, |
| }, |
| }, |
| |
| "session_name": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "The session name to use when assuming the role.", |
| }, |
| validateString{ |
| Validators: assumeRoleNameValidator, |
| }, |
| }, |
| |
| "source_identity": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "Source identity specified by the principal assuming the role.", |
| }, |
| validateString{ |
| Validators: assumeRoleNameValidator, |
| }, |
| }, |
| |
| "tags": mapAttribute{ |
| configschema.Attribute{ |
| Type: cty.Map(cty.String), |
| Optional: true, |
| Description: "Assume role session tags.", |
| }, |
| validateMap{}, |
| }, |
| |
| "transitive_tag_keys": setAttribute{ |
| configschema.Attribute{ |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "Assume role session tag keys to pass to any subsequent sessions.", |
| }, |
| validateSet{}, |
| }, |
| }, |
| } |
| |
| var assumeRoleWithWebIdentitySchema = singleNestedAttribute{ |
| Attributes: map[string]schemaAttribute{ |
| "role_arn": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Required: true, |
| Description: "The role to be assumed.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| validateARN( |
| validateIAMRoleARN, |
| ), |
| }, |
| }, |
| }, |
| |
| "duration": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "The duration, between 15 minutes and 12 hours, of the role session. Valid time units are ns, us (or µs), ms, s, h, or m.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateDuration( |
| validateDurationBetween(15*time.Minute, 12*time.Hour), |
| ), |
| }, |
| }, |
| }, |
| |
| "policy": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| validateIAMPolicyDocument, |
| }, |
| }, |
| }, |
| |
| "policy_arns": setAttribute{ |
| configschema.Attribute{ |
| Type: cty.Set(cty.String), |
| Optional: true, |
| Description: "Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.", |
| }, |
| validateSet{ |
| Validators: []setValidator{ |
| validateSetStringElements( |
| validateARN( |
| validateIAMPolicyARN, |
| ), |
| ), |
| }, |
| }, |
| }, |
| |
| "session_name": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "The session name to use when assuming the role.", |
| }, |
| validateString{ |
| Validators: assumeRoleNameValidator, |
| }, |
| }, |
| |
| "web_identity_token": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "Value of a web identity token from an OpenID Connect (OIDC) or OAuth provider.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLenBetween(4, 20000), |
| }, |
| }, |
| }, |
| |
| "web_identity_token_file": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "File containing a web identity token from an OpenID Connect (OIDC) or OAuth provider.", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLenBetween(4, 20000), |
| }, |
| }, |
| }, |
| }, |
| validateObject: validateObject{ |
| Validators: []objectValidator{ |
| validateExactlyOneOfAttributes( |
| cty.GetAttrPath("web_identity_token"), |
| cty.GetAttrPath("web_identity_token_file"), |
| ), |
| }, |
| }, |
| } |
| |
| var endpointsSchema = singleNestedAttribute{ |
| Attributes: map[string]schemaAttribute{ |
| "dynamodb": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the DynamoDB API", |
| Deprecated: true, |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLegacyURL, |
| }, |
| }, |
| }, |
| |
| "iam": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the IAM API", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLegacyURL, |
| }, |
| }, |
| }, |
| |
| "s3": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the S3 API", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLegacyURL, |
| }, |
| }, |
| }, |
| |
| "sso": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the IAM Identity Center (formerly known as SSO) API", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringValidURL, |
| }, |
| }, |
| }, |
| |
| "sts": stringAttribute{ |
| configschema.Attribute{ |
| Type: cty.String, |
| Optional: true, |
| Description: "A custom endpoint for the STS API", |
| }, |
| validateString{ |
| Validators: []stringValidator{ |
| validateStringLegacyURL, |
| }, |
| }, |
| }, |
| }, |
| } |
| |
| // PrepareConfig checks the validity of the values in the given |
| // configuration, and inserts any missing defaults, assuming that its |
| // structure has already been validated per the schema returned by |
| // ConfigSchema. |
| func (b *Backend) PrepareConfig(obj cty.Value) (cty.Value, tfdiags.Diagnostics) { |
| var diags tfdiags.Diagnostics |
| if obj.IsNull() { |
| return obj, diags |
| } |
| |
| var attrPath cty.Path |
| |
| attrPath = cty.GetAttrPath("bucket") |
| if val := obj.GetAttr("bucket"); val.IsNull() { |
| diags = diags.Append(requiredAttributeErrDiag(attrPath)) |
| } else { |
| bucketValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| }, |
| } |
| bucketValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| attrPath = cty.GetAttrPath("key") |
| if val := obj.GetAttr("key"); val.IsNull() { |
| diags = diags.Append(requiredAttributeErrDiag(attrPath)) |
| } else { |
| keyValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringNotEmpty, |
| validateStringS3Path, |
| validateStringDoesNotContain("//"), |
| }, |
| } |
| keyValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| // Not updating region handling, because validation will be handled by `aws-sdk-go-base` once it is updated |
| if val := obj.GetAttr("region"); val.IsNull() || val.AsString() == "" { |
| if os.Getenv("AWS_REGION") == "" && os.Getenv("AWS_DEFAULT_REGION") == "" { |
| diags = diags.Append(tfdiags.AttributeValue( |
| tfdiags.Error, |
| "Missing region value", |
| `The "region" attribute or the "AWS_REGION" or "AWS_DEFAULT_REGION" environment variables must be set.`, |
| cty.GetAttrPath("region"), |
| )) |
| } |
| } |
| |
| validateAttributesConflict( |
| cty.GetAttrPath("kms_key_id"), |
| cty.GetAttrPath("sse_customer_key"), |
| )(obj, cty.Path{}, &diags) |
| |
| attrPath = cty.GetAttrPath("kms_key_id") |
| if val := obj.GetAttr("kms_key_id"); !val.IsNull() { |
| kmsKeyIDValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringKMSKey, |
| }, |
| } |
| kmsKeyIDValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| attrPath = cty.GetAttrPath("workspace_key_prefix") |
| if val := obj.GetAttr("workspace_key_prefix"); !val.IsNull() { |
| keyPrefixValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringS3Path, |
| }, |
| } |
| keyPrefixValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| if val := obj.GetAttr("assume_role"); !val.IsNull() { |
| validateNestedAttribute(assumeRoleSchema, val, cty.GetAttrPath("assume_role"), &diags) |
| } |
| |
| if val := obj.GetAttr("assume_role_with_web_identity"); !val.IsNull() { |
| validateNestedAttribute(assumeRoleWithWebIdentitySchema, val, cty.GetAttrPath("assume_role_with_web_identity"), &diags) |
| } |
| |
| validateAttributesConflict( |
| cty.GetAttrPath("shared_credentials_file"), |
| cty.GetAttrPath("shared_credentials_files"), |
| )(obj, cty.Path{}, &diags) |
| |
| attrPath = cty.GetAttrPath("shared_credentials_file") |
| if val := obj.GetAttr("shared_credentials_file"); !val.IsNull() { |
| diags = diags.Append(deprecatedAttrDiag(attrPath, cty.GetAttrPath("shared_credentials_files"))) |
| } |
| |
| attrPath = cty.GetAttrPath("dynamodb_table") |
| if val := obj.GetAttr("dynamodb_table"); !val.IsNull() { |
| diags = diags.Append(deprecatedAttrDiag(attrPath, cty.GetAttrPath("use_lockfile"))) |
| } |
| |
| endpointFields := map[string]string{ |
| "dynamodb_endpoint": "dynamodb", |
| "iam_endpoint": "iam", |
| "endpoint": "s3", |
| "sts_endpoint": "sts", |
| } |
| endpoints := make(map[string]string) |
| if val := obj.GetAttr("endpoints"); !val.IsNull() { |
| for _, k := range []string{"dynamodb", "iam", "s3", "sts"} { |
| if v := val.GetAttr(k); !v.IsNull() { |
| endpoints[k] = v.AsString() |
| } |
| } |
| } |
| for k, v := range endpointFields { |
| if val := obj.GetAttr(k); !val.IsNull() { |
| diags = diags.Append(deprecatedAttrDiag(cty.GetAttrPath(k), cty.GetAttrPath("endpoints").GetAttr(v))) |
| if _, ok := endpoints[v]; ok { |
| diags = diags.Append(wholeBodyErrDiag( |
| "Conflicting Parameters", |
| fmt.Sprintf(`The parameters "%s" and "%s" cannot be configured together.`, |
| pathString(cty.GetAttrPath(k)), |
| pathString(cty.GetAttrPath("endpoints").GetAttr(v)), |
| ), |
| )) |
| } |
| } |
| } |
| |
| if val := obj.GetAttr("endpoints"); !val.IsNull() { |
| validateNestedAttribute(endpointsSchema, val, cty.GetAttrPath("endpoints"), &diags) |
| } |
| |
| endpointValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringLegacyURL, |
| }, |
| } |
| for k := range endpointFields { |
| if val := obj.GetAttr(k); !val.IsNull() { |
| attrPath := cty.GetAttrPath(k) |
| endpointValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| } |
| |
| if val := obj.GetAttr("ec2_metadata_service_endpoint"); !val.IsNull() { |
| attrPath := cty.GetAttrPath("ec2_metadata_service_endpoint") |
| ec2MetadataEndpointValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringValidURL, |
| }, |
| } |
| ec2MetadataEndpointValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| validateAttributesConflict( |
| cty.GetAttrPath("force_path_style"), |
| cty.GetAttrPath("use_path_style"), |
| )(obj, cty.Path{}, &diags) |
| |
| attrPath = cty.GetAttrPath("force_path_style") |
| if val := obj.GetAttr("force_path_style"); !val.IsNull() { |
| diags = diags.Append(deprecatedAttrDiag(attrPath, cty.GetAttrPath("use_path_style"))) |
| } |
| |
| attrPath = cty.GetAttrPath("retry_mode") |
| if val := obj.GetAttr("retry_mode"); !val.IsNull() { |
| retryModeValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringRetryMode, |
| }, |
| } |
| retryModeValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| attrPath = cty.GetAttrPath("ec2_metadata_service_endpoint_mode") |
| if val := obj.GetAttr("ec2_metadata_service_endpoint_mode"); !val.IsNull() { |
| endpointModeValidators := validateString{ |
| Validators: []stringValidator{ |
| validateStringInSlice(awsbase.EC2MetadataEndpointMode_Values()), |
| }, |
| } |
| endpointModeValidators.ValidateAttr(val, attrPath, &diags) |
| } |
| |
| validateAttributesConflict( |
| cty.GetAttrPath("allowed_account_ids"), |
| cty.GetAttrPath("forbidden_account_ids"), |
| )(obj, cty.Path{}, &diags) |
| |
| return obj, diags |
| } |
| |
| // Configure uses the provided configuration to set configuration fields |
| // within the backend. |
| // |
| // The given configuration is assumed to have already been validated |
| // against the schema returned by ConfigSchema and passed validation |
| // via PrepareConfig. |
| func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics { |
| ctx := context.TODO() |
| log := logger() |
| log = logWithOperation(log, operationBackendConfigure) |
| |
| var diags tfdiags.Diagnostics |
| if obj.IsNull() { |
| return diags |
| } |
| |
| var region string |
| if v, ok := stringAttrOk(obj, "region"); ok { |
| region = v |
| } |
| |
| if region != "" && !boolAttr(obj, "skip_region_validation") { |
| if err := validation.SupportedRegion(region); err != nil { |
| diags = diags.Append(tfdiags.AttributeValue( |
| tfdiags.Error, |
| "Invalid region value", |
| firstToUpper(err.Error()), |
| cty.GetAttrPath("region"), |
| )) |
| return diags |
| } |
| } |
| |
| b.bucketName = stringAttr(obj, "bucket") |
| b.keyName = stringAttr(obj, "key") |
| |
| log = log.With( |
| logKeyBucket, b.bucketName, |
| logKeyPath, b.keyName, |
| ) |
| |
| b.acl = stringAttr(obj, "acl") |
| b.workspaceKeyPrefix = stringAttrDefault(obj, "workspace_key_prefix", defaultWorkspaceKeyPrefix) |
| b.serverSideEncryption = boolAttr(obj, "encrypt") |
| b.kmsKeyID = stringAttr(obj, "kms_key_id") |
| b.ddbTable = stringAttr(obj, "dynamodb_table") |
| b.useLockFile = boolAttr(obj, "use_lockfile") |
| b.skipS3Checksum = boolAttr(obj, "skip_s3_checksum") |
| |
| if _, ok := stringAttrOk(obj, "kms_key_id"); ok { |
| if customerKey := os.Getenv("AWS_SSE_CUSTOMER_KEY"); customerKey != "" { |
| diags = diags.Append(wholeBodyErrDiag( |
| "Invalid encryption configuration", |
| encryptionKeyConflictEnvVarError, |
| )) |
| } |
| } |
| |
| if customerKey, ok := stringAttrOk(obj, "sse_customer_key"); ok { |
| if len(customerKey) != 44 { |
| diags = diags.Append(tfdiags.AttributeValue( |
| tfdiags.Error, |
| "Invalid sse_customer_key value", |
| "sse_customer_key must be 44 characters in length", |
| cty.GetAttrPath("sse_customer_key"), |
| )) |
| } else { |
| var err error |
| if b.customerEncryptionKey, err = base64.StdEncoding.DecodeString(customerKey); err != nil { |
| diags = diags.Append(tfdiags.AttributeValue( |
| tfdiags.Error, |
| "Invalid sse_customer_key value", |
| fmt.Sprintf("sse_customer_key must be base64 encoded: %s", err), |
| cty.GetAttrPath("sse_customer_key"), |
| )) |
| } |
| } |
| } else if customerKey := os.Getenv("AWS_SSE_CUSTOMER_KEY"); customerKey != "" { |
| if len(customerKey) != 44 { |
| diags = diags.Append(tfdiags.WholeContainingBody( |
| tfdiags.Error, |
| "Invalid AWS_SSE_CUSTOMER_KEY value", |
| `The environment variable "AWS_SSE_CUSTOMER_KEY" must be 44 characters in length`, |
| )) |
| } else { |
| var err error |
| if b.customerEncryptionKey, err = base64.StdEncoding.DecodeString(customerKey); err != nil { |
| diags = diags.Append(tfdiags.WholeContainingBody( |
| tfdiags.Error, |
| "Invalid AWS_SSE_CUSTOMER_KEY value", |
| fmt.Sprintf(`The environment variable "AWS_SSE_CUSTOMER_KEY" must be base64 encoded: %s`, err), |
| )) |
| } |
| } |
| } |
| |
| endpointEnvvars := map[string]string{ |
| "AWS_DYNAMODB_ENDPOINT": "AWS_ENDPOINT_URL_DYNAMODB", |
| "AWS_IAM_ENDPOINT": "AWS_ENDPOINT_URL_IAM", |
| "AWS_S3_ENDPOINT": "AWS_ENDPOINT_URL_S3", |
| "AWS_STS_ENDPOINT": "AWS_ENDPOINT_URL_STS", |
| "AWS_METADATA_URL": "AWS_EC2_METADATA_SERVICE_ENDPOINT", |
| } |
| for envvar, replacement := range endpointEnvvars { |
| if val := os.Getenv(envvar); val != "" { |
| diags = diags.Append(deprecatedEnvVarDiag(envvar, replacement)) |
| } |
| } |
| |
| ctx, baselog := baselogging.NewHcLogger(ctx, log) |
| |
| cfg := &awsbase.Config{ |
| AccessKey: stringAttr(obj, "access_key"), |
| APNInfo: stdUserAgentProducts(), |
| CallerDocumentationURL: "https://developer.hashicorp.com/terraform/language/backend/s3", |
| CallerName: "S3 Backend", |
| Logger: baselog, |
| MaxRetries: intAttrDefault(obj, "max_retries", 5), |
| Profile: stringAttr(obj, "profile"), |
| HTTPProxyMode: awsbase.HTTPProxyModeLegacy, |
| Region: stringAttr(obj, "region"), |
| SecretKey: stringAttr(obj, "secret_key"), |
| SkipCredsValidation: boolAttr(obj, "skip_credentials_validation"), |
| SkipRequestingAccountId: boolAttr(obj, "skip_requesting_account_id"), |
| Token: stringAttr(obj, "token"), |
| } |
| |
| if val, ok := boolAttrOk(obj, "skip_metadata_api_check"); ok { |
| if val { |
| cfg.EC2MetadataServiceEnableState = imds.ClientDisabled |
| } else { |
| cfg.EC2MetadataServiceEnableState = imds.ClientEnabled |
| } |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("ec2_metadata_service_endpoint")), |
| newEnvvarRetriever("AWS_EC2_METADATA_SERVICE_ENDPOINT"), |
| newEnvvarRetriever("AWS_METADATA_URL"), |
| ); ok { |
| cfg.EC2MetadataServiceEndpoint = v |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("ec2_metadata_service_endpoint_mode")), |
| newEnvvarRetriever("AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE"), |
| ); ok { |
| cfg.EC2MetadataServiceEndpointMode = v |
| } |
| |
| if val, ok := stringAttrOk(obj, "shared_credentials_file"); ok { |
| cfg.SharedCredentialsFiles = []string{ |
| val, |
| } |
| } |
| if val, ok := stringSetAttrDefaultEnvVarOk(obj, "shared_credentials_files", "AWS_SHARED_CREDENTIALS_FILE"); ok { |
| cfg.SharedCredentialsFiles = val |
| } |
| if val, ok := stringSetAttrDefaultEnvVarOk(obj, "shared_config_files", "AWS_SHARED_CONFIG_FILE"); ok { |
| cfg.SharedConfigFiles = val |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("custom_ca_bundle")), |
| newEnvvarRetriever("AWS_CA_BUNDLE"), |
| ); ok { |
| cfg.CustomCABundle = v |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoints").GetAttr("iam")), |
| newAttributeRetriever(obj, cty.GetAttrPath("iam_endpoint")), |
| newEnvvarRetriever("AWS_ENDPOINT_URL_IAM"), |
| newEnvvarRetriever("AWS_IAM_ENDPOINT"), |
| ); ok { |
| cfg.IamEndpoint = v |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoints").GetAttr("sso")), |
| newEnvvarRetriever("AWS_ENDPOINT_URL_SSO"), |
| ); ok { |
| cfg.SsoEndpoint = v |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoints").GetAttr("sts")), |
| newAttributeRetriever(obj, cty.GetAttrPath("sts_endpoint")), |
| newEnvvarRetriever("AWS_ENDPOINT_URL_STS"), |
| newEnvvarRetriever("AWS_STS_ENDPOINT"), |
| ); ok { |
| cfg.StsEndpoint = v |
| } |
| |
| if v, ok := retrieveArgument(&diags, newAttributeRetriever(obj, cty.GetAttrPath("sts_region"))); ok { |
| cfg.StsRegion = v |
| } |
| |
| if assumeRole := obj.GetAttr("assume_role"); !assumeRole.IsNull() { |
| ar := awsbase.AssumeRole{} |
| if val, ok := stringAttrOk(assumeRole, "role_arn"); ok { |
| ar.RoleARN = val |
| } |
| if val, ok := stringAttrOk(assumeRole, "duration"); ok { |
| duration, _ := time.ParseDuration(val) |
| ar.Duration = duration |
| } |
| if val, ok := stringAttrOk(assumeRole, "external_id"); ok { |
| ar.ExternalID = val |
| } |
| if val, ok := stringAttrOk(assumeRole, "policy"); ok { |
| ar.Policy = strings.TrimSpace(val) |
| } |
| if val, ok := stringSetAttrOk(assumeRole, "policy_arns"); ok { |
| ar.PolicyARNs = val |
| } |
| if val, ok := stringAttrOk(assumeRole, "session_name"); ok { |
| ar.SessionName = val |
| } |
| if val, ok := stringAttrOk(assumeRole, "source_identity"); ok { |
| ar.SourceIdentity = val |
| } |
| if val, ok := stringMapAttrOk(assumeRole, "tags"); ok { |
| ar.Tags = val |
| } |
| if val, ok := stringSetAttrOk(assumeRole, "transitive_tag_keys"); ok { |
| ar.TransitiveTagKeys = val |
| } |
| cfg.AssumeRole = []awsbase.AssumeRole{ar} |
| } |
| |
| if assumeRoleWithWebIdentity := obj.GetAttr("assume_role_with_web_identity"); !assumeRoleWithWebIdentity.IsNull() { |
| ar := &awsbase.AssumeRoleWithWebIdentity{} |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "role_arn"); ok { |
| ar.RoleARN = val |
| } |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "duration"); ok { |
| duration, _ := time.ParseDuration(val) |
| ar.Duration = duration |
| } |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "policy"); ok { |
| ar.Policy = strings.TrimSpace(val) |
| } |
| if val, ok := stringSetAttrOk(assumeRoleWithWebIdentity, "policy_arns"); ok { |
| ar.PolicyARNs = val |
| } |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "session_name"); ok { |
| ar.SessionName = val |
| } |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "web_identity_token"); ok { |
| ar.WebIdentityToken = val |
| } |
| if val, ok := stringAttrOk(assumeRoleWithWebIdentity, "web_identity_token_file"); ok { |
| ar.WebIdentityTokenFile = val |
| } |
| cfg.AssumeRoleWithWebIdentity = ar |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("http_proxy")), |
| ); ok { |
| cfg.HTTPProxy = aws.String(v) |
| } |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("https_proxy")), |
| ); ok { |
| cfg.HTTPSProxy = aws.String(v) |
| } |
| if val, ok := stringAttrOk(obj, "no_proxy"); ok { |
| cfg.NoProxy = val |
| } |
| |
| if val, ok := boolAttrOk(obj, "insecure"); ok { |
| cfg.Insecure = val |
| } |
| if val, ok := boolAttrDefaultEnvVarOk(obj, "use_fips_endpoint", "AWS_USE_FIPS_ENDPOINT"); ok { |
| cfg.UseFIPSEndpoint = val |
| } |
| if val, ok := boolAttrDefaultEnvVarOk(obj, "use_dualstack_endpoint", "AWS_USE_DUALSTACK_ENDPOINT"); ok { |
| cfg.UseDualStackEndpoint = val |
| } |
| |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("retry_mode")), |
| newEnvvarRetriever("AWS_RETRY_MODE"), |
| ); ok { |
| cfg.RetryMode = aws.RetryMode(v) |
| } |
| |
| if val, ok := stringSetAttrOk(obj, "allowed_account_ids"); ok { |
| cfg.AllowedAccountIds = val |
| } |
| if val, ok := stringSetAttrOk(obj, "forbidden_account_ids"); ok { |
| cfg.ForbiddenAccountIds = val |
| } |
| |
| _ /* ctx */, awsConfig, cfgDiags := awsbase.GetAwsConfig(ctx, cfg) |
| for _, d := range cfgDiags { |
| diags = diags.Append(tfdiags.Sourceless( |
| baseSeverityToTerraformSeverity(d.Severity()), |
| d.Summary(), |
| d.Detail(), |
| )) |
| } |
| if diags.HasErrors() { |
| return diags |
| } |
| b.awsConfig = awsConfig |
| |
| accountID, _, awsDiags := awsbase.GetAwsAccountIDAndPartition(ctx, awsConfig, cfg) |
| for _, d := range awsDiags { |
| diags = append(diags, tfdiags.Sourceless( |
| baseSeverityToTerraformSeverity(d.Severity()), |
| fmt.Sprintf("Retrieving AWS account details: %s", d.Summary()), |
| d.Detail(), |
| )) |
| } |
| |
| err := cfg.VerifyAccountIDAllowed(accountID) |
| if err != nil { |
| diags = append(diags, tfdiags.Sourceless( |
| tfdiags.Error, |
| "Invalid account ID", |
| err.Error(), |
| )) |
| } |
| |
| b.dynClient = dynamodb.NewFromConfig(awsConfig, func(opts *dynamodb.Options) { |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoints").GetAttr("dynamodb")), |
| newAttributeRetriever(obj, cty.GetAttrPath("dynamodb_endpoint")), |
| newEnvvarRetriever("AWS_ENDPOINT_URL_DYNAMODB"), |
| newEnvvarRetriever("AWS_DYNAMODB_ENDPOINT"), |
| ); ok { |
| opts.EndpointResolver = dynamodb.EndpointResolverFromURL(v) //nolint:staticcheck // The replacement is not documented yet (2023/08/03) |
| } |
| }) |
| |
| b.s3Client = s3.NewFromConfig(awsConfig, s3.WithAPIOptions(addS3WrongRegionErrorMiddleware), |
| func(opts *s3.Options) { |
| if v, ok := retrieveArgument(&diags, |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoints").GetAttr("s3")), |
| newAttributeRetriever(obj, cty.GetAttrPath("endpoint")), |
| newEnvvarRetriever("AWS_ENDPOINT_URL_S3"), |
| newEnvvarRetriever("AWS_S3_ENDPOINT"), |
| ); ok { |
| opts.EndpointResolver = s3.EndpointResolverFromURL(v) //nolint:staticcheck // The replacement is not documented yet (2023/08/03) |
| } |
| if v, ok := boolAttrOk(obj, "force_path_style"); ok { // deprecated |
| opts.UsePathStyle = v |
| } |
| if v, ok := boolAttrOk(obj, "use_path_style"); ok { |
| opts.UsePathStyle = v |
| } |
| }) |
| |
| return diags |
| } |
| |
| func stdUserAgentProducts() *awsbase.APNInfo { |
| return &awsbase.APNInfo{ |
| PartnerName: "HashiCorp", |
| Products: []awsbase.UserAgentProduct{ |
| {Name: "Terraform", Version: version.String(), Comment: "+https://www.terraform.io"}, |
| }, |
| } |
| } |
| |
| type argumentRetriever interface { |
| Retrieve(diags *tfdiags.Diagnostics) (string, bool) |
| } |
| |
| type attributeRetriever struct { |
| obj cty.Value |
| objPath cty.Path |
| attrPath cty.Path |
| } |
| |
| var _ argumentRetriever = attributeRetriever{} |
| |
| func newAttributeRetriever(obj cty.Value, attrPath cty.Path) attributeRetriever { |
| return attributeRetriever{ |
| obj: obj, |
| objPath: cty.Path{}, // Assumes that we're working relative to the root object |
| attrPath: attrPath, |
| } |
| } |
| |
| func (r attributeRetriever) Retrieve(diags *tfdiags.Diagnostics) (string, bool) { |
| val, err := pathSafeApply(r.attrPath, r.obj) |
| if err != nil { |
| *diags = diags.Append(attributeErrDiag( |
| "Invalid Path for Schema", |
| "The S3 Backend unexpectedly provided a path that does not match the schema. "+ |
| "Please report this to the developers.\n\n"+ |
| "Path: "+pathString(r.attrPath)+"\n\n"+ |
| "Error: "+err.Error(), |
| r.objPath, |
| )) |
| } |
| return stringValueOk(val) |
| } |
| |
| // pathSafeApply applies a `cty.Path` to a `cty.Value`. |
| // Unlike `path.Apply`, it does not return an error if it encounters a Null value |
| func pathSafeApply(path cty.Path, obj cty.Value) (cty.Value, error) { |
| if obj == cty.NilVal || obj.IsNull() { |
| return obj, nil |
| } |
| val := obj |
| var err error |
| for _, step := range path { |
| val, err = step.Apply(val) |
| if err != nil { |
| return cty.NilVal, err |
| } |
| if val == cty.NilVal || val.IsNull() { |
| return val, nil |
| } |
| } |
| return val, nil |
| } |
| |
| type envvarRetriever struct { |
| name string |
| } |
| |
| var _ argumentRetriever = envvarRetriever{} |
| |
| func newEnvvarRetriever(name string) envvarRetriever { |
| return envvarRetriever{ |
| name: name, |
| } |
| } |
| |
| func (r envvarRetriever) Retrieve(_ *tfdiags.Diagnostics) (string, bool) { |
| if v := os.Getenv(r.name); v != "" { |
| return v, true |
| } |
| return "", false |
| } |
| |
| func retrieveArgument(diags *tfdiags.Diagnostics, retrievers ...argumentRetriever) (string, bool) { |
| for _, retriever := range retrievers { |
| if v, ok := retriever.Retrieve(diags); ok { |
| return v, true |
| } |
| } |
| return "", false |
| } |
| |
| func stringValue(val cty.Value) string { |
| v, _ := stringValueOk(val) |
| return v |
| } |
| |
| func stringValueOk(val cty.Value) (string, bool) { |
| if val.IsNull() { |
| return "", false |
| } else { |
| return val.AsString(), true |
| } |
| } |
| |
| func stringAttr(obj cty.Value, name string) string { |
| return stringValue(obj.GetAttr(name)) |
| } |
| |
| func stringAttrOk(obj cty.Value, name string) (string, bool) { |
| return stringValueOk(obj.GetAttr(name)) |
| } |
| |
| func stringAttrDefault(obj cty.Value, name, def string) string { |
| if v, ok := stringAttrOk(obj, name); !ok { |
| return def |
| } else { |
| return v |
| } |
| } |
| |
| func stringSetValueOk(val cty.Value) ([]string, bool) { |
| var list []string |
| typ := val.Type() |
| if !typ.IsSetType() { |
| return nil, false |
| } |
| err := gocty.FromCtyValue(val, &list) |
| if err != nil { |
| return nil, false |
| } |
| return list, true |
| } |
| |
| func stringSetAttrOk(obj cty.Value, name string) ([]string, bool) { |
| return stringSetValueOk(obj.GetAttr(name)) |
| } |
| |
| // stringSetAttrDefaultEnvVarOk checks for a configured set of strings |
| // in the provided argument name or environment variables. A configured |
| // argument takes precedent over environment variables. An environment |
| // variable is assumed to be as a single item, such as how the singular |
| // AWS_SHARED_CONFIG_FILE variable aligns with the underlying |
| // shared_config_files argument. |
| func stringSetAttrDefaultEnvVarOk(obj cty.Value, name string, envvars ...string) ([]string, bool) { |
| if v, ok := stringSetValueOk(obj.GetAttr(name)); !ok { |
| for _, envvar := range envvars { |
| if v := os.Getenv(envvar); v != "" { |
| return []string{v}, true |
| } |
| } |
| return nil, false |
| } else { |
| return v, true |
| } |
| } |
| |
| func stringMapValueOk(val cty.Value) (map[string]string, bool) { |
| var m map[string]string |
| err := gocty.FromCtyValue(val, &m) |
| if err != nil { |
| return nil, false |
| } |
| return m, true |
| } |
| |
| func stringMapAttrOk(obj cty.Value, name string) (map[string]string, bool) { |
| return stringMapValueOk(obj.GetAttr(name)) |
| } |
| |
| func boolAttr(obj cty.Value, name string) bool { |
| v, _ := boolAttrOk(obj, name) |
| return v |
| } |
| |
| func boolAttrOk(obj cty.Value, name string) (bool, bool) { |
| if val := obj.GetAttr(name); val.IsNull() { |
| return false, false |
| } else { |
| return val.True(), true |
| } |
| } |
| |
| // boolAttrDefaultEnvVarOk checks for a configured bool argument or a non-empty |
| // value in any of the provided environment variables. If any of the environment |
| // variables are non-empty, to boolean is considered true. |
| func boolAttrDefaultEnvVarOk(obj cty.Value, name string, envvars ...string) (bool, bool) { |
| if val := obj.GetAttr(name); val.IsNull() { |
| for _, envvar := range envvars { |
| if v := os.Getenv(envvar); v != "" { |
| return true, true |
| } |
| } |
| return false, false |
| } else { |
| return val.True(), true |
| } |
| } |
| |
| func intAttr(obj cty.Value, name string) int { |
| v, _ := intAttrOk(obj, name) |
| return v |
| } |
| |
| func intAttrOk(obj cty.Value, name string) (int, bool) { |
| if val := obj.GetAttr(name); val.IsNull() { |
| return 0, false |
| } else { |
| var v int |
| if err := gocty.FromCtyValue(val, &v); err != nil { |
| return 0, false |
| } |
| return v, true |
| } |
| } |
| |
| func intAttrDefault(obj cty.Value, name string, def int) int { |
| if v, ok := intAttrOk(obj, name); !ok { |
| return def |
| } else { |
| return v |
| } |
| } |
| |
| const encryptionKeyConflictEnvVarError = `Only one of "kms_key_id" and the environment variable "AWS_SSE_CUSTOMER_KEY" can be set. |
| |
| The "kms_key_id" is used for encryption with KMS-Managed Keys (SSE-KMS) |
| while "AWS_SSE_CUSTOMER_KEY" is used for encryption with customer-managed keys (SSE-C). |
| Please choose one or the other.` |
| |
| func validateNestedAttribute(objSchema schemaAttribute, obj cty.Value, objPath cty.Path, diags *tfdiags.Diagnostics) { |
| if obj.IsNull() { |
| return |
| } |
| |
| na, ok := objSchema.(singleNestedAttribute) |
| if !ok { |
| return |
| } |
| |
| validator := objSchema.Validator() |
| validator.ValidateAttr(obj, objPath, diags) |
| |
| for name, attrSchema := range na.Attributes { |
| attrPath := objPath.GetAttr(name) |
| attrVal := obj.GetAttr(name) |
| |
| if attrVal.IsNull() { |
| if attrSchema.SchemaAttribute().Required { |
| *diags = diags.Append(requiredAttributeErrDiag(attrPath)) |
| } |
| continue |
| } |
| |
| if a, e := attrVal.Type(), attrSchema.SchemaAttribute().Type; a != e { |
| *diags = diags.Append(attributeErrDiag( |
| "Internal Error", |
| fmt.Sprintf(`Expected type to be %s, got: %s`, e.FriendlyName(), a.FriendlyName()), |
| attrPath, |
| )) |
| continue |
| } |
| |
| if attrVal.IsNull() { |
| if attrSchema.SchemaAttribute().Required { |
| *diags = diags.Append(requiredAttributeErrDiag(attrPath)) |
| } |
| continue |
| } |
| |
| validator := attrSchema.Validator() |
| validator.ValidateAttr(attrVal, attrPath, diags) |
| } |
| } |
| |
| func requiredAttributeErrDiag(path cty.Path) tfdiags.Diagnostic { |
| return attributeErrDiag( |
| "Missing Required Value", |
| fmt.Sprintf("The attribute %q is required by the backend.\n\n", pathString(path))+ |
| "Refer to the backend documentation for additional information which attributes are required.", |
| path, |
| ) |
| } |
| |
| func pathString(path cty.Path) string { |
| var buf strings.Builder |
| for i, step := range path { |
| switch x := step.(type) { |
| case cty.GetAttrStep: |
| if i != 0 { |
| buf.WriteString(".") |
| } |
| buf.WriteString(x.Name) |
| case cty.IndexStep: |
| val := x.Key |
| typ := val.Type() |
| var s string |
| switch { |
| case typ == cty.String: |
| s = val.AsString() |
| case typ == cty.Number: |
| num := val.AsBigFloat() |
| s = num.String() |
| default: |
| s = fmt.Sprintf("<unexpected index: %s>", typ.FriendlyName()) |
| } |
| buf.WriteString(fmt.Sprintf("[%s]", s)) |
| default: |
| if i != 0 { |
| buf.WriteString(".") |
| } |
| buf.WriteString(fmt.Sprintf("<unexpected step: %[1]T %[1]v>", x)) |
| } |
| } |
| return buf.String() |
| } |
| |
| type validateSchema interface { |
| ValidateAttr(cty.Value, cty.Path, *tfdiags.Diagnostics) |
| } |
| |
| type validateString struct { |
| Validators []stringValidator |
| } |
| |
| func (v validateString) ValidateAttr(val cty.Value, attrPath cty.Path, diags *tfdiags.Diagnostics) { |
| s := val.AsString() |
| for _, validator := range v.Validators { |
| validator(s, attrPath, diags) |
| if diags.HasErrors() { |
| return |
| } |
| } |
| } |
| |
| type validateMap struct{} |
| |
| func (v validateMap) ValidateAttr(val cty.Value, attrPath cty.Path, diags *tfdiags.Diagnostics) {} |
| |
| type validateSet struct { |
| Validators []setValidator |
| } |
| |
| func (v validateSet) ValidateAttr(val cty.Value, attrPath cty.Path, diags *tfdiags.Diagnostics) { |
| for _, validator := range v.Validators { |
| validator(val, attrPath, diags) |
| if diags.HasErrors() { |
| return |
| } |
| } |
| } |
| |
| type validateObject struct { |
| Validators []objectValidator |
| } |
| |
| func (v validateObject) ValidateAttr(val cty.Value, attrPath cty.Path, diags *tfdiags.Diagnostics) { |
| for _, validator := range v.Validators { |
| validator(val, attrPath, diags) |
| } |
| } |
| |
| type schemaAttribute interface { |
| SchemaAttribute() *configschema.Attribute |
| Validator() validateSchema |
| } |
| |
| var _ schemaAttribute = stringAttribute{} |
| |
| type stringAttribute struct { |
| configschema.Attribute |
| validateString |
| } |
| |
| func (a stringAttribute) SchemaAttribute() *configschema.Attribute { |
| return &a.Attribute |
| } |
| |
| func (a stringAttribute) Validator() validateSchema { |
| return a.validateString |
| } |
| |
| var _ schemaAttribute = setAttribute{} |
| |
| type setAttribute struct { |
| configschema.Attribute |
| validateSet |
| } |
| |
| func (a setAttribute) SchemaAttribute() *configschema.Attribute { |
| return &a.Attribute |
| } |
| |
| func (a setAttribute) Validator() validateSchema { |
| return a.validateSet |
| } |
| |
| var _ schemaAttribute = mapAttribute{} |
| |
| type mapAttribute struct { |
| configschema.Attribute |
| validateMap |
| } |
| |
| func (a mapAttribute) SchemaAttribute() *configschema.Attribute { |
| return &a.Attribute |
| } |
| |
| func (a mapAttribute) Validator() validateSchema { |
| return a.validateMap |
| } |
| |
| type objectSchema map[string]schemaAttribute |
| |
| func (s objectSchema) SchemaAttributes() map[string]*configschema.Attribute { |
| m := make(map[string]*configschema.Attribute, len(s)) |
| for k, v := range s { |
| m[k] = v.SchemaAttribute() |
| } |
| return m |
| } |
| |
| var _ schemaAttribute = singleNestedAttribute{} |
| |
| type singleNestedAttribute struct { |
| Attributes objectSchema |
| Required bool |
| validateObject |
| } |
| |
| func (a singleNestedAttribute) SchemaAttribute() *configschema.Attribute { |
| return &configschema.Attribute{ |
| NestedType: &configschema.Object{ |
| Nesting: configschema.NestingSingle, |
| Attributes: a.Attributes.SchemaAttributes(), |
| }, |
| Required: a.Required, |
| Optional: !a.Required, |
| } |
| } |
| |
| func (a singleNestedAttribute) Validator() validateSchema { |
| return a.validateObject |
| } |
| |
| func deprecatedAttrDiag(attr, replacement cty.Path) tfdiags.Diagnostic { |
| return attributeWarningDiag( |
| "Deprecated Parameter", |
| fmt.Sprintf(`The parameter "%s" is deprecated. Use parameter "%s" instead.`, pathString(attr), pathString(replacement)), |
| attr, |
| ) |
| } |
| |
| func deprecatedEnvVarDiag(envvar, replacement string) tfdiags.Diagnostic { |
| return wholeBodyWarningDiag( |
| "Deprecated Environment Variable", |
| fmt.Sprintf(`The environment variable "%s" is deprecated. Use environment variable "%s" instead.`, envvar, replacement), |
| ) |
| } |
| |
| func firstToUpper(s string) string { |
| r, size := utf8.DecodeRuneInString(s) |
| if r == utf8.RuneError && size <= 1 { |
| return s |
| } |
| lc := unicode.ToUpper(r) |
| if r == lc { |
| return s |
| } |
| return string(lc) + s[size:] |
| } |
