Skip to content

Commit aaa31ce

Browse files
author
Kanji Yomoda
authored
Add security role data source (#177)
* Add data-source for security role * Generate docs for security role data-source * Update CHANGELOG * Fix docs to include subcategory * Fix typo in docs * Fix conflicting constant name
1 parent f5a7a0d commit aaa31ce

File tree

8 files changed

+354
-2
lines changed

8 files changed

+354
-2
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
### Added
44
- New resource `elasticstack_elasticsearch_logstash_pipeline` to manage Logstash pipelines ([Centralized Pipeline Management](https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html)) ([#151](https://github.com/elastic/terraform-provider-elasticstack/pull/151))
5+
- Add `elasticstack_elasticsearch_security_role` data source ([#177](https://github.com/elastic/terraform-provider-elasticstack/pull/177))
56
- Add `elasticstack_elasticsearch_security_role_mapping` data source ([#178](https://github.com/elastic/terraform-provider-elasticstack/pull/178))
67

78
### Fixed

‎docs/data-sources/elasticsearch_security_role.md

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
subcategory: "Security"
3+
layout: ""
4+
page_title: "Elasticstack: elasticstack_elasticsearch_security_role Data Source"
5+
description: |-
6+
Retrieves roles in the native realm.
7+
---
8+
9+
# Data Source: elasticstack_elasticsearch_security_role
10+
11+
Use this data source to get information about an existing Elasticsearch role. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role.html
12+
13+
## Example Usage
14+
15+
```terraform
16+
provider "elasticstack" {
17+
elasticsearch {}
18+
}
19+
20+
data "elasticstack_elasticsearch_security_role" "role" {
21+
name = "testrole"
22+
}
23+
24+
output "role" {
25+
value = data.elasticstack_elasticsearch_security_role.role.name
26+
}
27+
```
28+
29+
<!-- schema generated by tfplugindocs -->
30+
## Schema
31+
32+
### Required
33+
34+
- `name` (String) The name of the role.
35+
36+
### Optional
37+
38+
- `elasticsearch_connection` (Block List, Max: 1) Used to establish connection to Elasticsearch server. Overrides environment variables if present. (see [below for nested schema](#nestedblock--elasticsearch_connection))
39+
- `run_as` (Set of String) A list of users that the owners of this role can impersonate.
40+
41+
### Read-Only
42+
43+
- `applications` (Set of Object) A list of application privilege entries. (see [below for nested schema](#nestedatt--applications))
44+
- `cluster` (Set of String) A list of cluster privileges. These privileges define the cluster level actions that users with this role are able to execute.
45+
- `global` (String) An object defining global privileges.
46+
- `id` (String) Internal identifier of the resource
47+
- `indices` (Set of Object) A list of indices permissions entries. (see [below for nested schema](#nestedatt--indices))
48+
- `metadata` (String) Optional meta-data.
49+
50+
<a id="nestedblock--elasticsearch_connection"></a>
51+
### Nested Schema for `elasticsearch_connection`
52+
53+
Optional:
54+
55+
- `api_key` (String, Sensitive) API Key to use for authentication to Elasticsearch
56+
- `ca_data` (String) PEM-encoded custom Certificate Authority certificate
57+
- `ca_file` (String) Path to a custom Certificate Authority certificate
58+
- `endpoints` (List of String, Sensitive) A list of endpoints the Terraform provider will point to. They must include the http(s) schema and port number.
59+
- `insecure` (Boolean) Disable TLS certificate validation
60+
- `password` (String, Sensitive) A password to use for API authentication to Elasticsearch.
61+
- `username` (String) A username to use for API authentication to Elasticsearch.
62+
63+
64+
<a id="nestedatt--applications"></a>
65+
### Nested Schema for `applications`
66+
67+
Read-Only:
68+
69+
- `application` (String)
70+
- `privileges` (Set of String)
71+
- `resources` (Set of String)
72+
73+
74+
<a id="nestedatt--indices"></a>
75+
### Nested Schema for `indices`
76+
77+
Read-Only:
78+
79+
- `allow_restricted_indices` (Boolean)
80+
- `field_security` (List of Object) (see [below for nested schema](#nestedobjatt--indices--field_security))
81+
- `names` (Set of String)
82+
- `privileges` (Set of String)
83+
- `query` (String)
84+
85+
<a id="nestedobjatt--indices--field_security"></a>
86+
### Nested Schema for `indices.field_security`
87+
88+
Read-Only:
89+
90+
- `except` (Set of String)
91+
- `grant` (Set of String)

‎examples/data-sources/elasticstack_elasticsearch_security_role/data-source.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "elasticstack" {
2+
elasticsearch {}
3+
}
4+
5+
data "elasticstack_elasticsearch_security_role" "role" {
6+
name = "testrole"
7+
}
8+
9+
output "role" {
10+
value = data.elasticstack_elasticsearch_security_role.role.name
11+
}

‎internal/elasticsearch/security/role_data_source.go

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
package security
2+
3+
import (
4+
"context"
5+
6+
"github.com/elastic/terraform-provider-elasticstack/internal/clients"
7+
"github.com/elastic/terraform-provider-elasticstack/internal/utils"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
9+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
10+
)
11+
12+
func DataSourceRole() *schema.Resource {
13+
roleSchema := map[string]*schema.Schema{
14+
"id": {
15+
Description: "Internal identifier of the resource",
16+
Type: schema.TypeString,
17+
Computed: true,
18+
},
19+
"name": {
20+
Description: "The name of the role.",
21+
Type: schema.TypeString,
22+
Required: true,
23+
},
24+
"applications": {
25+
Description: "A list of application privilege entries.",
26+
Type: schema.TypeSet,
27+
Computed: true,
28+
Elem: &schema.Resource{
29+
Schema: map[string]*schema.Schema{
30+
"application": {
31+
Description: "The name of the application to which this entry applies.",
32+
Type: schema.TypeString,
33+
Computed: true,
34+
},
35+
"privileges": {
36+
Description: "A list of strings, where each element is the name of an application privilege or action.",
37+
Type: schema.TypeSet,
38+
Elem: &schema.Schema{
39+
Type: schema.TypeString,
40+
},
41+
Computed: true,
42+
},
43+
"resources": {
44+
Description: "A list resources to which the privileges are applied.",
45+
Type: schema.TypeSet,
46+
Elem: &schema.Schema{
47+
Type: schema.TypeString,
48+
},
49+
Computed: true,
50+
},
51+
},
52+
},
53+
},
54+
"global": {
55+
Description: "An object defining global privileges.",
56+
Type: schema.TypeString,
57+
Computed: true,
58+
},
59+
"cluster": {
60+
Description: "A list of cluster privileges. These privileges define the cluster level actions that users with this role are able to execute.",
61+
Type: schema.TypeSet,
62+
Elem: &schema.Schema{
63+
Type: schema.TypeString,
64+
},
65+
Computed: true,
66+
},
67+
"indices": {
68+
Description: "A list of indices permissions entries.",
69+
Type: schema.TypeSet,
70+
Computed: true,
71+
Elem: &schema.Resource{
72+
Schema: map[string]*schema.Schema{
73+
"field_security": {
74+
Description: "The document fields that the owners of the role have read access to.",
75+
Type: schema.TypeList,
76+
Computed: true,
77+
Elem: &schema.Resource{
78+
Schema: map[string]*schema.Schema{
79+
"grant": {
80+
Description: "List of the fields to grant the access to.",
81+
Type: schema.TypeSet,
82+
Computed: true,
83+
Elem: &schema.Schema{
84+
Type: schema.TypeString,
85+
},
86+
},
87+
"except": {
88+
Description: "List of the fields to which the grants will not be applied.",
89+
Type: schema.TypeSet,
90+
Computed: true,
91+
Elem: &schema.Schema{
92+
Type: schema.TypeString,
93+
},
94+
},
95+
},
96+
},
97+
},
98+
"names": {
99+
Description: "A list of indices (or index name patterns) to which the permissions in this entry apply.",
100+
Type: schema.TypeSet,
101+
Computed: true,
102+
Elem: &schema.Schema{
103+
Type: schema.TypeString,
104+
},
105+
},
106+
"privileges": {
107+
Description: "The index level privileges that the owners of the role have on the specified indices.",
108+
Type: schema.TypeSet,
109+
Computed: true,
110+
Elem: &schema.Schema{
111+
Type: schema.TypeString,
112+
},
113+
},
114+
"query": {
115+
Description: "A search query that defines the documents the owners of the role have read access to.",
116+
Type: schema.TypeString,
117+
Computed: true,
118+
},
119+
"allow_restricted_indices": {
120+
Description: "Include matching restricted indices in names parameter. Usage is strongly discouraged as it can grant unrestricted operations on critical data, make the entire system unstable or leak sensitive information.",
121+
Type: schema.TypeBool,
122+
Computed: true,
123+
},
124+
},
125+
},
126+
},
127+
"metadata": {
128+
Description: "Optional meta-data.",
129+
Type: schema.TypeString,
130+
Computed: true,
131+
},
132+
"run_as": {
133+
Description: "A list of users that the owners of this role can impersonate.",
134+
Type: schema.TypeSet,
135+
Optional: true,
136+
Elem: &schema.Schema{
137+
Type: schema.TypeString,
138+
},
139+
},
140+
}
141+
142+
utils.AddConnectionSchema(roleSchema)
143+
144+
return &schema.Resource{
145+
Description: "Retrieves roles in the native realm. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role.html",
146+
ReadContext: dataSourceSecurityRoleRead,
147+
Schema: roleSchema,
148+
}
149+
}
150+
151+
func dataSourceSecurityRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
152+
client, err := clients.NewApiClient(d, meta)
153+
if err != nil {
154+
return diag.FromErr(err)
155+
}
156+
157+
roleId := d.Get("name").(string)
158+
id, diags := client.ID(ctx, roleId)
159+
if diags.HasError() {
160+
return diags
161+
}
162+
d.SetId(id.String())
163+
164+
return resourceSecurityRoleRead(ctx, d, meta)
165+
}

‎internal/elasticsearch/security/role_data_source_test.go

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
package security_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/elastic/terraform-provider-elasticstack/internal/acctest"
7+
"github.com/elastic/terraform-provider-elasticstack/internal/utils"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
9+
)
10+
11+
func TestAccDataSourceSecurityRole(t *testing.T) {
12+
resource.Test(t, resource.TestCase{
13+
PreCheck: func() { acctest.PreCheck(t) },
14+
ProviderFactories: acctest.Providers,
15+
Steps: []resource.TestStep{
16+
{
17+
Config: testAccDataSourceSecurityRole,
18+
Check: resource.ComposeTestCheckFunc(
19+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role.test", "name", "data_source_test"),
20+
resource.TestCheckTypeSetElemAttr("data.elasticstack_elasticsearch_security_role.test", "cluster.*", "all"),
21+
utils.TestCheckResourceListAttr("data.elasticstack_elasticsearch_security_role.test", "indices.0.names", []string{"index1", "index2"}),
22+
resource.TestCheckTypeSetElemAttr("data.elasticstack_elasticsearch_security_role.test", "indices.0.privileges.*", "all"),
23+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role.test", "indices.0.allow_restricted_indices", "true"),
24+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role.test", "applications.0.application", "myapp"),
25+
utils.TestCheckResourceListAttr("data.elasticstack_elasticsearch_security_role.test", "applications.0.privileges", []string{"admin", "read"}),
26+
resource.TestCheckTypeSetElemAttr("data.elasticstack_elasticsearch_security_role.test", "applications.0.resources.*", "*"),
27+
resource.TestCheckTypeSetElemAttr("data.elasticstack_elasticsearch_security_role.test", "run_as.*", "other_user"),
28+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role.test", "metadata", `{"version":1}`),
29+
),
30+
},
31+
},
32+
})
33+
}
34+
35+
const testAccDataSourceSecurityRole = `
36+
provider "elasticstack" {
37+
elasticsearch {}
38+
}
39+
40+
resource "elasticstack_elasticsearch_security_role" "test" {
41+
name = "data_source_test"
42+
cluster = ["all"]
43+
44+
indices {
45+
names = ["index1", "index2"]
46+
privileges = ["all"]
47+
allow_restricted_indices = true
48+
}
49+
50+
applications {
51+
application = "myapp"
52+
privileges = ["admin", "read"]
53+
resources = ["*"]
54+
}
55+
56+
run_as = ["other_user"]
57+
58+
metadata = jsonencode({
59+
version = 1
60+
})
61+
}
62+
63+
data "elasticstack_elasticsearch_security_role" "test" {
64+
name = elasticstack_elasticsearch_security_role.test.name
65+
}
66+
`

‎internal/elasticsearch/security/role_mapping_data_source_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ func TestAccDataSourceSecurityRoleMapping(t *testing.T) {
1414
ProviderFactories: acctest.Providers,
1515
Steps: []resource.TestStep{
1616
{
17-
Config: testAccDataSourceSecurityRole,
17+
Config: testAccDataSourceSecurityRoleMapping,
1818
Check: resource.ComposeTestCheckFunc(
1919
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "name", "data_source_test"),
2020
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "enabled", "true"),
@@ -27,7 +27,7 @@ func TestAccDataSourceSecurityRoleMapping(t *testing.T) {
2727
})
2828
}
2929

30-
const testAccDataSourceSecurityRole = `
30+
const testAccDataSourceSecurityRoleMapping = `
3131
provider "elasticstack" {
3232
elasticsearch {}
3333
}

‎provider/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ func New(version string) func() *schema.Provider {
118118
"elasticstack_elasticsearch_ingest_processor_urldecode": ingest.DataSourceProcessorUrldecode(),
119119
"elasticstack_elasticsearch_ingest_processor_uri_parts": ingest.DataSourceProcessorUriParts(),
120120
"elasticstack_elasticsearch_ingest_processor_user_agent": ingest.DataSourceProcessorUserAgent(),
121+
"elasticstack_elasticsearch_security_role": security.DataSourceRole(),
121122
"elasticstack_elasticsearch_security_role_mapping": security.DataSourceRoleMapping(),
122123
"elasticstack_elasticsearch_security_user": security.DataSourceUser(),
123124
"elasticstack_elasticsearch_snapshot_repository": cluster.DataSourceSnapshotRespository(),

‎templates/data-sources/elasticsearch_security_role.md.tmpl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
subcategory: "Security"
3+
layout: ""
4+
page_title: "Elasticstack: elasticstack_elasticsearch_security_role Data Source"
5+
description: |-
6+
Retrieves roles in the native realm.
7+
---
8+
9+
# Data Source: elasticstack_elasticsearch_security_role
10+
11+
Use this data source to get information about an existing Elasticsearch role. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role.html
12+
13+
## Example Usage
14+
15+
{{ tffile "examples/data-sources/elasticstack_elasticsearch_security_role/data-source.tf" }}
16+
17+
{{ .SchemaMarkdown | trimspace }}

0 commit comments

Comments
 (0)