Skip to content

Commit f5a7a0d

Browse files
author
Kanji Yomoda
authored
Add security role mapping data source (#178)
* Implement role mapping data-source * Generate docs for security role mapping data-source * Update CHANGELOG * Fix docs to include subcategory
1 parent d3d700d commit f5a7a0d

File tree

7 files changed

+221
-0
lines changed

7 files changed

+221
-0
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
### Added
44
- New resource `elasticstack_elasticsearch_logstash_pipeline` to manage Logstash pipelines ([Centralized Pipeline Management](https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html)) ([#151](https://github.com/elastic/terraform-provider-elasticstack/pull/151))
5+
- Add `elasticstack_elasticsearch_security_role_mapping` data source ([#178](https://github.com/elastic/terraform-provider-elasticstack/pull/178))
56

67
### Fixed
78
- Remove unnecessary unsetting id on delete ([#174](https://github.com/elastic/terraform-provider-elasticstack/pull/174))

‎docs/data-sources/elasticsearch_security_role_mapping.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
subcategory: "Security"
3+
layout: ""
4+
page_title: "Elasticstack: elasticstack_elasticsearch_security_role_mapping Data Source"
5+
description: |-
6+
Retrieves role mappings.
7+
---
8+
9+
# Data Source: elasticstack_elasticsearch_security_role_mapping
10+
11+
Retrieves role mappings. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role-mapping.html
12+
13+
## Example Usage
14+
15+
```terraform
16+
provider "elasticstack" {
17+
elasticsearch {}
18+
}
19+
20+
data "elasticstack_elasticsearch_security_role_mapping" "mapping" {
21+
name = "my_mapping"
22+
}
23+
24+
output "user" {
25+
value = data.elasticstack_elasticsearch_security_role_mapping.mapping.name
26+
}
27+
```
28+
29+
<!-- schema generated by tfplugindocs -->
30+
## Schema
31+
32+
### Required
33+
34+
- `name` (String) The distinct name that identifies the role mapping, used solely as an identifier.
35+
36+
### Optional
37+
38+
- `elasticsearch_connection` (Block List, Max: 1) Used to establish connection to Elasticsearch server. Overrides environment variables if present. (see [below for nested schema](#nestedblock--elasticsearch_connection))
39+
40+
### Read-Only
41+
42+
- `enabled` (Boolean) Mappings that have `enabled` set to `false` are ignored when role mapping is performed.
43+
- `id` (String) Internal identifier of the resource
44+
- `metadata` (String) Additional metadata that helps define which roles are assigned to each user. Keys beginning with `_` are reserved for system usage.
45+
- `role_templates` (String) A list of mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules.
46+
- `roles` (Set of String) A list of role names that are granted to the users that match the role mapping rules.
47+
- `rules` (String) The rules that determine which users should be matched by the mapping. A rule is a logical condition that is expressed by using a JSON DSL.
48+
49+
<a id="nestedblock--elasticsearch_connection"></a>
50+
### Nested Schema for `elasticsearch_connection`
51+
52+
Optional:
53+
54+
- `api_key` (String, Sensitive) API Key to use for authentication to Elasticsearch
55+
- `ca_data` (String) PEM-encoded custom Certificate Authority certificate
56+
- `ca_file` (String) Path to a custom Certificate Authority certificate
57+
- `endpoints` (List of String, Sensitive) A list of endpoints the Terraform provider will point to. They must include the http(s) schema and port number.
58+
- `insecure` (Boolean) Disable TLS certificate validation
59+
- `password` (String, Sensitive) A password to use for API authentication to Elasticsearch.
60+
- `username` (String) A username to use for API authentication to Elasticsearch.

‎examples/data-sources/elasticstack_elasticsearch_security_role_mapping/data-source.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "elasticstack" {
2+
elasticsearch {}
3+
}
4+
5+
data "elasticstack_elasticsearch_security_role_mapping" "mapping" {
6+
name = "my_mapping"
7+
}
8+
9+
output "user" {
10+
value = data.elasticstack_elasticsearch_security_role_mapping.mapping.name
11+
}

‎internal/elasticsearch/security/role_mapping_data_source.go

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
package security
2+
3+
import (
4+
"context"
5+
6+
"github.com/elastic/terraform-provider-elasticstack/internal/clients"
7+
"github.com/elastic/terraform-provider-elasticstack/internal/utils"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
9+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
10+
)
11+
12+
func DataSourceRoleMapping() *schema.Resource {
13+
roleMappingSchema := map[string]*schema.Schema{
14+
"id": {
15+
Description: "Internal identifier of the resource",
16+
Type: schema.TypeString,
17+
Computed: true,
18+
},
19+
"name": {
20+
Type: schema.TypeString,
21+
Required: true,
22+
Description: "The distinct name that identifies the role mapping, used solely as an identifier.",
23+
},
24+
"enabled": {
25+
Type: schema.TypeBool,
26+
Computed: true,
27+
Description: "Mappings that have `enabled` set to `false` are ignored when role mapping is performed.",
28+
},
29+
"rules": {
30+
Type: schema.TypeString,
31+
Computed: true,
32+
Description: "The rules that determine which users should be matched by the mapping. A rule is a logical condition that is expressed by using a JSON DSL.",
33+
},
34+
"roles": {
35+
Type: schema.TypeSet,
36+
Elem: &schema.Schema{
37+
Type: schema.TypeString,
38+
},
39+
Computed: true,
40+
Description: "A list of role names that are granted to the users that match the role mapping rules.",
41+
},
42+
"role_templates": {
43+
Type: schema.TypeString,
44+
Computed: true,
45+
Description: "A list of mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules.",
46+
},
47+
"metadata": {
48+
Type: schema.TypeString,
49+
Computed: true,
50+
Description: "Additional metadata that helps define which roles are assigned to each user. Keys beginning with `_` are reserved for system usage.",
51+
},
52+
}
53+
54+
utils.AddConnectionSchema(roleMappingSchema)
55+
56+
return &schema.Resource{
57+
Description: "Retrieves role mappings. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role-mapping.html",
58+
ReadContext: dataSourceSecurityRoleMappingRead,
59+
Schema: roleMappingSchema,
60+
}
61+
}
62+
63+
func dataSourceSecurityRoleMappingRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
64+
client, err := clients.NewApiClient(d, meta)
65+
if err != nil {
66+
return diag.FromErr(err)
67+
}
68+
69+
roleId := d.Get("name").(string)
70+
id, diags := client.ID(ctx, roleId)
71+
if diags.HasError() {
72+
return diags
73+
}
74+
d.SetId(id.String())
75+
76+
return resourceSecurityRoleMappingRead(ctx, d, meta)
77+
}

‎internal/elasticsearch/security/role_mapping_data_source_test.go

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package security_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/elastic/terraform-provider-elasticstack/internal/acctest"
7+
"github.com/elastic/terraform-provider-elasticstack/internal/utils"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
9+
)
10+
11+
func TestAccDataSourceSecurityRoleMapping(t *testing.T) {
12+
resource.Test(t, resource.TestCase{
13+
PreCheck: func() { acctest.PreCheck(t) },
14+
ProviderFactories: acctest.Providers,
15+
Steps: []resource.TestStep{
16+
{
17+
Config: testAccDataSourceSecurityRole,
18+
Check: resource.ComposeTestCheckFunc(
19+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "name", "data_source_test"),
20+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "enabled", "true"),
21+
utils.TestCheckResourceListAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "roles", []string{"admin"}),
22+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "rules", `{"any":[{"field":{"username":"esadmin"}},{"field":{"groups":"cn=admins,dc=example,dc=com"}}]}`),
23+
resource.TestCheckResourceAttr("data.elasticstack_elasticsearch_security_role_mapping.test", "metadata", `{"version":1}`),
24+
),
25+
},
26+
},
27+
})
28+
}
29+
30+
const testAccDataSourceSecurityRole = `
31+
provider "elasticstack" {
32+
elasticsearch {}
33+
}
34+
35+
resource "elasticstack_elasticsearch_security_role_mapping" "test" {
36+
name = "data_source_test"
37+
enabled = true
38+
roles = [
39+
"admin"
40+
]
41+
rules = jsonencode({
42+
any = [
43+
{ field = { username = "esadmin" } },
44+
{ field = { groups = "cn=admins,dc=example,dc=com" } },
45+
]
46+
})
47+
48+
metadata = jsonencode({ version = 1 })
49+
}
50+
51+
data "elasticstack_elasticsearch_security_role_mapping" "test" {
52+
name = elasticstack_elasticsearch_security_role_mapping.test.name
53+
}
54+
`

‎provider/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ func New(version string) func() *schema.Provider {
118118
"elasticstack_elasticsearch_ingest_processor_urldecode": ingest.DataSourceProcessorUrldecode(),
119119
"elasticstack_elasticsearch_ingest_processor_uri_parts": ingest.DataSourceProcessorUriParts(),
120120
"elasticstack_elasticsearch_ingest_processor_user_agent": ingest.DataSourceProcessorUserAgent(),
121+
"elasticstack_elasticsearch_security_role_mapping": security.DataSourceRoleMapping(),
121122
"elasticstack_elasticsearch_security_user": security.DataSourceUser(),
122123
"elasticstack_elasticsearch_snapshot_repository": cluster.DataSourceSnapshotRespository(),
123124
},

‎templates/data-sources/elasticsearch_security_role_mapping.md.tmpl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
subcategory: "Security"
3+
layout: ""
4+
page_title: "Elasticstack: elasticstack_elasticsearch_security_role_mapping Data Source"
5+
description: |-
6+
Retrieves role mappings.
7+
---
8+
9+
# Data Source: elasticstack_elasticsearch_security_role_mapping
10+
11+
Retrieves role mappings. See, https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role-mapping.html
12+
13+
## Example Usage
14+
15+
{{ tffile "examples/data-sources/elasticstack_elasticsearch_security_role_mapping/data-source.tf" }}
16+
17+
{{ .SchemaMarkdown | trimspace }}

0 commit comments

Comments
 (0)