Skip to content

Commit 7578195

Browse files
SevenEarthSevenEarth
committed
add
1 parent cf6d504 commit 7578195

File tree

2 files changed

+217
-51
lines changed

2 files changed

+217
-51
lines changed

‎tencentcloud/provider.go

Lines changed: 132 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -233,28 +233,93 @@ func Provider() *schema.Provider {
233233
Optional: true,
234234
Description: "A more restrictive policy when making the AssumeRole call. Its content must not contains `principal` elements. Notice: more syntax references, please refer to: [policies syntax logic](https://intl.cloud.tencent.com/document/product/598/10603).",
235235
},
236+
},
237+
},
238+
},
239+
"assume_role_with_saml": {
240+
Type: schema.TypeList,
241+
Optional: true,
242+
MaxItems: 1,
243+
ConflictsWith: []string{"assume_role_with_web_identity"},
244+
Description: "The `assume_role_with_saml` block. If provided, terraform will attempt to assume this role using the supplied credentials.",
245+
Elem: &schema.Resource{
246+
Schema: map[string]*schema.Schema{
236247
"saml_assertion": {
237-
Type: schema.TypeString,
238-
Optional: true,
239-
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SAML_ASSERTION, nil),
240-
ConflictsWith: []string{"assume_role.0.web_identity_token"},
241-
RequiredWith: []string{"assume_role.0.principal_arn"},
242-
Description: "SAML assertion information encoded in base64. And it can't be used with `web_identity_token` together.",
248+
Type: schema.TypeString,
249+
Required: true,
250+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SAML_ASSERTION, nil),
251+
Description: "SAML assertion information encoded in base64. It can be sourced from the `PROVIDER_ASSUME_ROLE_SAML_ASSERTION`.",
243252
},
244253
"principal_arn": {
245-
Type: schema.TypeString,
246-
Optional: true,
247-
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN, nil),
248-
ConflictsWith: []string{"assume_role.0.web_identity_token"},
249-
RequiredWith: []string{"assume_role.0.saml_assertion"},
250-
Description: "Player Access Description Name. And it can't be used with `web_identity_token` together.",
254+
Type: schema.TypeString,
255+
Required: true,
256+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN, nil),
257+
Description: "Player Access Description Name. It can be sourced from the `PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN`.",
258+
},
259+
"role_arn": {
260+
Type: schema.TypeString,
261+
Required: true,
262+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_ARN, nil),
263+
Description: "The ARN of the role to assume. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_ARN`.",
264+
},
265+
"session_name": {
266+
Type: schema.TypeString,
267+
Required: true,
268+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SESSION_NAME, nil),
269+
Description: "The session name to use when making the AssumeRole call. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME`.",
251270
},
271+
"session_duration": {
272+
Type: schema.TypeInt,
273+
Required: true,
274+
DefaultFunc: func() (interface{}, error) {
275+
if v := os.Getenv(PROVIDER_ASSUME_ROLE_SESSION_DURATION); v != "" {
276+
return strconv.Atoi(v)
277+
}
278+
return 7200, nil
279+
},
280+
ValidateFunc: tccommon.ValidateIntegerInRange(0, 43200),
281+
Description: "The duration of the session when making the AssumeRoleWithSAML call. Its value ranges from 0 to 43200(seconds), and default is 7200 seconds. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION`.",
282+
},
283+
},
284+
},
285+
},
286+
"assume_role_with_web_identity": {
287+
Type: schema.TypeList,
288+
Optional: true,
289+
MaxItems: 1,
290+
ConflictsWith: []string{"assume_role_with_saml"},
291+
Description: "The `assume_role_with_web_identity` block. If provided, terraform will attempt to assume this role using the supplied credentials.",
292+
Elem: &schema.Resource{
293+
Schema: map[string]*schema.Schema{
252294
"web_identity_token": {
253-
Type: schema.TypeString,
254-
Optional: true,
255-
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN, nil),
256-
ConflictsWith: []string{"assume_role.0.saml_assertion", "assume_role.0.principal_arn"},
257-
Description: "OIDC token issued by IdP. And it can't be used with `saml_assertion` or `principal_arn` together.",
295+
Type: schema.TypeString,
296+
Required: true,
297+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN, nil),
298+
Description: "OIDC token issued by IdP. It can be sourced from the `PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN`.",
299+
},
300+
"role_arn": {
301+
Type: schema.TypeString,
302+
Required: true,
303+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_ARN, nil),
304+
Description: "The ARN of the role to assume. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_ARN`.",
305+
},
306+
"session_name": {
307+
Type: schema.TypeString,
308+
Required: true,
309+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SESSION_NAME, nil),
310+
Description: "The session name to use when making the AssumeRole call. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME`.",
311+
},
312+
"session_duration": {
313+
Type: schema.TypeInt,
314+
Required: true,
315+
DefaultFunc: func() (interface{}, error) {
316+
if v := os.Getenv(PROVIDER_ASSUME_ROLE_SESSION_DURATION); v != "" {
317+
return strconv.Atoi(v)
318+
}
319+
return 7200, nil
320+
},
321+
ValidateFunc: tccommon.ValidateIntegerInRange(0, 43200),
322+
Description: "The duration of the session when making the AssumeRoleWithWebIdentity call. Its value ranges from 0 to 43200(seconds), and default is 7200 seconds. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION`.",
258323
},
259324
},
260325
},
@@ -2038,6 +2103,7 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
20382103
domain string
20392104
)
20402105

2106+
needSecret := true
20412107
if v, ok := d.GetOk("secret_id"); ok {
20422108
secretId = v.(string)
20432109
} else {
@@ -2087,13 +2153,10 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
20872153
}
20882154

20892155
var (
2090-
assumeRoleArn string
2091-
assumeRoleSessionName string
2092-
assumeRoleSessionDuration int
2093-
assumeRolePolicy string
2094-
assumeRoleSamlAssertion string
2095-
assumeRolePrincipalArn string
2096-
assumeRoleWebIdentityToken string
2156+
assumeRoleArn string
2157+
assumeRoleSessionName string
2158+
assumeRoleSessionDuration int
2159+
assumeRolePolicy string
20972160
)
20982161

20992162
// get assume role from credential
@@ -2108,7 +2171,6 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
21082171
if assumeRoleArn != "" && assumeRoleSessionName != "" {
21092172
assumeRoleSessionDuration = 7200
21102173
assumeRolePolicy = ""
2111-
21122174
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy)
21132175
}
21142176

@@ -2128,19 +2190,25 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
21282190
assumeRoleSessionDuration = 7200
21292191
}
21302192

2193+
// get assume role with saml from env
21312194
envSamlAssertion := os.Getenv(PROVIDER_ASSUME_ROLE_SAML_ASSERTION)
21322195
envPrincipalArn := os.Getenv(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN)
2196+
// get assume role with web identity from env
21332197
envWebIdentityToken := os.Getenv(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN)
21342198

21352199
if envSamlAssertion == "" && envPrincipalArn == "" && envWebIdentityToken == "" {
21362200
// use assume role
21372201
_ = genClientWithSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, "")
2202+
} else if envSamlAssertion != "" && envPrincipalArn != "" && envWebIdentityToken != "" {
2203+
return nil, fmt.Errorf("can not set `TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION`, `TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN`, `TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN` at the same time.\n")
21382204
} else if envSamlAssertion != "" && envPrincipalArn != "" {
21392205
// use assume role with saml
21402206
_ = genClientWithSamlSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envSamlAssertion, envPrincipalArn)
2207+
needSecret = false
21412208
} else if envWebIdentityToken != "" {
21422209
// use assume role with oidc
21432210
_ = genClientWithOidcSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envWebIdentityToken)
2211+
needSecret = false
21442212
} else {
21452213
return nil, fmt.Errorf("get `assume_role` from env error.\n")
21462214
}
@@ -2150,34 +2218,53 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
21502218
if v, ok := d.GetOk("assume_role"); ok {
21512219
assumeRoleList := v.([]interface{})
21522220
if len(assumeRoleList) == 1 {
2153-
// assume role
21542221
assumeRole := assumeRoleList[0].(map[string]interface{})
21552222
assumeRoleArn = assumeRole["role_arn"].(string)
21562223
assumeRoleSessionName = assumeRole["session_name"].(string)
21572224
assumeRoleSessionDuration = assumeRole["session_duration"].(int)
21582225
assumeRolePolicy = assumeRole["policy"].(string)
2159-
// saml
2160-
assumeRoleSamlAssertion = assumeRole["saml_assertion"].(string)
2161-
assumeRolePrincipalArn = assumeRole["principal_arn"].(string)
2162-
// oidc
2163-
assumeRoleWebIdentityToken = assumeRole["web_identity_token"].(string)
2164-
2165-
if assumeRoleSamlAssertion == "" && assumeRolePrincipalArn == "" && assumeRoleWebIdentityToken == "" {
2166-
// use assume role
2167-
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy)
2168-
} else if assumeRoleSamlAssertion != "" && assumeRolePrincipalArn != "" {
2169-
// use assume role with saml
2170-
_ = genClientWithSamlSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleSamlAssertion, assumeRolePrincipalArn)
2171-
} else if assumeRoleWebIdentityToken != "" {
2172-
// use assume role with oidc
2173-
_ = genClientWithOidcSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleWebIdentityToken)
2174-
} else {
2175-
return nil, fmt.Errorf("get `assume_role` params error.\n")
2176-
}
2226+
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy)
2227+
}
2228+
}
2229+
2230+
var (
2231+
assumeRoleSamlAssertion string
2232+
assumeRolePrincipalArn string
2233+
assumeRoleWebIdentityToken string
2234+
)
2235+
2236+
// get assume role with saml from tf
2237+
if v, ok := d.GetOk("assume_role_with_saml"); ok {
2238+
assumeRoleWithSamlList := v.([]interface{})
2239+
if len(assumeRoleWithSamlList) == 1 {
2240+
assumeRoleWithSaml := assumeRoleWithSamlList[0].(map[string]interface{})
2241+
assumeRoleSamlAssertion = assumeRoleWithSaml["saml_assertion"].(string)
2242+
assumeRolePrincipalArn = assumeRoleWithSaml["principal_arn"].(string)
2243+
assumeRoleArn = assumeRoleWithSaml["role_arn"].(string)
2244+
assumeRoleSessionName = assumeRoleWithSaml["session_name"].(string)
2245+
assumeRoleSessionDuration = assumeRoleWithSaml["session_duration"].(int)
2246+
2247+
_ = genClientWithSamlSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleSamlAssertion, assumeRolePrincipalArn)
2248+
needSecret = false
2249+
}
2250+
}
2251+
2252+
// get assume role with web identity from tf
2253+
if v, ok := d.GetOk("assume_role_with_web_identity"); ok {
2254+
assumeRoleWithWebIdentityList := v.([]interface{})
2255+
if len(assumeRoleWithWebIdentityList) == 1 {
2256+
assumeRoleWithWebIdentity := assumeRoleWithWebIdentityList[0].(map[string]interface{})
2257+
assumeRoleWebIdentityToken = assumeRoleWithWebIdentity["web_identity_token"].(string)
2258+
assumeRoleArn = assumeRoleWithWebIdentity["role_arn"].(string)
2259+
assumeRoleSessionName = assumeRoleWithWebIdentity["session_name"].(string)
2260+
assumeRoleSessionDuration = assumeRoleWithWebIdentity["session_duration"].(int)
2261+
2262+
_ = genClientWithOidcSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleWebIdentityToken)
2263+
needSecret = false
21772264
}
21782265
}
21792266

2180-
if secretId == "" || secretKey == "" {
2267+
if needSecret && (secretId == "" || secretKey == "") {
21812268
return nil, fmt.Errorf("Please set your `secret_id` and `secret_key`.\n")
21822269
}
21832270

0 commit comments

Comments
 (0)