fix(cbs): [122768379] support kms key

.changelog/3334.txt

@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/tencentcloud_cbs_storage: support `kms_key_id`
+```
+
+```release-note:enhancement
+resource/tencentcloud_cbs_storage_set: support `kms_key_id`
+```
+
+```release-note:enhancement
+datasource/tencentcloud_cbs_storages: add return value `kms_key_id`
+```
+
+```release-note:enhancement
+datasource/tencentcloud_cbs_storages_set: add return value `kms_key_id`
+```

go.mod

@@ -34,7 +34,7 @@ require (
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/bi v1.0.824
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam v1.0.1071
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cat v1.0.825
-	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.591
+	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.1153
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdb v1.0.944
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdn v1.0.1010
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdwch v1.0.1129
@@ -46,7 +46,7 @@ require (
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/clb v1.0.1107
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cloudaudit v1.0.1033
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cls v1.0.1135
-	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1149
+	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1153
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cvm v1.0.1128
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cwp v1.0.762
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cynosdb v1.0.1111

go.sum

@@ -837,6 +837,10 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cat v1.0.825 h1:TgO9L1y
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cat v1.0.825/go.mod h1:1yCKeIioX4D0bcIDHs3JCS5lbyzndXh1E8wHyHaCjxY=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.591 h1:TPGLjH6wqkA5Iirl6xCxFkWwrtCZ8ZmeF7ASzqUbsZA=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.591/go.mod h1:nCAGfVTXZkVnurkbjF3b0FM6RwGztE9t8D9Ms1unaKo=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.1148 h1:AUppERhfYCUu5ZAN8gbGYfHwPy1uaT7nPmhYGY5JvSY=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.1148/go.mod h1:cfP+nV0uB7FF86XyKF31edBoSJO36WFUsTc0KC80B4I=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.1153 h1:jRsdk2F5QZusPAV5+C/cwmgXoxxomOXH3o9ofeb4dFo=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cbs v1.0.1153/go.mod h1:M83IuCDKXMqmpeOMkVtu9cloiJZsylESDjCvF0hzWQg=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdb v1.0.944 h1:+PGoNHlZE/WY6KWWNOByL0sYVv1ZJtSx7yXMUJNYV1Y=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdb v1.0.944/go.mod h1:+VHcZ4Cnzpt6vtCvNROz8xWfNWUkoAZ9UPSonbA3NWM=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdc v1.0.970 h1:0A6PwOaUeLtm4U5TR1uD91ETBgDcnfqFnsG9mwCNvlY=
@@ -945,14 +949,14 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1136/go.mod
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1142/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1145 h1:DETyir/MtG+GLOD0OatzjrQTTXRguFSJo1ZtPXtbIQw=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1145/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1148 h1:+2jHvXzO0ljzTtqdnZ6ug0wMLYSaMwyr1zJa0z/DqyE=
-github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1148/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1147 h1:6v559jM1v6A4KJinNZ28RqVZs+ipKMzCWtYWcWy+zZ4=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1147/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1148 h1:+2jHvXzO0ljzTtqdnZ6ug0wMLYSaMwyr1zJa0z/DqyE=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1148/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1149 h1:a2N8e9YHftVvJmI6PIVJBLfPuy2dn+jZ92atTsmtJuc=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1149/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1153 h1:g/aw2nrrMfO/+sdBPCFsiq+sgSFNiUK/sAci6PT4O4E=
+github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.1153/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/controlcenter v1.0.993 h1:WlPgXldQCxt7qi5Xrc6j6zTrsXWzN5BcOGs7Irq7fwQ=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/controlcenter v1.0.993/go.mod h1:Z9U8zNtyuyKhjS0698wqsrG/kLx1TQ5CEixXBwVe7xY=
 github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/csip v1.0.860 h1:F3esKBIT3HW9+7Gt8cVgf8X06VdGIczpgLBUECzSEzU=

tencentcloud/services/cbs/data_source_tc_cbs_storages.go

@@ -156,6 +156,11 @@ func DataSourceTencentCloudCbsStorages() *schema.Resource {
 							Computed:    true,
 							Description: "ID of the CVM instance that be mounted by this CBS.",
 						},
+						"kms_key_id": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "Kms key ID.",
+						},
 						"encrypt": {
 							Type:        schema.TypeBool,
 							Computed:    true,
@@ -288,6 +293,7 @@ func dataSourceTencentCloudCbsStoragesRead(d *schema.ResourceData, meta interfac
 				"storage_size":           storage.DiskSize,
 				"attached":               storage.Attached,
 				"instance_id":            storage.InstanceId,
+				"kms_key_id":             storage.KmsKeyId,
 				"encrypt":                storage.Encrypt,
 				"create_time":            storage.CreateTime,
 				"status":                 storage.DiskState,

tencentcloud/services/cbs/data_source_tc_cbs_storages.md

@@ -3,6 +3,7 @@ Use this data source to query detailed information of CBS storages.
 Example Usage
 
 Query all CBS storages
+
 ```hcl
 data "tencentcloud_cbs_storages" "example" {}
 ```
@@ -17,6 +18,7 @@ data "tencentcloud_cbs_storages" "example" {
 ```
 
 Query CBS by dedicated cluster id
+
 ```hcl
 data "tencentcloud_cbs_storages" "example" {
   dedicated_cluster_id = "cluster-262n63e8"
@@ -26,7 +28,7 @@ data "tencentcloud_cbs_storages" "example" {
 The following snippet shows the new supported query params
 
 ```hcl
-data "tencentcloud_cbs_storages" "whats_new" {
+data "tencentcloud_cbs_storages" "example" {
   charge_type   = ["POSTPAID_BY_HOUR", "PREPAID", "CDCPAID", "DEDICATED_CLUSTER_PAID"]
   storage_state = ["ATTACHED"]
   instance_ips  = ["10.0.0.2"]

tencentcloud/services/cbs/data_source_tc_cbs_storages_set.go

@@ -155,6 +155,11 @@ func DataSourceTencentCloudCbsStoragesSet() *schema.Resource {
 							Computed:    true,
 							Description: "ID of the CVM instance that be mounted by this CBS.",
 						},
+						"kms_key_id": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "Kms key ID.",
+						},
 						"encrypt": {
 							Type:        schema.TypeBool,
 							Computed:    true,
@@ -286,6 +291,7 @@ func dataSourceTencentCloudCbsStoragesSetRead(d *schema.ResourceData, meta inter
 			"storage_size":           storage.DiskSize,
 			"attached":               storage.Attached,
 			"instance_id":            storage.InstanceId,
+			"kms_key_id":             storage.KmsKeyId,
 			"encrypt":                storage.Encrypt,
 			"create_time":            storage.CreateTime,
 			"status":                 storage.DiskState,

tencentcloud/services/cbs/resource_tc_cbs_storage.go

@@ -95,11 +95,18 @@ func ResourceTencentCloudCbsStorage() *schema.Resource {
 				Default:     0,
 				Description: "ID of the project to which the instance belongs.",
 			},
+			"kms_key_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Computed:    true,
+				Description: "Optional parameters. When purchasing an encryption disk, customize the key. When this parameter is passed in, the `encrypt` parameter need be set.",
+			},
 			"encrypt": {
 				Type:        schema.TypeBool,
 				Optional:    true,
 				ForceNew:    true,
-				Description: "Indicates whether CBS is encrypted.",
+				Description: "Pass in this parameter to create an encrypted cloud disk.",
 			},
 			"tags": {
 				Type:        schema.TypeMap,
@@ -156,7 +163,7 @@ func resourceTencentCloudCbsStorageCreate(d *schema.ResourceData, meta interface
 		Zone: helper.String(d.Get("availability_zone").(string)),
 	}
 
-	if v, ok := d.GetOk("project_id"); ok {
+	if v, ok := d.GetOkExists("project_id"); ok {
 		request.Placement.ProjectId = helper.IntUint64(v.(int))
 	}
 
@@ -168,11 +175,15 @@ func resourceTencentCloudCbsStorageCreate(d *schema.ResourceData, meta interface
 		request.SnapshotId = helper.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		request.KmsKeyId = helper.String(v.(string))
+	}
+
 	if _, ok := d.GetOk("encrypt"); ok {
 		request.Encrypt = helper.String("ENCRYPT")
 	}
 
-	if v, ok := d.GetOk("throughput_performance"); ok {
+	if v, ok := d.GetOkExists("throughput_performance"); ok {
 		request.ThroughputPerformance = helper.IntUint64(v.(int))
 	}
 
@@ -182,7 +193,7 @@ func resourceTencentCloudCbsStorageCreate(d *schema.ResourceData, meta interface
 
 	if chargeType == CBS_CHARGE_TYPE_PREPAID {
 		request.DiskChargePrepaid = &cbs.DiskChargePrepaid{}
-		if period, ok := d.GetOk("prepaid_period"); ok {
+		if period, ok := d.GetOkExists("prepaid_period"); ok {
 			periodInt64 := uint64(period.(int))
 			request.DiskChargePrepaid.Period = &periodInt64
 		} else {
@@ -215,6 +226,10 @@ func resourceTencentCloudCbsStorageCreate(d *schema.ResourceData, meta interface
 			return tccommon.RetryError(e, tccommon.InternalError)
 		}
 
+		if response == nil || response.Response == nil {
+			return resource.NonRetryableError(fmt.Errorf("Create cbs failed, Response is nil."))
+		}
+
 		if len(response.Response.DiskIdSet) < 1 {
 			return resource.NonRetryableError(fmt.Errorf("storage id is nil"))
 		}
@@ -310,6 +325,10 @@ func resourceTencentCloudCbsStorageRead(d *schema.ResourceData, meta interface{}
 	_ = d.Set("prepaid_renew_flag", storage.RenewFlag)
 	_ = d.Set("throughput_performance", storage.ThroughputPerformance)
 
+	if storage.KmsKeyId != nil {
+		_ = d.Set("kms_key_id", storage.KmsKeyId)
+	}
+
 	if *storage.DiskChargeType == CBS_CHARGE_TYPE_PREPAID {
 		_ = d.Set("prepaid_renew_flag", storage.RenewFlag)
 	}

tencentcloud/services/cbs/resource_tc_cbs_storage.md

@@ -1,5 +1,9 @@
 Provides a resource to create a CBS storage.
 
+-> **NOTE:** When creating an encrypted disk, if `kms_key_id` is not entered, the product side will generate a key by default.
+
+-> **NOTE:** When using CBS encrypted disk, it is necessary to add `CVM_QcsRole` role and `QcloudKMSAccessForCVMRole` strategy to the account.
+
 Example Usage
 
 Create a standard CBS storage
@@ -14,7 +18,42 @@ resource "tencentcloud_cbs_storage" "example" {
   encrypt           = false
 
   tags = {
-    createBy = "terraform"
+    createBy = "Terraform"
+  }
+}
+```
+
+Create an encrypted CBS storage with customize kms_key_id
+
+```hcl
+resource "tencentcloud_cbs_storage" "example" {
+  storage_name      = "tf-example"
+  storage_type      = "CLOUD_SSD"
+  storage_size      = 100
+  availability_zone = "ap-guangzhou-3"
+  project_id        = 0
+  kms_key_id        = "2e860789-7ef0-11ef-8d1c-5254001955d1"
+  encrypt           = true
+
+  tags = {
+    createBy = "Terraform"
+  }
+}
+```
+
+Create an encrypted CBS storage with default generated kms_key_id
+
+```hcl
+resource "tencentcloud_cbs_storage" "example" {
+  storage_name      = "tf-example"
+  storage_type      = "CLOUD_SSD"
+  storage_size      = 100
+  availability_zone = "ap-guangzhou-3"
+  project_id        = 0
+  encrypt           = true
+
+  tags = {
+    createBy = "Terraform"
   }
 }
 ```
@@ -33,7 +72,7 @@ resource "tencentcloud_cbs_storage" "example" {
   encrypt              = false
 
   tags = {
-    createBy = "terraform"
+    createBy = "Terraform"
   }
 }
 ```

tencentcloud/services/cbs/resource_tc_cbs_storage_set.go

@@ -80,6 +80,13 @@ func ResourceTencentCloudCbsStorageSet() *schema.Resource {
 				Default:     0,
 				Description: "ID of the project to which the instance belongs.",
 			},
+			"kms_key_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Computed:    true,
+				Description: "Optional parameters. When purchasing an encryption disk, customize the key. When this parameter is passed in, the `encrypt` parameter need be set.",
+			},
 			"encrypt": {
 				Type:        schema.TypeBool,
 				Optional:    true,
@@ -148,6 +155,10 @@ func resourceTencentCloudCbsStorageSetCreate(d *schema.ResourceData, meta interf
 		request.SnapshotId = helper.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		request.KmsKeyId = helper.String(v.(string))
+	}
+
 	if _, ok := d.GetOk("encrypt"); ok {
 		request.Encrypt = helper.String("ENCRYPT")
 	}
@@ -234,6 +245,10 @@ func resourceTencentCloudCbsStorageSetRead(d *schema.ResourceData, meta interfac
 	_ = d.Set("charge_type", storage.DiskChargeType)
 	_ = d.Set("throughput_performance", storage.ThroughputPerformance)
 
+	if storage.KmsKeyId != nil {
+		_ = d.Set("kms_key_id", storage.KmsKeyId)
+	}
+
 	return nil
 }
 

tencentcloud/services/cbs/resource_tc_cbs_storage_set.md

@@ -1,5 +1,9 @@
 Provides a resource to create CBS set.
 
+-> **NOTE:** When creating encrypted disks, if `kms_key_id` is not entered, the product side will generate a key by default.
+
+-> **NOTE:** When using CBS encrypted disk, it is necessary to add `CVM_QcsRole` role and `QcloudKMSAccessForCVMRole` strategy to the account.
+
 Example Usage
 
 Create 3 standard CBS storages
@@ -16,6 +20,35 @@ resource "tencentcloud_cbs_storage_set" "example" {
 }
 ```
 
+Create 3 standard CBS storages with customize kms_key_id
+
+```hcl
+resource "tencentcloud_cbs_storage_set" "example" {
+  disk_count        = 3
+  storage_name      = "tf-example"
+  storage_type      = "CLOUD_SSD"
+  storage_size      = 100
+  availability_zone = "ap-guangzhou-3"
+  project_id        = 0
+  kms_key_id        = "b60b328d-7ed5-11ef-8836-5254009ad364"
+  encrypt           = true
+}
+```
+
+Create 3 encrypted CBS storage with default generated kms_key_id
+
+```hcl
+resource "tencentcloud_cbs_storage_set" "example" {
+  disk_count        = 3
+  storage_name      = "tf-example"
+  storage_type      = "CLOUD_SSD"
+  storage_size      = 100
+  availability_zone = "ap-guangzhou-3"
+  project_id        = 0
+  encrypt           = true
+}
+```
+
 Create 3 dedicated cluster CBS storages
 
 ```hcl