Merge pull request #5859 from mgarstecki/allow_empty_boundary_on_user

Allow empty permissions_boundary attribute on aws_iam_user
hashicorp · Sep 13, 2018 · 12b93fe · 12b93fe
2 parents 201f435 + ced2fb2
commit 12b93fe
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 2 deletions.
diff --git a/aws/resource_aws_iam_user.go b/aws/resource_aws_iam_user.go
@@ -11,7 +11,6 @@ import (
 
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
-	"github.com/hashicorp/terraform/helper/validation"
 )
 
 func resourceAwsIamUser() *schema.Resource {
@@ -54,7 +53,7 @@ func resourceAwsIamUser() *schema.Resource {
 			"permissions_boundary": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(20, 2048),
+				ValidateFunc: validateMaxLength(2048),
 			},
 			"force_destroy": {
 				Type:        schema.TypeBool,

diff --git a/aws/resource_aws_iam_user_test.go b/aws/resource_aws_iam_user_test.go
@@ -178,6 +178,7 @@ func TestAccAWSUser_permissionsBoundary(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSUserExists(resourceName, &user),
 					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", permissionsBoundary1),
+					testAccCheckAWSUserPermissionsBoundary(&user, permissionsBoundary1),
 				),
 			},
 			// Test update
@@ -186,6 +187,7 @@ func TestAccAWSUser_permissionsBoundary(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSUserExists(resourceName, &user),
 					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", permissionsBoundary2),
+					testAccCheckAWSUserPermissionsBoundary(&user, permissionsBoundary2),
 				),
 			},
 			// Test import
@@ -201,6 +203,7 @@ func TestAccAWSUser_permissionsBoundary(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSUserExists(resourceName, &user),
 					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", ""),
+					testAccCheckAWSUserPermissionsBoundary(&user, ""),
 				),
 			},
 			// Test addition
@@ -209,6 +212,16 @@ func TestAccAWSUser_permissionsBoundary(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSUserExists(resourceName, &user),
 					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", permissionsBoundary1),
+					testAccCheckAWSUserPermissionsBoundary(&user, permissionsBoundary1),
+				),
+			},
+			// Test empty value
+			{
+				Config: testAccAWSUserConfig_permissionsBoundary(rName, ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSUserExists(resourceName, &user),
+					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", ""),
+					testAccCheckAWSUserPermissionsBoundary(&user, ""),
 				),
 			},
 		},
@@ -297,6 +310,22 @@ func testAccCheckAWSUserDisappears(getUserOutput *iam.GetUserOutput) resource.Te
 	}
 }
 
+func testAccCheckAWSUserPermissionsBoundary(getUserOutput *iam.GetUserOutput, expectedPermissionsBoundaryArn string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		actualPermissionsBoundaryArn := ""
+
+		if getUserOutput.User.PermissionsBoundary != nil {
+			actualPermissionsBoundaryArn = *getUserOutput.User.PermissionsBoundary.PermissionsBoundaryArn
+		}
+
+		if actualPermissionsBoundaryArn != expectedPermissionsBoundaryArn {
+			return fmt.Errorf("PermissionsBoundary: '%q', expected '%q'.", actualPermissionsBoundaryArn, expectedPermissionsBoundaryArn)
+		}
+
+		return nil
+	}
+}
+
 func testAccAWSUserConfig(rName, path string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_user" "user" {