Add aws_iot_certificate resource

aws/provider.go

@@ -356,6 +356,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_inspector_resource_group":                 resourceAWSInspectorResourceGroup(),
 			"aws_instance":                                 resourceAwsInstance(),
 			"aws_internet_gateway":                         resourceAwsInternetGateway(),
+			"aws_iot_certificate":                          resourceAwsIotCertificate(),
 			"aws_iot_policy":                               resourceAwsIotPolicy(),
 			"aws_key_pair":                                 resourceAwsKeyPair(),
 			"aws_kinesis_firehose_delivery_stream":         resourceAwsKinesisFirehoseDeliveryStream(),

aws/resource_aws_iot_certificate.go

@@ -0,0 +1,147 @@
+package aws
+
+import (
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsIotCertificate() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsIotCertificateCreate,
+		Read:   resourceAwsIotCertificateRead,
+		Update: resourceAwsIotCertificateUpdate,
+		Delete: resourceAwsIotCertificateDelete,
+		Schema: map[string]*schema.Schema{
+			"csr": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"active": &schema.Schema{
+				Type:     schema.TypeBool,
+				Required: true,
+			},
+			"arn": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceAwsIotCertificateCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iotconn
+
+	log.Printf("[DEBUG] Creating certificate from csr")
+	out, err := conn.CreateCertificateFromCsr(&iot.CreateCertificateFromCsrInput{
+		CertificateSigningRequest: aws.String(d.Get("csr").(string)),
+		SetAsActive:               aws.Bool(d.Get("active").(bool)),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+	log.Printf("[DEBUG] Created certificate from csr")
+
+	d.SetId(*out.CertificateId)
+
+	return resourceAwsIotCertificateRead(d, meta)
+}
+
+func resourceAwsIotCertificateRead(d *schema.ResourceData, meta interface{}) error {
+
+	conn := meta.(*AWSClient).iotconn
+
+	out, err := conn.DescribeCertificate(&iot.DescribeCertificateInput{
+		CertificateId: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+
+	d.Set("arn", out.CertificateDescription.CertificateArn)
+
+	return nil
+}
+
+func resourceAwsIotCertificateUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).iotconn
+
+	if d.HasChange("csr") {
+		// First create certificate with new CSR
+		out, err := conn.CreateCertificateFromCsr(&iot.CreateCertificateFromCsrInput{
+			CertificateSigningRequest: aws.String(d.Get("csr").(string)),
+			SetAsActive:               aws.Bool(d.Get("active").(bool)),
+		})
+
+		if err != nil {
+			log.Printf("[ERROR] %s", err)
+			return nil
+		}
+
+		// If everything worked, make the old one inactive
+		_, err = conn.UpdateCertificate(&iot.UpdateCertificateInput{
+			CertificateId: aws.String(d.Id()),
+			NewStatus:     aws.String("INACTIVE"),
+		})
+
+		if err != nil {
+			log.Printf("[ERROR] %s", err)
+			return err
+		}
+
+		d.SetId(*out.CertificateId)
+
+	} else {
+
+		if d.HasChange("active") {
+			status := "INACTIVE"
+			if d.Get("active").(bool) {
+				status = "ACTIVE"
+			}
+
+			_, err := conn.UpdateCertificate(&iot.UpdateCertificateInput{
+				CertificateId: aws.String(d.Id()),
+				NewStatus:     aws.String(status),
+			})
+
+			if err != nil {
+				log.Printf("[ERROR] %s", err)
+				return err
+			}
+		}
+	}
+
+	return resourceAwsIotCertificateRead(d, meta)
+}
+
+func resourceAwsIotCertificateDelete(d *schema.ResourceData, meta interface{}) error {
+
+	conn := meta.(*AWSClient).iotconn
+
+	_, err := conn.UpdateCertificate(&iot.UpdateCertificateInput{
+		CertificateId: aws.String(d.Id()),
+		NewStatus:     aws.String("INACTIVE"),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR], %s", err)
+		return err
+	}
+
+	_, err = conn.DeleteCertificate(&iot.DeleteCertificateInput{
+		CertificateId: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		log.Printf("[ERROR] %s", err)
+		return err
+	}
+
+	return nil
+}

aws/resource_aws_iot_certificate_test.go

@@ -0,0 +1,71 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAWSIoTCertificate_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIoTCertificateDestroy_basic,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSIoTCertificate_basic,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("aws_iot_certificate.foo_cert", "arn"),
+					resource.TestCheckResourceAttrSet("aws_iot_certificate.foo_cert", "csr"),
+					resource.TestCheckResourceAttr("aws_iot_certificate.foo_cert", "active", "true"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAWSIoTCertificateDestroy_basic(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).iotconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iot_certificate" {
+			continue
+		}
+
+		// Try to find the Cert
+		DescribeCertOpts := &iot.DescribeCertificateInput{
+			CertificateId: aws.String(rs.Primary.ID),
+		}
+
+		resp, err := conn.DescribeCertificate(DescribeCertOpts)
+
+		if err == nil {
+			if resp.CertificateDescription != nil {
+				return fmt.Errorf("Device Certificate still exists")
+			}
+		}
+
+		// Verify the error is what we want
+		if err != nil {
+			iotErr, ok := err.(awserr.Error)
+			if !ok || iotErr.Code() != "ResourceNotFoundException" {
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+var testAccAWSIoTCertificate_basic = `
+resource "aws_iot_certificate" "foo_cert" {
+  csr = "${file("test-fixtures/iot-csr.pem")}"
+  active = true
+}
+`

aws/test-fixtures/iot-csr.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICijCCAXICAQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUx
+ITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMSUg2mO7mYnhvYUB55K0/ay9WLLgPjOHnbduyCv
+N+udkJaZc+A65ux9LvVo33VHDTlV2Ms9H/42on902WtuS3BNuxdXfD068CpN2lb6
+bSAeuKc6Fdu4BIP2bFYKCyejqBoOmTEhYA8bOM1Wu/pRsq1PkAmcGkvw3mlRx45E
+B2LRicWcg3YEleEBGyLYohyeMu0pnlsc7zsu5T4bwrjetdbDPVbzgu0Mf/evU9hJ
+G/IisXNxQhzPh/DTQsKZSNddZ4bmkAQrRN1nmNXD6QoxBiVyjjgKGrPnX+hz4ugm
+aaN9CsOO/cad1E3C0KiI0BQCjxRb80wOpI4utz4pEcY97sUCAwEAAaAAMA0GCSqG
+SIb3DQEBBQUAA4IBAQC64L4JHvwxdxmnXT9Lv12p5CGx99d7VOXQXy29b1yH9cJ+
+FaQ2TH377uOdorSCS4bK7eje9/HLsCNgqftR0EruwSNnukF695BWN8e/AJSZe0vA
+3J/llZ6G7MWuOIhCswsOxqNnM1htu3o6ujXVrgBMeMgQy2tfylWfI7SGR6UmtLYF
+ZrPaqXdkpt47ROJNCm2Oht1B0J3QEOmbIp/2XMxrfknzwH6se/CjuliiXVPYxrtO
+5hbZcRqjhugb8FWtaLirqh3Q3+1UIJ+CW0ZczsblP7DNdqqt8YQZpWVIqR64mSXV
+Ajq/cupsJST9fey8chcNSTt4nKxOGs3OgXu1ftgy
+-----END CERTIFICATE REQUEST-----

website/aws.erb

@@ -882,6 +882,10 @@
                   <a href="#">IoT Resources</a>
                   <ul class="nav nav-visible">
 
+                    <li<%= sidebar_current("docs-aws-resource-iot-certificate") %>>
+                      <a href="/docs/providers/aws/r/iot_certificate.html">aws_iot_certificate</a>
+                    </li>
+
                     <li<%= sidebar_current("docs-aws-resource-iot-policy") %>>
                       <a href="/docs/providers/aws/r/iot_policy.html">aws_iot_policy</a>
                     </li>

website/docs/r/iot_certificate.html.markdown

@@ -0,0 +1,32 @@
+---
+layout: "aws"
+page_title: "AWS: aws_iot_certificate"
+sidebar_current: "docs-aws-resource-iot-certificate"
+description: |-
+    Creates and manages an AWS IoT certificate.
+---
+
+# aws\_iot\_certificate
+
+Creates and manages an AWS IoT certificate.
+
+## Example Usage
+
+```hcl
+resource "aws_iot_certificate" "cert" {
+  csr = "${file("/my/csr.pem")}"
+  active = true
+}
+```
+
+## Argument Reference
+
+* `active` - (Required)  Boolean flag to indicate if the certificate should be active
+* `csr` - (Required) The certificate signing request. Review the
+  [IoT API Reference Guide] (http://docs.aws.amazon.com/iot/latest/apireference/API_CreateCertificateFromCsr.html)
+  for more information on creating a certificate from a certificate signing request (CSR).
+
+
+## Attributes Reference
+
+* `arn` - The ARN of the created AWS IoT certificate