Support AWS PrivateLink for AWS Services

[ewbankkit]

Fixes #2222.

• aws_vpc_endpoint_service data source - Update
• aws_vpc_endpoint data source - Update
• aws_vpc_endpoint resource - Update
• aws_vpc_endpoint_subnet_association resource - New
• aws_vpc_endpoint_security_group_association resource - New
• Documentation
• Acceptance tests

[ewbankkit]

OK, finally completed this.
The major change since my initial design was to not add a new aws_vpc_endpoint_security_group_association but instead to require at least one subnet ID be specified in the aws_vpc_endpoint resource for Interface endpoints.
The reasoning for this is that Interface endpoints must always be associated with at least one security group and if none is explicitly specified on creation then the VPC's default security group is implictly added. This doesn't fit well with the Terraform model, so I went with only specifying security groups in the aws_vpc_endpoint resource and not allowing them to be associated via a separate resource.

[ewbankkit]

Acceptance tests:

make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsVpcEndpointService_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccDataSourceAwsVpcEndpointService_ -timeout 120m
=== RUN   TestAccDataSourceAwsVpcEndpointService_gateway
--- PASS: TestAccDataSourceAwsVpcEndpointService_gateway (14.91s)
=== RUN   TestAccDataSourceAwsVpcEndpointService_interface
--- PASS: TestAccDataSourceAwsVpcEndpointService_interface (13.98s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	28.907s

make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsVpcEndpoint_'==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccDataSourceAwsVpcEndpoint_ -timeout 120m
=== RUN   TestAccDataSourceAwsVpcEndpoint_gatewayBasic
--- PASS: TestAccDataSourceAwsVpcEndpoint_gatewayBasic (44.29s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_byId
--- PASS: TestAccDataSourceAwsVpcEndpoint_byId (45.65s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_gatewayWithRouteTable
--- PASS: TestAccDataSourceAwsVpcEndpoint_gatewayWithRouteTable (47.49s)
=== RUN   TestAccDataSourceAwsVpcEndpoint_interface
--- PASS: TestAccDataSourceAwsVpcEndpoint_interface (218.24s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	355.672s

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpointSubnetAssociation_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpointSubnetAssociation_ -timeout 120m
=== RUN   TestAccAwsVpcEndpointSubnetAssociation_basic
--- PASS: TestAccAwsVpcEndpointSubnetAssociation_basic (94.42s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	94.443s

make testacc TEST=./aws/ TESTARGS='-run=TestAccAwsVpcEndpoint_'==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAwsVpcEndpoint_ -timeout 120m
=== RUN   TestAccAwsVpcEndpoint_importBasic
--- PASS: TestAccAwsVpcEndpoint_importBasic (44.35s)
=== RUN   TestAccAwsVpcEndpoint_gatewayBasic
--- PASS: TestAccAwsVpcEndpoint_gatewayBasic (38.88s)
=== RUN   TestAccAwsVpcEndpoint_gatewayWithRouteTableAndPolicy
--- PASS: TestAccAwsVpcEndpoint_gatewayWithRouteTableAndPolicy (73.42s)
=== RUN   TestAccAwsVpcEndpoint_interfaceBasic
--- PASS: TestAccAwsVpcEndpoint_interfaceBasic (48.15s)
=== RUN   TestAccAwsVpcEndpoint_interfaceWithSubnetAndSecurityGroup
--- PASS: TestAccAwsVpcEndpoint_interfaceWithSubnetAndSecurityGroup (341.28s)
=== RUN   TestAccAwsVpcEndpoint_removed
--- PASS: TestAccAwsVpcEndpoint_removed (31.93s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	578.036s

[ewbankkit]

Removed WIP.

[ewbankkit]

I think we can now replace this "apply-time" logic with "plan-time" logic using these changes.

[ewbankkit]

I can't get the "plan-time" logic

CustomizeDiff: func(diff *schema.ResourceDiff, v interface{}) error {
    if diff.Get("vpc_endpoint_type").(string) == ec2.VpcEndpointTypeInterface {
        _, new := diff.GetChange("security_group_ids")
        if new.(*schema.Set).Len() == 0 {
                return errors.New("An Interface VPC Endpoint must always have at least one Security Group")
        }
    }

    return nil
},

to work - the new length is always 0 when creating the resource the first time.

[johnjelinek]

LGTM

[ewbankkit]

Rebased and added the acceptance_required attribute to the aws_vpc_endpoint_service data source, required in support of #2460.

[darrenhaken]

Any idea when this might be good to go?

[ewbankkit]

Work merged in to #2515.

[jen20]

This landed as part of #2515 in 35b273e.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!