-
Notifications
You must be signed in to change notification settings - Fork 60
HCPF-3090: update state only if setting policy succeeds #1320
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HCPF-3090: update state only if setting policy succeeds #1320
Conversation
… to storeIamPolicyData.
Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement Learn more about why HashiCorp requires a CLA and what the CLA includes 1 out of 2 committers have signed the CLA.
Have you signed the CLA already but the status is still pending? Recheck it. |
This reverts commit 8cadb3e.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work on the tests!
🛠️ Description
ResourceIamPolicy has an issue where it stores state before the policy is set. If setting the policy fails, then the state is corrupted and the user cannot continue after that.
This change saves the state only after a successful call to setIamPolicyData, and the storeIamPolicyData should act on the plan, not the state.
🏗️ Acceptance tests
Output from acceptance testing:
TestAccVaultSecretsAppIamPolicyResource - this test will be deprecated/modified as HCP Vault Secrets is no longer allowing new resource creation
TestAccGroupIamPolicyResource
TestAcc_Packer_BucketIamPolicyResource
TestAccProjectIamPolicyResource
TestAccIAMPolicyDataSource
TestRadarResourceIAMPolicy
TestAccIAMPolicyDataSource
TestAccIAMPolicyDataSource_Validation
Tested locally with resourcemanger always returning an error for setting an iam policy, can see that the state is not updated if an error occurs.
Untitled.mov
Thanks @NickCellino for testing this!
PCI review checklist
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've worked with GRC to document the impact of any changes to security controls.
Examples of changes to controls include access controls, encryption, logging, etc.
If applicable, I've worked with GRC to ensure compliance due to a significant change to the in-scope PCI environment.
Examples include changes to operating systems, ports, protocols, services, cryptography-related components, PII processing code, etc.