Skip to content

Commit

Permalink
tests/resource/aws_cloudfront_distribution: Remove extraneous aliases…
Browse files Browse the repository at this point in the history 
… configurations and create aliased us-east-1 provider configuration

On April 8th, 2019, [Amazon CloudFront began validating alternate domain names](https://aws.amazon.com/about-aws/whats-new/2019/04/amazon-cloudfront-enhances-the-security-for-adding-alternate-domain-names-to-a-distribution/) for security reasons. Some of our acceptance testing was extraneously assigning aliases to CloudFront distributions configured with the CloudFront default certificate and began failing as a result of this service update.

Previous output from acceptance testing:

```
--- FAIL: TestAccAWSCloudFrontDistribution_S3Origin (95.64s)
    testing.go:538: Step 0 error: Error applying: 1 error occurred:
          * aws_cloudfront_distribution.s3_distribution: 1 error occurred:
          * aws_cloudfront_distribution.s3_distribution: error creating CloudFront Distribution: InvalidViewerCertificate: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements

--- FAIL: TestAccAWSCloudFrontDistribution_S3OriginWithTags (95.90s)
    testing.go:538: Step 0 error: Error applying: 1 error occurred:
          * aws_cloudfront_distribution.s3_distribution: 1 error occurred:
          * aws_cloudfront_distribution.s3_distribution: error creating CloudFront Distribution: InvalidViewerCertificate: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements

--- FAIL: TestAccAWSCloudFrontDistribution_customOrigin (65.61s)
    testing.go:538: Step 0 error: Error applying: 1 error occurred:
          * aws_cloudfront_distribution.custom_distribution: 1 error occurred:
          * aws_cloudfront_distribution.custom_distribution: error creating CloudFront Distribution: InvalidViewerCertificate: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements

--- FAIL: TestAccAWSCloudFrontDistribution_multiOrigin (95.68s)
    testing.go:538: Step 0 error: Error applying: 1 error occurred:
          * aws_cloudfront_distribution.multi_origin_distribution: 1 error occurred:
          * aws_cloudfront_distribution.multi_origin_distribution: error creating CloudFront Distribution: InvalidViewerCertificate: To add an alternate domain name (CNAME) to a CloudFront distribution, you must attach a trusted certificate that validates your authorization to use the domain name. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements
```

This change simply removes the `aws_cloudfront_distribution` resource `aliases` configurations, which are not meaningful in these acceptance tests. We also remove the hardcoded `us-east-1` region provider used for ACM certificate handling as it can break other acceptance testing when run concurrently (e.g. locally with `go test -parallel`):

```
--- FAIL: TestAccAWSCloudFrontDistribution_OriginGroups (1247.64s)
    testing.go:599: Error destroying resource! WARNING: Dangling resources
        may exist. The full state and error is shown below.

        Error: Error applying: 2 errors occurred:
          * aws_s3_bucket.s3_bucket_origin (destroy): 1 error occurred:
          * aws_s3_bucket.s3_bucket_origin: error deleting S3 Bucket (mybucket.6479347118024743098): BucketRegionError: incorrect region, the bucket is not in 'us-east-1' region at endpoint ''
          status code: 301, request id: , host id:

          * aws_s3_bucket.s3_backup_bucket_origin (destroy): 1 error occurred:
          * aws_s3_bucket.s3_backup_bucket_origin: error deleting S3 Bucket (mybucket-backup.6479347118024743098): BucketRegionError: incorrect region, the bucket is not in 'us-east-1' region at endpoint ''
          status code: 301, request id: , host id:
```

The aliased `us-east-1` provider configuration will be applied to other test configuration usage later.

Output from acceptance testing:

```
--- PASS: TestAccAWSCloudFrontDistribution_Origin_EmptyOriginID (2.11s)
--- PASS: TestAccAWSCloudFrontDistribution_Origin_EmptyDomainName (2.21s)
--- PASS: TestAccAWSCloudFrontDistribution_DefaultCacheBehavior_ForwardedValues_Cookies_WhitelistedNames (590.42s)
--- PASS: TestAccAWSCloudFrontDistribution_OrderedCacheBehavior_ForwardedValues_Cookies_WhitelistedNames (592.18s)
--- PASS: TestAccAWSCloudFrontDistribution_DefaultCacheBehavior_ForwardedValues_Headers (592.31s)
--- PASS: TestAccAWSCloudFrontDistribution_disappears (592.72s)
--- PASS: TestAccAWSCloudFrontDistribution_OrderedCacheBehavior_ForwardedValues_Headers (594.33s)
--- PASS: TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn (1187.55s)
--- PASS: TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn_ConflictsWithCloudFrontDefaultCertificate (1187.67s)
--- PASS: TestAccAWSCloudFrontDistribution_RetainOnDelete (1225.22s)
--- PASS: TestAccAWSCloudFrontDistribution_orderedCacheBehavior (1225.58s)
--- PASS: TestAccAWSCloudFrontDistribution_HTTP11Config (1226.33s)
--- PASS: TestAccAWSCloudFrontDistribution_multiOrigin (1227.19s)
--- PASS: TestAccAWSCloudFrontDistribution_noOptionalItemsConfig (1229.81s)
--- PASS: TestAccAWSCloudFrontDistribution_S3Origin (1230.36s)
--- PASS: TestAccAWSCloudFrontDistribution_noCustomErrorResponseConfig (1232.47s)
--- PASS: TestAccAWSCloudFrontDistribution_OriginGroups (1232.59s)
--- PASS: TestAccAWSCloudFrontDistribution_customOrigin (1231.23s)
--- PASS: TestAccAWSCloudFrontDistribution_WaitForDeployment (1233.12s)
--- PASS: TestAccAWSCloudFrontDistribution_IsIPV6EnabledConfig (1234.68s)
--- PASS: TestAccAWSCloudFrontDistribution_Enabled (1728.08s)
--- PASS: TestAccAWSCloudFrontDistribution_S3OriginWithTags (1787.54s)
```
  • Loading branch information
@bflad
bflad committed Apr 15, 2019
1 parent f329cc9 commit 9b2beae
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 17 deletions.
20 changes: 20 additions & 0 deletions aws/provider_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,11 @@ func init() {
*providers = append(*providers, p.(*schema.Provider))
return p, nil
},
"tls": func() (terraform.ResourceProvider, error) {
p := tls.Provider()
*providers = append(*providers, p.(*schema.Provider))
return p, nil
},
}
}
testAccProvidersWithTLS = map[string]terraform.ResourceProvider{
Expand Down Expand Up @@ -254,6 +259,21 @@ provider "aws" {
`, os.Getenv("AWS_ALTERNATE_ACCESS_KEY_ID"), os.Getenv("AWS_ALTERNATE_PROFILE"), os.Getenv("AWS_ALTERNATE_SECRET_ACCESS_KEY"))
}

// Provider configuration hardcoded for us-east-1.
// This should only be necessary for testing ACM Certificates with CloudFront
// related infrastucture such as API Gateway Domain Names for EDGE endpoints,
// CloudFront Distribution Viewer Certificates, and Cognito User Pool Domains.
// Other valid usage is for services only available in us-east-1 such as the
// Cost and Usage Reporting and Pricing services.
func testAccUsEast1RegionProviderConfig() string {
return fmt.Sprintf(`
provider "aws" {
alias = "us-east-1"
region = "us-east-1"
}
`)
}

func testAccAwsRegionProviderFunc(region string, providers *[]*schema.Provider) func() *schema.Provider {
return func() *schema.Provider {
if region == "" {
Expand Down
32 changes: 15 additions & 17 deletions aws/resource_aws_cloudfront_distribution_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (
"github.com/aws/aws-sdk-go/service/cloudfront"
"github.com/hashicorp/terraform/helper/acctest"
"github.com/hashicorp/terraform/helper/resource"
"github.com/hashicorp/terraform/helper/schema"
"github.com/hashicorp/terraform/terraform"
)

Expand Down Expand Up @@ -719,13 +720,14 @@ func TestAccAWSCloudFrontDistribution_OrderedCacheBehavior_ForwardedValues_Heade

func TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn(t *testing.T) {
var distribution cloudfront.Distribution
var providers []*schema.Provider
resourceName := "aws_cloudfront_distribution.test"
retainOnDelete := testAccAWSCloudFrontDistributionRetainOnDeleteFromEnv()

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProvidersWithTLS,
CheckDestroy: testAccCheckCloudFrontDistributionDestroy,
PreCheck: func() { testAccPreCheck(t) },
ProviderFactories: testAccProviderFactories(&providers),
CheckDestroy: testAccCheckCloudFrontDistributionDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSCloudFrontDistributionConfigViewerCertificateAcmCertificateArn(retainOnDelete),
Expand All @@ -734,6 +736,7 @@ func TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn(t *tes
),
},
{
Config: testAccAWSCloudFrontDistributionConfigViewerCertificateAcmCertificateArn(retainOnDelete),
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
Expand All @@ -749,13 +752,14 @@ func TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn(t *tes
// Reference: https://github.com/terraform-providers/terraform-provider-aws/issues/7773
func TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn_ConflictsWithCloudFrontDefaultCertificate(t *testing.T) {
var distribution cloudfront.Distribution
var providers []*schema.Provider
resourceName := "aws_cloudfront_distribution.test"
retainOnDelete := testAccAWSCloudFrontDistributionRetainOnDeleteFromEnv()

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProvidersWithTLS,
CheckDestroy: testAccCheckCloudFrontDistributionDestroy,
PreCheck: func() { testAccPreCheck(t) },
ProviderFactories: testAccProviderFactories(&providers),
CheckDestroy: testAccCheckCloudFrontDistributionDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSCloudFrontDistributionConfigViewerCertificateAcmCertificateArnConflictsWithCloudFrontDefaultCertificate(retainOnDelete),
Expand All @@ -764,6 +768,7 @@ func TestAccAWSCloudFrontDistribution_ViewerCertificate_AcmCertificateArn_Confli
),
},
{
Config: testAccAWSCloudFrontDistributionConfigViewerCertificateAcmCertificateArnConflictsWithCloudFrontDefaultCertificate(retainOnDelete),
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
Expand Down Expand Up @@ -1093,7 +1098,6 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
bucket = "${aws_s3_bucket.s3_bucket_logs.id}.s3.amazonaws.com"
prefix = "myprefix"
}
aliases = [ "mysite.${var.rand_id}.example.com", "yoursite.${var.rand_id}.example.com" ]
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -1141,7 +1145,6 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
}
enabled = true
default_root_object = "index.html"
aliases = [ "mysite.${var.rand_id}.example.com", "yoursite.${var.rand_id}.example.com" ]
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -1193,7 +1196,6 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
}
enabled = true
default_root_object = "index.html"
aliases = [ "mysite.${var.rand_id}.example.com", "yoursite.${var.rand_id}.example.com" ]
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -1255,7 +1257,6 @@ resource "aws_cloudfront_distribution" "custom_distribution" {
bucket = "${aws_s3_bucket.s3_bucket_logs.id}.s3.amazonaws.com"
prefix = "myprefix"
}
aliases = [ "mysite.${var.rand_id}.example.com", "*.yoursite.${var.rand_id}.example.com" ]
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -1321,7 +1322,6 @@ resource "aws_cloudfront_distribution" "multi_origin_distribution" {
bucket = "${aws_s3_bucket.s3_bucket_logs.id}.s3.amazonaws.com"
prefix = "myprefix"
}
aliases = [ "mysite.${var.rand_id}.example.com", "*.yoursite.${var.rand_id}.example.com" ]
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -1677,7 +1677,6 @@ resource "aws_cloudfront_distribution" "main" {
}
enabled = true
comment = "Some comment"
aliases = []
default_cache_behavior {
allowed_methods = [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ]
cached_methods = [ "GET", "HEAD" ]
Expand Down Expand Up @@ -2297,12 +2296,9 @@ resource "aws_cloudfront_distribution" "test" {
`, retainOnDelete)
}

// CloudFront Distribution ACM Certificates must be created in us-east-1
func testAccAWSCloudFrontDistributionConfigViewerCertificateAcmCertificateArnBase(commonName string) string {
return fmt.Sprintf(`
provider "aws" {
region = "us-east-1"
}
return testAccUsEast1RegionProviderConfig() + fmt.Sprintf(`
resource "tls_private_key" "test" {
algorithm = "RSA"
}
Expand All @@ -2325,6 +2321,8 @@ resource "tls_self_signed_cert" "test" {
}
resource "aws_acm_certificate" "test" {
provider = "aws.us-east-1"
certificate_body = "${tls_self_signed_cert.test.cert_pem}"
private_key = "${tls_private_key.test.private_key_pem}"
}
Expand Down

0 comments on commit 9b2beae

Please sign in to comment.