INTMDB-133: Examples for encryption at rest with roles

GNUmakefile

@@ -1,4 +1,4 @@
-TEST?=./...
+TEST?=$$(go list ./... | grep -v /integration-testing)
 GOFMT_FILES?=$$(find . -name '*.go' |grep -v vendor)
 PKG_NAME=mongodbatlas
 WEBSITE_REPO=github.com/hashicorp/terraform-website
@@ -79,3 +79,6 @@ endif
 
 .PHONY: build test testacc fmt fmtcheck lint check tools test-compile website website-lint website-test
 
+terratest: fmtcheck
+	@$(eval VERSION=acc)
+	 go test $$(go list ./... | grep  /integration-testing) -v -parallel 20 $(TESTARGS) -timeout 120m -cover -ldflags="$(LINKER_FLAGS)"

examples/atlas-encryptionAtRest-roles/aws-roles.tf

@@ -0,0 +1,57 @@
+
+resource "mongodbatlas_cloud_provider_access" "test" {
+  project_id           = var.project_id
+  provider_name        = "AWS"
+  iam_assumed_role_arn = var.aws_iam_role_arn
+}
+
+resource "aws_iam_role_policy" "test_policy" {
+  name = "test_policy"
+  role = aws_iam_role.test_role.id
+
+  policy = <<-EOF
+  {
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+		"Action": "*",
+		"Resource": "*"
+      }
+    ]
+  }
+  EOF
+}
+
+resource "aws_iam_role" "test_role" {
+  name = "test_role"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "${mongodbatlas_cloud_provider_access.test.atlas_aws_account_arn}"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "${mongodbatlas_cloud_provider_access.test.atlas_assumed_role_external_id}"
+        }
+      }
+    }
+  ]
+}
+EOF
+
+
+}
+
+output "aws_iam_role_arn" {
+  value = aws_iam_role.test_role.arn
+}
+output "cpa_role_id" {
+  value = mongodbatlas_cloud_provider_access.test.role_id
+}

examples/atlas-encryptionAtRest-roles/provider.tf

@@ -0,0 +1,9 @@
+provider "mongodbatlas" {
+  public_key  = var.public_key
+  private_key = var.private_key
+}
+provider "aws" {
+  access_key = var.access_key
+  secret_key = var.secret_key
+  region     = var.aws_region
+}

examples/atlas-encryptionAtRest-roles/second_step/atlas-encryption.tf

@@ -0,0 +1,13 @@
+resource "mongodbatlas_encryption_at_rest" "test" {
+  project_id = var.project_id
+
+  aws_kms = {
+    access_key_id          = var.access_key
+    secret_access_key      = var.secret_key
+    enabled                = true
+    customer_master_key_id = var.customer_master_key
+    region                 = var.atlas_region
+    role_id                = var.cpa_role_id
+  }
+}
+

examples/atlas-encryptionAtRest-roles/second_step/provider.tf

@@ -0,0 +1,4 @@
+provider "mongodbatlas" {
+  public_key  = var.public_key
+  private_key = var.private_key
+}

examples/atlas-encryptionAtRest-roles/second_step/variables.tf

@@ -0,0 +1,33 @@
+variable "public_key" {
+  description = "The public API key for MongoDB Atlas"
+  default     = ""
+}
+variable "private_key" {
+  description = "The private API key for MongoDB Atlas"
+  default     = ""
+}
+variable "project_id" {
+  description = "Atlas project ID"
+  default     = ""
+}
+variable "customer_master_key" {
+  description = "The customer master secret key for AWS Account"
+  default     = ""
+}
+variable "atlas_region" {
+  default     = "US_EAST_1"
+  description = "Atlas Region"
+}
+
+variable "cpa_role_id" {
+  description = "AWS IAM ROLE ARN"
+  default     = ""
+}
+variable "access_key" {
+  description = "The access key for AWS Account"
+  default     = ""
+}
+variable "secret_key" {
+  description = "The secret key for AWS Account"
+  default     = ""
+}

examples/atlas-encryptionAtRest-roles/second_step/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    mongodbatlas = {
+      source = "mongodb/mongodbatlas"
+      //version = "0.7-dev"
+    }
+  }
+  required_version = ">= 0.13"
+}

examples/atlas-encryptionAtRest-roles/variables.tf

@@ -0,0 +1,36 @@
+variable "public_key" {
+  description = "The public API key for MongoDB Atlas"
+  default     = ""
+}
+variable "private_key" {
+  description = "The private API key for MongoDB Atlas"
+  default     = ""
+}
+variable "project_id" {
+  description = "Atlas project ID"
+  default     = ""
+}
+variable "access_key" {
+  description = "The access key for AWS Account"
+  default     = ""
+}
+variable "secret_key" {
+  description = "The secret key for AWS Account"
+  default     = ""
+}
+variable "customer_master_key" {
+  description = "The customer master secret key for AWS Account"
+  default     = ""
+}
+variable "atlas_region" {
+  default     = "US_EAST_1"
+  description = "Atlas Region"
+}
+variable "aws_region" {
+  default     = "us-east-1"
+  description = "AWS Region"
+}
+variable "aws_iam_role_arn" {
+  description = "AWS IAM ROLE ARN"
+  default     = ""
+}

examples/atlas-encryptionAtRest-roles/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    mongodbatlas = {
+      source = "mongodb/mongodbatlas"
+      //version = "0.7-dev"
+    }
+  }
+  required_version = ">= 0.13"
+}

go.mod

@@ -5,6 +5,7 @@ go 1.14
 require (
 	github.com/client9/misspell v0.3.4
 	github.com/go-test/deep v1.0.7
+	github.com/gruntwork-io/terratest v0.32.3
 	github.com/hashicorp/terraform-plugin-sdk v1.14.0
 	github.com/mongodb-forks/digest v1.0.1
 	github.com/mwielbut/pointy v1.1.0