Skip to content

Commit c136548

Browse files
ChrisdeRChrisdeR
committed
modify description of is_enabled and is_archived, add keyState check before update keyState
1 parent 6b87f29 commit c136548

File tree

5 files changed

+100
-56
lines changed

5 files changed

+100
-56
lines changed

‎tencentcloud/resource_tc_kms_external_key.go‎

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func resourceTencentCloudKmsExternalKey() *schema.Resource {
4141
Type: schema.TypeString,
4242
Optional: true,
4343
Default: KMS_WRAPPING_ALGORITHM_RSAES_PKCS1_V1_5,
44-
Description: "The algorithm for encrypting key material. Available values include `RSAES_PKCS1_V1_5`, `RSAES_OAEP_SHA_1` and `RSAES_OAEP_SHA_256`.",
44+
Description: "The algorithm for encrypting key material. Available values include `RSAES_PKCS1_V1_5`, `RSAES_OAEP_SHA_1` and `RSAES_OAEP_SHA_256`. Default value is `RSAES_PKCS1_V1_5`.",
4545
},
4646
"key_material_base64": {
4747
Type: schema.TypeString,
@@ -274,21 +274,37 @@ func resourceTencentCloudKmsExternalKeyUpdate(d *schema.ResourceData, meta inter
274274
}
275275
}
276276

277-
if isArchived, ok := d.GetOk("is_archived"); ok {
278-
err := updateIsArchived(ctx, kmsService, keyId, isArchived.(bool))
279-
if err != nil {
280-
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
281-
return err
277+
var key *kms.KeyMetadata
278+
err := resource.Retry(readRetryTimeout, func() *resource.RetryError {
279+
result, e := kmsService.DescribeKeyById(ctx, keyId)
280+
if e != nil {
281+
return retryError(e)
282282
}
283-
d.SetPartial("is_archived")
284-
} else {
285-
isEnabled := d.Get("is_enabled").(bool)
286-
err := updateIsEnabled(ctx, kmsService, keyId, isEnabled)
287-
if err != nil {
288-
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
289-
return err
283+
key = result
284+
return nil
285+
})
286+
if err != nil {
287+
log.Printf("[CRITAL]%s read KMS external key failed, reason:%+v", logId, err)
288+
return err
289+
}
290+
291+
if *key.KeyState == KMS_KEY_STATE_ENABLED || *key.KeyState == KMS_KEY_STATE_DISABLED || *key.KeyState == KMS_KEY_STATE_ARCHIVED {
292+
if isArchived, ok := d.GetOk("is_archived"); ok {
293+
err := updateIsArchived(ctx, kmsService, keyId, isArchived.(bool))
294+
if err != nil {
295+
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
296+
return err
297+
}
298+
d.SetPartial("is_archived")
299+
} else {
300+
isEnabled := d.Get("is_enabled").(bool)
301+
err := updateIsEnabled(ctx, kmsService, keyId, isEnabled)
302+
if err != nil {
303+
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
304+
return err
305+
}
306+
d.SetPartial("is_enabled")
290307
}
291-
d.SetPartial("is_enabled")
292308
}
293309

294310
if d.HasChange("tags") {
@@ -367,11 +383,11 @@ func updateKeyMaterial(ctx context.Context, kmsService KmsService, d *schema.Res
367383
param["key_id"] = d.Id()
368384
param["algorithm"] = d.Get("wrapping_algorithm").(string)
369385
param["key_spec"] = KMS_WRAPPING_KEY_SPEC_RSA_2048
370-
param["key_material_base64"] = d.Get("key_material_base64")
386+
param["key_material_base64"] = d.Get("key_material_base64").(string)
371387
param["valid_to"] = d.Get("valid_to").(int)
372388

373389
var err error
374-
if param["key_material_base64"] == "" {
390+
if d.HasChange("key_material_base64") && param["key_material_base64"] == "" {
375391
err = resource.Retry(writeRetryTimeout, func() *resource.RetryError {
376392
e := kmsService.DeleteImportKeyMaterial(ctx, d.Id())
377393
if e != nil {

‎tencentcloud/resource_tc_kms_external_key_test.go‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,19 @@ func TestAccKmsExternalKey_basic(t *testing.T) {
2121
Config: testAccKmsExternalKey_basic(rName),
2222
Check: resource.ComposeTestCheckFunc(
2323
testAccCheckKmsKeyExists(resourceName),
24-
resource.TestCheckResourceAttr(resourceName, "is_enabled", "true"),
24+
resource.TestCheckResourceAttrSet(resourceName, "alias"),
25+
resource.TestCheckResourceAttrSet(resourceName, "description"),
26+
resource.TestCheckResourceAttr(resourceName, "key_state", "PendingImport"),
2527
resource.TestCheckResourceAttr(resourceName, "tags.test-tag", "unit-test"),
2628
),
2729
},
30+
{
31+
Config: testAccKmsExternalKey_import(rName),
32+
Check: resource.ComposeTestCheckFunc(
33+
testAccCheckKmsKeyExists(resourceName),
34+
resource.TestCheckResourceAttr(resourceName, "key_state", "Enabled"),
35+
),
36+
},
2837
{
2938
Config: testAccKmsExternalKey_disabled(rName),
3039
Check: resource.ComposeTestCheckFunc(
@@ -47,9 +56,22 @@ func testAccKmsExternalKey_basic(rName string) string {
4756
resource "tencentcloud_kms_external_key" "test" {
4857
alias = %[1]q
4958
description = %[1]q
59+
60+
tags = {
61+
"test-tag" = "unit-test"
62+
}
63+
}
64+
`, rName)
65+
}
66+
67+
func testAccKmsExternalKey_import(rName string) string {
68+
return fmt.Sprintf(`
69+
resource "tencentcloud_kms_external_key" "test" {
70+
alias = %[1]q
71+
description = %[1]q
5072
wrapping_algorithm = "RSAES_PKCS1_V1_5"
5173
key_material_base64 = "MTIzMTIzMTIzMTIzMTIzQQ=="
52-
is_enabled = true
74+
is_enabled = true
5375
5476
tags = {
5577
"test-tag" = "unit-test"

‎tencentcloud/resource_tc_kms_key.go‎

Lines changed: 39 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,13 @@ func TencentKmsBasicInfo() map[string]*schema.Schema {
5353
Type: schema.TypeBool,
5454
Optional: true,
5555
ConflictsWith: []string{"is_archived"},
56-
Description: "Specify whether to enable key. Default value is `false`.",
56+
Description: "Specify whether to enable key. Default value is `false`. This field is conflict with `is_archived`, valid when key_state is `Enabled`, `Disabled`, `Archived`.",
5757
},
5858
"is_archived": {
5959
Type: schema.TypeBool,
6060
Optional: true,
6161
ConflictsWith: []string{"is_enabled"},
62-
Description: "Specify whether to archive key. Default value is `false`.",
62+
Description: "Specify whether to archive key. Default value is `false`. This field is conflict with `is_enabled`, valid when key_state is `Enabled`, `Disabled`, `Archived`.",
6363
},
6464
"pending_delete_window_in_days": {
6565
Type: schema.TypeInt,
@@ -164,17 +164,19 @@ func resourceTencentCloudKmsKeyCreate(d *schema.ResourceData, meta interface{})
164164
}
165165
}
166166

167-
if keyRotationEnabled := d.Get("key_rotation_enabled").(bool); keyRotationEnabled {
168-
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
169-
e := kmsService.EnableKeyRotation(ctx, d.Id())
170-
if e != nil {
171-
return retryError(e)
167+
if keyUsage == KMS_KEY_USAGE_ENCRYPT_DECRYPT {
168+
if keyRotationEnabled := d.Get("key_rotation_enabled").(bool); keyRotationEnabled {
169+
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
170+
e := kmsService.EnableKeyRotation(ctx, d.Id())
171+
if e != nil {
172+
return retryError(e)
173+
}
174+
return nil
175+
})
176+
if err != nil {
177+
log.Printf("[CRITAL]%s modify KMS key rotation status failed, reason:%+v", logId, err)
178+
return err
172179
}
173-
return nil
174-
})
175-
if err != nil {
176-
log.Printf("[CRITAL]%s modify KMS key rotation status failed, reason:%+v", logId, err)
177-
return err
178180
}
179181
}
180182

@@ -299,31 +301,35 @@ func resourceTencentCloudKmsKeyUpdate(d *schema.ResourceData, meta interface{})
299301
d.SetPartial("alias")
300302
}
301303

302-
if isArchived, ok := d.GetOk("is_archived"); ok {
303-
err := updateIsArchived(ctx, kmsService, keyId, isArchived.(bool))
304-
if err != nil {
305-
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
306-
return err
307-
}
308-
d.SetPartial("is_archived")
309-
} else {
310-
isEnabled := d.Get("is_enabled").(bool)
311-
err := updateIsEnabled(ctx, kmsService, keyId, isEnabled)
312-
if err != nil {
313-
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
314-
return err
304+
if keyState := d.Get("key_state").(string); keyState == KMS_KEY_STATE_ENABLED || keyState == KMS_KEY_STATE_DISABLED || keyState == KMS_KEY_STATE_ARCHIVED {
305+
if isArchived, ok := d.GetOk("is_archived"); ok {
306+
err := updateIsArchived(ctx, kmsService, keyId, isArchived.(bool))
307+
if err != nil {
308+
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
309+
return err
310+
}
311+
d.SetPartial("is_archived")
312+
} else {
313+
isEnabled := d.Get("is_enabled").(bool)
314+
err := updateIsEnabled(ctx, kmsService, keyId, isEnabled)
315+
if err != nil {
316+
log.Printf("[CRITAL]%s modify key state failed, reason:%+v", logId, err)
317+
return err
318+
}
319+
d.SetPartial("is_enabled")
315320
}
316-
d.SetPartial("is_enabled")
317321
}
318322

319-
if d.HasChange("key_rotation_enabled") {
320-
keyRotationEnabled := d.Get("key_rotation_enabled").(bool)
321-
err := updateKeyRotationStatus(ctx, kmsService, keyId, keyRotationEnabled)
322-
if err != nil {
323-
log.Printf("[CRITAL]%s modify KMS key rotation status failed, reason:%+v", logId, err)
324-
return err
323+
if v := d.Get("key_usage").(string); v == KMS_KEY_USAGE_ENCRYPT_DECRYPT {
324+
if d.HasChange("key_rotation_enabled") {
325+
keyRotationEnabled := d.Get("key_rotation_enabled").(bool)
326+
err := updateKeyRotationStatus(ctx, kmsService, keyId, keyRotationEnabled)
327+
if err != nil {
328+
log.Printf("[CRITAL]%s modify KMS key rotation status failed, reason:%+v", logId, err)
329+
return err
330+
}
331+
d.SetPartial("key_rotation_enabled")
325332
}
326-
d.SetPartial("key_rotation_enabled")
327333
}
328334

329335
if d.HasChange("tags") {

‎website/docs/r/kms_external_key.html.markdown‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@ The following arguments are supported:
3030

3131
* `alias` - (Required) Name of CMK. The name can only contain English letters, numbers, underscore and hyphen '-'. The first character must be a letter or number.
3232
* `description` - (Optional) Description of CMK. The maximum is 1024 bytes.
33-
* `is_archived` - (Optional) Specify whether to archive key. Default value is `false`.
34-
* `is_enabled` - (Optional) Specify whether to enable key. Default value is `false`.
33+
* `is_archived` - (Optional) Specify whether to archive key. Default value is `false`. This field is conflict with `is_enabled`, valid when key_state is `Enabled`, `Disabled`, `Archived`.
34+
* `is_enabled` - (Optional) Specify whether to enable key. Default value is `false`. This field is conflict with `is_archived`, valid when key_state is `Enabled`, `Disabled`, `Archived`.
3535
* `key_material_base64` - (Optional) The base64-encoded key material encrypted with the public_key. For regions using the national secret version, the length of the imported key material is required to be 128 bits, and for regions using the FIPS version, the length of the imported key material is required to be 256 bits.
3636
* `pending_delete_window_in_days` - (Optional) Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 7 days.
3737
* `tags` - (Optional) Tags of CMK.
3838
* `valid_to` - (Optional) This value means the effective timestamp of the key material, 0 means it does not expire. Need to be greater than the current timestamp, the maximum support is 2147443200.
39-
* `wrapping_algorithm` - (Optional) The algorithm for encrypting key material. Available values include `RSAES_PKCS1_V1_5`, `RSAES_OAEP_SHA_1` and `RSAES_OAEP_SHA_256`.
39+
* `wrapping_algorithm` - (Optional) The algorithm for encrypting key material. Available values include `RSAES_PKCS1_V1_5`, `RSAES_OAEP_SHA_1` and `RSAES_OAEP_SHA_256`. Default value is `RSAES_PKCS1_V1_5`.
4040

4141
## Attributes Reference
4242

‎website/docs/r/kms_key.html.markdown‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ The following arguments are supported:
3232

3333
* `alias` - (Required) Name of CMK. The name can only contain English letters, numbers, underscore and hyphen '-'. The first character must be a letter or number.
3434
* `description` - (Optional) Description of CMK. The maximum is 1024 bytes.
35-
* `is_archived` - (Optional) Specify whether to archive key. Default value is `false`.
36-
* `is_enabled` - (Optional) Specify whether to enable key. Default value is `false`.
35+
* `is_archived` - (Optional) Specify whether to archive key. Default value is `false`. This field is conflict with `is_enabled`, valid when key_state is `Enabled`, `Disabled`, `Archived`.
36+
* `is_enabled` - (Optional) Specify whether to enable key. Default value is `false`. This field is conflict with `is_archived`, valid when key_state is `Enabled`, `Disabled`, `Archived`.
3737
* `key_rotation_enabled` - (Optional) Specify whether to enable key rotation, valid when key_usage is `ENCRYPT_DECRYPT`. Default value is `false`.
3838
* `key_usage` - (Optional, ForceNew) Usage of CMK. Available values include `ENCRYPT_DECRYPT`, `ASYMMETRIC_DECRYPT_RSA_2048`, `ASYMMETRIC_DECRYPT_SM2`, `ASYMMETRIC_SIGN_VERIFY_SM2`, `ASYMMETRIC_SIGN_VERIFY_RSA_2048`, `ASYMMETRIC_SIGN_VERIFY_ECC`. Default value is `ENCRYPT_DECRYPT`.
3939
* `pending_delete_window_in_days` - (Optional) Duration in days after which the key is deleted after destruction of the resource, must be between 7 and 30 days. Defaults to 7 days.

0 commit comments

Comments
 (0)