databricks / terraform-provider-databricks

Databricks Terraform Provider
https://registry.terraform.io/providers/databricks/databricks/latest
Other
445 stars 384 forks source link

[ISSUE] Issue with `databricks_aws_bucket_policy` resource does not work in other partitions #4054

Open drew-altana opened 2 days ago

drew-altana commented 2 days ago

Configuration

# Copy-paste your Terraform configuration here

data "databricks_aws_bucket_policy" "this" { bucket = "mycoolbucket" }

resource "aws_s3_bucket_policy" "root_bucket_policy" { bucket = "mycoolbucket" policy = data.databricks_aws_bucket_policy.this.json }


### Expected Behavior
Arns generated are in the wrong partiton
### Actual Behavior

api error MalformedPolicy: Invalid principal in policy

  "bucketPolicy": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": [
                        "s3:GetObject",
                        "s3:GetObjectVersion",
                        "s3:PutObject",
                        "s3:DeleteObject",
                        "s3:ListBucket",
                        "s3:GetBucketLocation"
                    ],
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::414351767826:root"
                    },
                    "Resource": [
                        "arn:aws:s3:::mycoolbucket/*",
                        "arn:aws:s3:::mycoolbucket"
                    ]
                }
            ]
        },
        "bucketName": "mycoolbucket",
        "Host": "mycoolbucket.s3.us-gov-west-1.amazonaws.com",
        "policy": ""
    },
### Steps to Reproduce
1. `terraform apply`-->

### Terraform and provider versions
1.51.0

### Is it a regression?
unknown

### Debug Output

### Important Factoids

This is for us-gov-west-1 it's obvious the code here is not partition aware:

https://github.com/databricks/terraform-provider-databricks/blob/b827aeccb86c1cd7c5803e8a755d7085ebbdb207/aws/data_aws_bucket_policy.go#L33

### Would you like to implement a fix?
No
drew-altana commented 2 days ago

Appears that a bunch of places have the partition hard coded? https://github.com/search?q=repo%3Adatabricks%2Fterraform-provider-databricks+%22arn%3Aaws%22+path%3Aaws%2F*.go&type=code

I guess it's safe to assume govcloud support isn't available via this terraform provider yet?