hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.

https://registry.terraform.io/providers/hashicorp/aws

Mozilla Public License 2.0

9.72k stars 9.08k forks source link

[Enhancement]: Validate OpenSearch Serverless JSON arguments #33721

Open jar-b opened 11 months ago

jar-b commented 11 months ago

Description

The OpenSearch Serverless access policy and security policy resources currently only validate length limits for their respective policy arguments. Confirming the string is valid JSON and contains no duplicate keys could produce improved error messaging for practitioners.

https://github.com/hashicorp/terraform-provider-aws/blob/c611551eff6d062ae985126576a99b14aaba7be7/internal/service/opensearchserverless/access_policy.go#L78-L83

https://github.com/hashicorp/terraform-provider-aws/blob/c611551eff6d062ae985126576a99b14aaba7be7/internal/service/opensearchserverless/security_policy.go#L78-L83

Affected Resource(s) and/or Data Source(s)

aws_opensearchserverless_access_policy
aws_opensearchserverless_security_policy

Potential Terraform Configuration

No response

References

Relates #33026

Would you like to implement a fix?

None

github-actions[bot] commented 11 months ago

Community Note

Voting for Prioritization

Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
Please see our prioritization guide for information on how we prioritize.
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

If you are interested in working on this issue, please leave a comment.
If this would be your first contribution, please review the contribution guide.

jar-b commented 11 months ago

Worth noting that unlike the JSON arguments in the iam package, these policy values are sent directly to the AWS API as-is rather than being normalized to suppress differences. Assuming AWS detects duplicate keys this enhancement wouldn't add new security, simply a cleaner provider-generated message when invalid values are provided.

https://github.com/hashicorp/terraform-provider-aws/blob/c611551eff6d062ae985126576a99b14aaba7be7/internal/service/opensearchserverless/security_policy.go#L114

https://github.com/hashicorp/terraform-provider-aws/blob/c611551eff6d062ae985126576a99b14aaba7be7/internal/service/opensearchserverless/security_policy.go#L256-L264