sos: introduce bucket policy resource (#391)

Since the AWS provider isn't compatible anymore with our bucket policy
format we introduce our own resource for this purpose.

It was necessary to update
`github.com/hashicorp/terraform-plugin-testing` because it required each
resource to have an "id" attribute, which is not actually required by
terraform itself, only by this testing library. Thus this requirement
was removed in
[v1.5.0](https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes).

---------

Co-authored-by: Predrag Janosevic <[email protected]>

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+FEATURES:
+
+- sos: introduce bucket policy resource #391
+
 ## 0.61.1
 
 BUG FIXES:
@@ -31,7 +35,7 @@ BUG FIXES:
 
 FEATURES:
 
-- exoscale_compute_instance: mac address attribute #373 
+- exoscale_compute_instance: mac address attribute #373
 
 BUG FIXES:
 
@@ -54,14 +58,14 @@ BUG FIXES:
 IMPROVEMENTS:
 
 - `exoscale_instance_pool`: add `anti-affinity-group` & deprecate `affinity-group` #355
-- template: document ignore_changes #368 
+- template: document ignore_changes #368
 
 ## 0.59.1 (June 3, 2024)
 
 IMPROVEMENTS
 
-- SKS: document dependency of CSI on CCM #359 
-- go.mk: lint with staticcheck #364 
+- SKS: document dependency of CSI on CCM #359
+- go.mk: lint with staticcheck #364
 
 BUG FIXES
 
@@ -72,7 +76,7 @@ BUG FIXES
 
 FEATURES:
 
-- block-storage: update names and labels of volumes and snapshots #354 
+- block-storage: update names and labels of volumes and snapshots #354
 
 BUG FIXES:
 
@@ -85,13 +89,13 @@ FEATURES:
 - Add Kubelet Image GC support for SKS nodepools
 - Block storage volume resource & data source #341
 - Block storage volume snapshot resource & data source #344
-- sks_cluster: enable CSI addon on existing clusters #350 
+- sks_cluster: enable CSI addon on existing clusters #350
 
 BUG FIXES:
 
 - Fix dbaas bugs causing acceptance tests to fail #346
-- docs: fix example in index.md #345 
-- Set labels on unmanaged eip creation #347 
+- docs: fix example in index.md #345
+- Set labels on unmanaged eip creation #347
 
 ## 0.57.0 (April 3, 2024)
 
@@ -101,13 +105,13 @@ FEATURES:
 
 IMPROVEMENTS:
 
-- go.mk: remove submodule and initialize through make #338 
+- go.mk: remove submodule and initialize through make #338
 
 ## 0.56.0 (February 28, 2024)
 
 FEATURES:
 
-- compute_instance: add destroy_protected attr #337 
+- compute_instance: add destroy_protected attr #337
 
 IMPROVEMENTS:
 
@@ -118,7 +122,7 @@ IMPROVEMENTS:
 IMPROVEMENTS:
 
 - Bump golang.org/x/crypto from 0.14.0 to 0.17.0 (#323)
-- sks_nodepool: add an example for taints #324 
+- sks_nodepool: add an example for taints #324
 - SKS tests: renable cluster update test as upstream bug is fixed (#309)
 - Make `iam_role.name` attribute require replace as per API behavior (#330)
 - Handle DNS record normalization #332

docs/data-sources/sos_bucket_policy.md

@@ -0,0 +1,38 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "exoscale_sos_bucket_policy Data Source - terraform-provider-exoscale"
+subcategory: ""
+description: |-
+  Fetch Exoscale SOS Bucket Policies https://community.exoscale.com/documentation/storage/bucketpolicy/.
+---
+
+# exoscale_sos_bucket_policy (Data Source)
+
+Fetch Exoscale [SOS Bucket Policies](https://community.exoscale.com/documentation/storage/bucketpolicy/).
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `bucket` (String) The name of the bucket to which the policy is to be applied.
+- `zone` (String) The Exoscale [Zone](https://www.exoscale.com/datacenters/) name.
+
+### Optional
+
+- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+
+### Read-Only
+
+- `policy` (String) The content of the policy
+
+<a id="nestedblock--timeouts"></a>
+### Nested Schema for `timeouts`
+
+Optional:
+
+- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
+
+

docs/index.md

@@ -51,6 +51,7 @@ provider "exoscale" {
 - `environment` (String)
 - `key` (String) Exoscale API key
 - `secret` (String, Sensitive) Exoscale API secret
+- `sos_endpoint` (String)
 - `timeout` (Number) Timeout in seconds for waiting on compute resources to become available (by default: 300)
 
 ### Fine-tuning Timeout durations

docs/resources/sos_bucket_policy.md

@@ -0,0 +1,40 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "exoscale_sos_bucket_policy Resource - terraform-provider-exoscale"
+subcategory: ""
+description: |-
+  Manage Exoscale SOS Bucket Policies https://community.exoscale.com/documentation/storage/bucketpolicy/.
+---
+
+# exoscale_sos_bucket_policy (Resource)
+
+Manage Exoscale [SOS Bucket Policies](https://community.exoscale.com/documentation/storage/bucketpolicy/).
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `bucket` (String) ❗ The name of the bucket to which the policy is to be applied.
+- `policy` (String) The content of the policy
+- `zone` (String) ❗ The Exoscale [Zone](https://www.exoscale.com/datacenters/) name.
+
+### Optional
+
+- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+
+<a id="nestedblock--timeouts"></a>
+### Nested Schema for `timeouts`
+
+Optional:
+
+- `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+- `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
+- `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+
+-> The symbol ❗ in an attribute indicates that modifying it, will force the creation of a new resource.
+
+

examples/sos-bucket-policy/README.md

@@ -0,0 +1,20 @@
+# SOS Bucket Policies
+
+This example demonstrates how to manage Exoscale [SOS Bucket Policies](https://community.exoscale.com/documentation/storage/bucketpolicy/).
+
+```console
+terraform init
+terraform apply \
+  -var exoscale_api_key=$EXOSCALE_API_KEY \
+  -var exoscale_api_secret=$EXOSCALE_API_SECRET
+
+...
+
+Outputs:
+
+my_bucket_uri = <<EOT
+https://sos-ch-gva-2.exo.io/my-bucket-6bed6744-c98e-aaba-1710-3ac09522348e
+
+EOT
+my_data_policy = "{\"default-service-strategy\":\"allow\",\"services\":{\"sos\":{\"type\":\"allow\"}}}"
+```

examples/sos-bucket-policy/bucket_policy.json.tpl

@@ -0,0 +1,8 @@
+{
+  "default-service-strategy": "allow",
+  "services": {
+    "sos": {
+      "type": "allow"
+    }
+  }
+}

examples/sos-bucket-policy/main.tf

@@ -0,0 +1,41 @@
+# Providers
+# -> providers.tf
+
+# Customizable parameters
+locals {
+  my_zone   = "ch-gva-2"
+  my_bucket = "my-bucket"
+}
+
+# Sample random UUID
+resource "random_uuid" "my_uuid" {
+}
+
+# SOS bucket
+resource "aws_s3_bucket" "my_bucket" {
+  bucket = "${local.my_bucket}-${resource.random_uuid.my_uuid.result}"
+}
+
+resource "exoscale_sos_bucket_policy" "my_policy" {
+  bucket = aws_s3_bucket.my_bucket.bucket
+  policy = templatefile("${path.module}/bucket_policy.json.tpl", {})
+  zone   = local.my_zone
+}
+
+data "exoscale_sos_bucket_policy" "my_policy_ds" {
+  bucket = exoscale_sos_bucket_policy.my_policy.bucket
+  zone   = local.my_zone
+}
+
+# Outputs
+output "my_bucket_uri" {
+  value = format(
+    "https://sos-%s.exo.io/%s\n",
+    aws_s3_bucket.my_bucket.region,
+    aws_s3_bucket.my_bucket.bucket,
+  )
+}
+
+output "my_data_policy" {
+  value = data.exoscale_sos_bucket_policy.my_policy_ds.policy
+}

examples/sos-bucket-policy/providers.tf

@@ -0,0 +1,27 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    exoscale = {
+      source = "exoscale/exoscale"
+    }
+  }
+}
+
+variable "exoscale_api_key" { type = string }
+variable "exoscale_api_secret" { type = string }
+provider "aws" {
+  access_key = var.exoscale_api_key
+  secret_key = var.exoscale_api_secret
+
+  region = local.my_zone
+  endpoints {
+    s3 = "https://sos-${local.my_zone}.exo.io"
+  }
+
+  # Disable AWS-specific features
+  skip_credentials_validation = true
+  skip_region_validation      = true
+  skip_requesting_account_id  = true
+}

exoscale/provider.go

@@ -65,6 +65,10 @@ func Provider() *schema.Provider {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
+			"sos_endpoint": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 			"timeout": {
 				Type:     schema.TypeFloat,
 				Optional: true,
@@ -183,6 +187,13 @@ func ProviderConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 			DefaultEnvironment)
 	}
 
+	sosEndpoint, sosEndpointOK := d.GetOk("sos_endpoint")
+	if !sosEndpointOK {
+		environment = providerConfig.GetEnvDefault(
+			"EXOSCALE_SOS_ENDPOINT",
+			providerConfig.GetEnvDefault("EXOSCALE_STORAGE_API_ENDPOINT", ""))
+	}
+
 	if keyOK || secretOK {
 		if !keyOK || !secretOK {
 			return nil, diag.Errorf(
@@ -211,6 +222,7 @@ func ProviderConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 		Secret:      secret.(string),
 		Timeout:     ConvertTimeout(timeout),
 		Environment: environment.(string),
+		SOSEndpoint: sosEndpoint.(string),
 	}
 
 	clv2, err := CreateClient(&baseConfig)
@@ -237,10 +249,11 @@ func ProviderConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 	exov3.UserAgent = UserAgent
 
 	return map[string]interface{}{
-			"config":      baseConfig,
-			"client":      clv2,
-			"clientV3":    clv3,
-			"environment": environment,
+			"config":       baseConfig,
+			"client":       clv2,
+			"clientV3":     clv3,
+			"environment":  environment,
+			"sos_endpoint": sosEndpoint,
 		},
 		diags
 }