{"action":"created","issue":{"url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5346","repository_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws","labels_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5346/labels{/name}","comments_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5346/comments","events_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5346/events","html_url":"https://github.com/terraform-providers/terraform-provider-aws/pull/5346","id":344807352,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA0MTEzNzA4","number":5346,"title":"[WIP] r/aws_elasticsearchdomain: add support for cognito_options","user":{"login":"aoggz","id":10116205,"node_id":"MDQ6VXNlcjEwMTE2MjA1","avatar_url":"https://avatars0.githubusercontent.com/u/10116205?v=4","gravatar_id":"","url":"https://api.github.com/users/aoggz","html_url":"https://github.com/aoggz","followers_url":"https://api.github.com/users/aoggz/followers","following_url":"https://api.github.com/users/aoggz/following{/other_user}","gists_url":"https://api.github.com/users/aoggz/gists{/gist_id}","starred_url":"https://api.github.com/users/aoggz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoggz/subscriptions","organizations_url":"https://api.github.com/users/aoggz/orgs","repos_url":"https://api.github.com/users/aoggz/repos","events_url":"https://api.github.com/users/aoggz/events{/privacy}","received_events_url":"https://api.github.com/users/aoggz/received_events","type":"User","site_admin":false},"labels":[{"id":620316241,"node_id":"MDU6TGFiZWw2MjAzMTYyNDE=","url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/labels/enhancement","name":"enhancement","color":"d4c5f9","default":true},{"id":801971640,"node_id":"MDU6TGFiZWw4MDE5NzE2NDA=","url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/labels/service/elasticsearch","name":"service/elasticsearch","color":"bfd4f2","default":false},{"id":737832189,"node_id":"MDU6TGFiZWw3Mzc4MzIxODk=","url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/labels/size/L","name":"size/L","color":"ffffff","default":false},{"id":623647943,"node_id":"MDU6TGFiZWw2MjM2NDc5NDM=","url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/labels/waiting-response","name":"waiting-response","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-26T11:36:58Z","updated_at":"2018-07-27T10:36:38Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/pulls/5346","html_url":"https://github.com/terraform-providers/terraform-provider-aws/pull/5346","diff_url":"https://github.com/terraform-providers/terraform-provider-aws/pull/5346.diff","patch_url":"https://github.com/terraform-providers/terraform-provider-aws/pull/5346.patch"},"body":"Fixes #4061\r\n\r\nChanges proposed in this pull request:\r\n\r\n* Add support for cognito_options in Elasticsearch domain creation.\r\n* Update documentation to reflect new functionality\r\n\r\nOutput from acceptance testing:\r\n\r\nMy test is currently failing. It looks like this is due to the 'behind-the-scenes' work that the Elasticsearch service is doing to configure Cognito to work with the cluster. It looks like the updates that the Elasticsearch service makes to the Cognito Identity Pool are being pulled in during the `refresh`, which is causing the test to fail (since tf wasn't aware of the 'initial' state).\r\n\r\nI'm opening this PR before the this change is ready because I couldn't find an instance in the repo where a similar situation is occurring and would greatly appreciate feedback on how best to handle this!\r\n\r\n```\r\n$ make testacc TEST=./aws TESTARGS='-run=TestAccAWSElasticSearchDomain_CognitoOptions'\r\n==> Checking that code complies with gofmt requirements...\r\nTF_ACC=1 go test ./aws -v -run=TestAccAWSElasticSearchDomain_CognitoOptions -timeout 120m\r\n=== RUN   TestAccAWSElasticSearchDomain_CognitoOptions\r\n--- FAIL: TestAccAWSElasticSearchDomain_CognitoOptions (749.37s)\r\n        testing.go:518: Step 0 error: After applying this step and refreshing, the plan was not empty:\r\n\r\n                DIFF:\r\n\r\n                UPDATE: aws_cognito_identity_pool.example\r\n                  cognito_identity_providers.#:                                 \"1\" => \"0\"\r\n                  cognito_identity_providers.188648750.client_id:               \"l5vruqq3skb07fcbq2dgfbfuo\" => \"\"\r\n                  cognito_identity_providers.188648750.provider_name:           \"cognito-idp.us-west-2.amazonaws.com/us-west-2_AhWuyNOVP\" => \"\"\r\n                  cognito_identity_providers.188648750.server_side_token_check: \"true\" => \"false\"\r\n\r\n                STATE:\r\n\r\n                aws_cognito_identity_pool.example:\r\n                  ID = us-west-2:41618e40-c687-4206-bdc9-08f70ed00de4\r\n                  provider = provider.aws\r\n                  allow_unauthenticated_identities = false\r\n                  arn = arn:aws:cognito-identity:us-west-2:143815088754:identitypool/us-west-2:41618e40-c687-4206-bdc9-08f70ed00de4\r\n                  cognito_identity_providers.# = 1\r\n                  cognito_identity_providers.188648750.client_id = l5vruqq3skb07fcbq2dgfbfuo\r\n                  cognito_identity_providers.188648750.provider_name = cognito-idp.us-west-2.amazonaws.com/us-west-2_AhWuyNOVP\r\n                  cognito_identity_providers.188648750.server_side_token_check = true\r\n                  developer_provider_name =\r\n                  identity_pool_name = tf_test_3433714343141331240\r\n                  openid_connect_provider_arns.# = 0\r\n                  saml_provider_arns.# = 0\r\n                  supported_login_providers.% = 0\r\n                aws_cognito_user_pool.example:\r\n                  ID = us-west-2_AhWuyNOVP\r\n                  provider = provider.aws\r\n                  admin_create_user_config.# = 1\r\n                  admin_create_user_config.0.allow_admin_create_user_only = false\r\n                  admin_create_user_config.0.invite_message_template.# = 0\r\n                  admin_create_user_config.0.unused_account_validity_days = 7\r\n                  arn = arn:aws:cognito-idp:us-west-2:143815088754:userpool/us-west-2_AhWuyNOVP\r\n                  auto_verified_attributes.# = 0\r\n                  creation_date = 2018-07-26T10:42:17Z\r\n                  device_configuration.# = 0\r\n                  email_configuration.# = 0\r\n                  endpoint = cognito-idp.us-west-2.amazonaws.com/us-west-2_AhWuyNOVP\r\n                  lambda_config.# = 0\r\n                  last_modified_date = 2018-07-26T10:42:17Z\r\n                  mfa_configuration = OFF\r\n                  name = tf-test-3433714343141331240\r\n                  password_policy.# = 1\r\n                  password_policy.0.minimum_length = 8\r\n                  password_policy.0.require_lowercase = true\r\n                  password_policy.0.require_numbers = true\r\n                  password_policy.0.require_symbols = true\r\n                  password_policy.0.require_uppercase = true\r\n                  schema.# = 0\r\n                  sms_configuration.# = 0\r\n                  tags.% = 0\r\n                  verification_message_template.# = 1\r\n                  verification_message_template.0.default_email_option = CONFIRM_WITH_CODE\r\n                  verification_message_template.0.email_message =\r\n                  verification_message_template.0.email_message_by_link =\r\n                  verification_message_template.0.email_subject =\r\n                  verification_message_template.0.email_subject_by_link =\r\n                  verification_message_template.0.sms_message =\r\n                aws_cognito_user_pool_domain.example:\r\n                  ID = tf-test-3433714343141331240\r\n                  provider = provider.aws\r\n                  aws_account_id = 143815088754\r\n                  cloudfront_distribution_arn = dpp0gtxikpq3y.cloudfront.net\r\n                  domain = tf-test-3433714343141331240\r\n                  s3_bucket = aws-cognito-prod-pdx-assets\r\n                  user_pool_id = us-west-2_AhWuyNOVP\r\n                  version = 20180726104218\r\n\r\n                  Dependencies:\r\n                    aws_cognito_user_pool.example\r\n                aws_elasticsearch_domain.example:\r\n                  ID = arn:aws:es:us-west-2:143815088754:domain/tf-test-3433714343141331240\r\n                  provider = provider.aws\r\n                  advanced_options.% = 1\r\n                  advanced_options.rest.action.multi.allow_explicit_index = true\r\n                  arn = arn:aws:es:us-west-2:143815088754:domain/tf-test-3433714343141331240\r\n                  cluster_config.# = 1\r\n                  cluster_config.0.dedicated_master_count = 0\r\n                  cluster_config.0.dedicated_master_enabled = false\r\n                  cluster_config.0.dedicated_master_type =\r\n                  cluster_config.0.instance_count = 1\r\n                  cluster_config.0.instance_type = m4.large.elasticsearch\r\n                  cluster_config.0.zone_awareness_enabled = false\r\n                  cognito_options.# = 1\r\n                  cognito_options.0.enabled = true\r\n                  cognito_options.0.identity_pool_id = us-west-2:41618e40-c687-4206-bdc9-08f70ed00de4\r\n                  cognito_options.0.role_arn = arn:aws:iam::143815088754:role/service-role/tf-test-3433714343141331240\r\n                  cognito_options.0.user_pool_id = us-west-2_AhWuyNOVP\r\n                  domain_id = 143815088754/tf-test-3433714343141331240\r\n                  domain_name = tf-test-3433714343141331240\r\n                  ebs_options.# = 1\r\n                  ebs_options.0.ebs_enabled = true\r\n                  ebs_options.0.iops = 0\r\n                  ebs_options.0.volume_size = 10\r\n                  ebs_options.0.volume_type = gp2\r\n                  elasticsearch_version = 6.0\r\n                  encrypt_at_rest.# = 1\r\n                  encrypt_at_rest.0.enabled = false\r\n                  encrypt_at_rest.0.kms_key_id =\r\n                  endpoint = search-tf-test-3433714343141331240-inqnpmzxqaq3vopfc5dlmpa7cy.us-west-2.es.amazonaws.com\r\n                  kibana_endpoint = search-tf-test-3433714343141331240-inqnpmzxqaq3vopfc5dlmpa7cy.us-west-2.es.amazonaws.com/_plugin/kibana/\r\n                  tags.% = 0\r\n\r\n                  Dependencies:\r\n                    aws_cognito_identity_pool.example\r\n                    aws_cognito_user_pool.example\r\n                    aws_iam_role.example\r\n                    aws_iam_role_policy_attachment.example\r\n                aws_iam_role.example:\r\n                  ID = tf-test-3433714343141331240\r\n                  provider = provider.aws\r\n                  arn = arn:aws:iam::143815088754:role/service-role/tf-test-3433714343141331240\r\n                  assume_role_policy = {\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"es.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}\r\n                  create_date = 2018-07-26T10:42:16Z\r\n                  force_detach_policies = false\r\n                  max_session_duration = 3600\r\n                  name = tf-test-3433714343141331240\r\n                  path = /service-role/\r\n                  unique_id = AROAJAHBDLICLKECWAC3I\r\n\r\n                  Dependencies:\r\n                    data.aws_iam_policy_document.assume-role-policy\r\n                aws_iam_role_policy_attachment.example:\r\n                  ID = tf-test-3433714343141331240-20180726104216418000000001\r\n                  provider = provider.aws\r\n                  policy_arn = arn:aws:iam::aws:policy/AmazonESCognitoAccess\r\n                  role = tf-test-3433714343141331240\r\n\r\n                  Dependencies:\r\n                    aws_iam_role.example\r\n                data.aws_iam_policy_document.assume-role-policy:\r\n                  ID = 196909887\r\n                  provider = provider.aws\r\n                  json = {\r\n                  \"Version\": \"2012-10-17\",\r\n                  \"Statement\": [\r\n                    {\r\n                      \"Sid\": \"\",\r\n                      \"Effect\": \"Allow\",\r\n                      \"Action\": \"sts:AssumeRole\",\r\n                      \"Principal\": {\r\n                        \"Service\": \"es.amazonaws.com\"\r\n                      }\r\n                    }\r\n                  ]\r\n                }\r\n                  statement.# = 1\r\n                  statement.0.actions.# = 1\r\n                  statement.0.actions.2528466339 = sts:AssumeRole\r\n                  statement.0.condition.# = 0\r\n                  statement.0.effect = Allow\r\n                  statement.0.not_actions.# = 0\r\n                  statement.0.not_principals.# = 0\r\n                  statement.0.not_resources.# = 0\r\n                  statement.0.principals.# = 1\r\n                  statement.0.principals.477085228.identifiers.# = 1\r\n                  statement.0.principals.477085228.identifiers.1393498159 = es.amazonaws.com\r\n                  statement.0.principals.477085228.type = Service\r\n                  statement.0.resources.# = 0\r\n                  statement.0.sid =\r\nFAIL\r\nFAIL    github.com/terraform-providers/terraform-provider-aws/aws       749.403s\r\nGNUmakefile:20: recipe for target 'testacc' failed\r\nmake: *** [testacc] Error 1\r\n\r\n...\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/comments/408381014","html_url":"https://github.com/terraform-providers/terraform-provider-aws/pull/5346#issuecomment-408381014","issue_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5346","id":408381014,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODM4MTAxNA==","user":{"login":"aoggz","id":10116205,"node_id":"MDQ6VXNlcjEwMTE2MjA1","avatar_url":"https://avatars0.githubusercontent.com/u/10116205?v=4","gravatar_id":"","url":"https://api.github.com/users/aoggz","html_url":"https://github.com/aoggz","followers_url":"https://api.github.com/users/aoggz/followers","following_url":"https://api.github.com/users/aoggz/following{/other_user}","gists_url":"https://api.github.com/users/aoggz/gists{/gist_id}","starred_url":"https://api.github.com/users/aoggz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoggz/subscriptions","organizations_url":"https://api.github.com/users/aoggz/orgs","repos_url":"https://api.github.com/users/aoggz/repos","events_url":"https://api.github.com/users/aoggz/events{/privacy}","received_events_url":"https://api.github.com/users/aoggz/received_events","type":"User","site_admin":false},"created_at":"2018-07-27T10:36:38Z","updated_at":"2018-07-27T10:36:38Z","author_association":"NONE","body":"@bflad Thanks for the feedback!\r\n\r\nI didn't find an issue already entered, but as I was about to enter one, I wondered if it makes sense to? It doesn't feel like an issue that needs fixed, since terraform is technically working as one would expect. The `lifecycle.ignore_changes` functionality looks like it would achieve the desired effect.\r\n\r\nI'll work on implementing the changes you suggested (thanks again!) and will enter the issue if you feel like it's the way we should go."}}
{"actor":{"display_login":"aoggz"}}