update kms instance policies (#5346)

* use new go sdk for kms that uses pointers for policy bools, removed kcia defaults and changed to Computed, when enabled is false, don't update any other attributes, updated resource docs to reflect not using enabled=false with any other attributes * update networking go sdk version to resolve conflict * move back to using defaults --------- Co-authored-by: wsiew <wsiew@ibm.com>
IBM-Cloud · May 17, 2024 · 500e25c · 500e25c
1 parent a4b10f8
commit 500e25c
Show file tree

Hide file tree

Showing 5 changed files with 64 additions and 18 deletions.
diff --git a/go.mod b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/IBM/ibm-cos-sdk-go-config/v2 v2.0.4
 	github.com/IBM/ibm-hpcs-tke-sdk v0.0.0-20211109141421-a4b61b05f7d1
 	github.com/IBM/ibm-hpcs-uko-sdk v0.0.20-beta
-	github.com/IBM/keyprotect-go-client v0.12.2
+	github.com/IBM/keyprotect-go-client v0.14.0
 	github.com/IBM/networking-go-sdk v0.45.0
 	github.com/IBM/platform-services-go-sdk v0.62.10
 	github.com/IBM/project-go-sdk v0.2.8-1

diff --git a/go.sum b/go.sum
@@ -152,8 +152,8 @@ github.com/IBM/ibm-hpcs-tke-sdk v0.0.0-20211109141421-a4b61b05f7d1/go.mod h1:M2J
 github.com/IBM/ibm-hpcs-uko-sdk v0.0.20-beta h1:P1fdIfKsD9xvJQ5MHIEztPS9yfNf9x+VDTamaYcmqcs=
 github.com/IBM/ibm-hpcs-uko-sdk v0.0.20-beta/go.mod h1:MLVNHMYoKsvovJZ4v1gQCpIYtRDHTtoIHK6XztDZGsU=
 github.com/IBM/keyprotect-go-client v0.5.1/go.mod h1:5TwDM/4FRJq1ZOlwQL1xFahLWQ3TveR88VmL1u3njyI=
-github.com/IBM/keyprotect-go-client v0.12.2 h1:Cjxcqin9Pl0xz3MnxdiVd4v/eIa79xL3hQpSbwOr/DQ=
-github.com/IBM/keyprotect-go-client v0.12.2/go.mod h1:yr8h2noNgU8vcbs+vhqoXp3Lmv73PI0zAc6VMgFvWwM=
+github.com/IBM/keyprotect-go-client v0.14.0 h1:GqgK3BdczA/w7+B1RxEPLya0w9S/ZXi5YWKAxdW8vHQ=
+github.com/IBM/keyprotect-go-client v0.14.0/go.mod h1:cAt714Vnwnd03mmkBHHSJlDNRVthdRmJB6RePd4/B8Q=
 github.com/IBM/mqcloud-go-sdk v0.0.4 h1:gqMpoU5a0qJ0GETG4PQrkgeEEoaQLvbxRJnEe6ytvC4=
 github.com/IBM/mqcloud-go-sdk v0.0.4/go.mod h1:gQptHC6D+rxfg0muRFFGvTDmvl4YfiDE0uXkaRRewRk=
 github.com/IBM/networking-go-sdk v0.45.0 h1:tYgDhVDpgKvELNY7tcodbZ4ny9fatpEWM6PwtQcDe20=

diff --git a/ibm/flex/structures.go b/ibm/flex/structures.go
@@ -3157,12 +3157,25 @@ func FlattenInstancePolicy(policyType string, policies []kp.InstancePolicy) []ma
 			metricsMap = append(metricsMap, policyInstance)
 		}
 		if policy.PolicyType == "keyCreateImportAccess" {
-			policyInstance["enabled"] = policy.PolicyData.Enabled
-			policyInstance["create_root_key"] = policy.PolicyData.Attributes.CreateRootKey
-			policyInstance["create_standard_key"] = policy.PolicyData.Attributes.CreateStandardKey
-			policyInstance["import_root_key"] = policy.PolicyData.Attributes.ImportRootKey
-			policyInstance["import_standard_key"] = policy.PolicyData.Attributes.ImportStandardKey
-			policyInstance["enforce_token"] = policy.PolicyData.Attributes.EnforceToken
+			if policy.PolicyData.Enabled != nil {
+				policyInstance["enabled"] = *policy.PolicyData.Enabled
+			}
+			if policy.PolicyData.Attributes.CreateRootKey != nil {
+				policyInstance["create_root_key"] = *policy.PolicyData.Attributes.CreateRootKey
+			}
+			if policy.PolicyData.Attributes.CreateStandardKey != nil {
+				policyInstance["create_standard_key"] = *policy.PolicyData.Attributes.CreateStandardKey
+			}
+			if policy.PolicyData.Attributes.ImportRootKey != nil {
+				policyInstance["import_root_key"] = *policy.PolicyData.Attributes.ImportRootKey
+			}
+			if policy.PolicyData.Attributes.ImportStandardKey != nil {
+				policyInstance["import_standard_key"] = *policy.PolicyData.Attributes.ImportStandardKey
+			}
+			if policy.PolicyData.Attributes.EnforceToken != nil {
+				policyInstance["enforce_token"] = *policy.PolicyData.Attributes.EnforceToken
+			}
+
 			keyCreateImportAccessMap = append(keyCreateImportAccessMap, policyInstance)
 		}
 	}

diff --git a/ibm/service/kms/resource_ibm_kms_instance_policies.go b/ibm/service/kms/resource_ibm_kms_instance_policies.go
@@ -331,13 +331,30 @@ func policyCreateOrUpdate(context context.Context, d *schema.ResourceData, kpAPI
 	if kciaip, ok := d.GetOk("key_create_import_access"); ok {
 		kciaipList := kciaip.([]interface{})
 		if len(kciaipList) != 0 {
-			mulPolicy.KeyCreateImportAccess = &kp.KeyCreateImportAccessInstancePolicy{
-				Enabled:           kciaipList[0].(map[string]interface{})["enabled"].(bool),
-				CreateRootKey:     kciaipList[0].(map[string]interface{})["create_root_key"].(bool),
-				CreateStandardKey: kciaipList[0].(map[string]interface{})["create_standard_key"].(bool),
-				ImportRootKey:     kciaipList[0].(map[string]interface{})["import_root_key"].(bool),
-				ImportStandardKey: kciaipList[0].(map[string]interface{})["import_standard_key"].(bool),
-				EnforceToken:      kciaipList[0].(map[string]interface{})["enforce_token"].(bool),
+			enabled := kciaipList[0].(map[string]interface{})["enabled"].(bool)
+			create_root_key := kciaipList[0].(map[string]interface{})["create_root_key"].(bool)
+			create_standard_key := kciaipList[0].(map[string]interface{})["create_standard_key"].(bool)
+			import_root_key := kciaipList[0].(map[string]interface{})["import_root_key"].(bool)
+			import_standard_key := kciaipList[0].(map[string]interface{})["import_standard_key"].(bool)
+			enforce_token := kciaipList[0].(map[string]interface{})["enforce_token"].(bool)
+
+			// we must make sure not to attempt any updates on attributes when enabled is false or face input validation errors
+			if enabled {
+				mulPolicy.KeyCreateImportAccess = &kp.KeyCreateImportAccessInstancePolicy{
+					Enabled: enabled,
+					Attributes: &kp.KeyCreateImportAccessInstancePolicyAttributes{
+						CreateRootKey:     &create_root_key,
+						CreateStandardKey: &create_standard_key,
+						ImportRootKey:     &import_root_key,
+						ImportStandardKey: &import_standard_key,
+						EnforceToken:      &enforce_token,
+					},
+				}
+			} else {
+				mulPolicy.KeyCreateImportAccess = &kp.KeyCreateImportAccessInstancePolicy{
+					Enabled:    enabled,
+					Attributes: nil,
+				}
 			}
 		}
 	}

diff --git a/website/docs/r/kms_instance_policies.html.markdown b/website/docs/r/kms_instance_policies.html.markdown
@@ -40,14 +40,30 @@ resource "ibm_kms_instance_policies" "instance_policy" {
         enabled = true
     }
     key_create_import_access {
-      enable = true
+        enabled = true
     }
 }
 
 ```
 
 **NOTE** 
-- To create an instance policy, atleast one of the policy block as mentioned in the argument section is mandatory.
+- When setting `enabled=false`, you must not specify any other attributes for that policy. The below is an example of an invalid setting
+
+```terraform
+    key_create_import_access {
+        enabled = false
+        import_root_key = false
+    }
+```
+
+The extra attributes will be ignored and will not be updated, this can also cause state drift. Users are advised to only use the `enabled` attribute when disabling a policy
+
+```terraform
+    key_create_import_access {
+        enabled = false
+    }
+```
+
 
 - Policies `allowedIP` and `allowedNetwork` are not supported by instance_policies resource, and can be set using Context Based Restrictions (CBR).
 ## Argument reference