r/aws_imagebuilder_pipeline: add support for workflows

.changelog/37317.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_imagebuilder_image_pipeline: Add `execution_role` and `workflow` arguments
+```

internal/service/imagebuilder/image_pipeline.go

@@ -78,6 +78,11 @@ func ResourceImagePipeline() *schema.Resource {
  Optional: true,
  Default: true,
  },
+ "execution_role": {
+ Type: schema.TypeString,
+ Optional: true,
+ ValidateFunc: verify.ValidARN,
+ },
  "image_recipe_arn": {
  Type: schema.TypeString,
  Optional: true,
@@ -193,6 +198,47 @@ func ResourceImagePipeline() *schema.Resource {
  },
  names.AttrTags: tftags.TagsSchema(),
  names.AttrTagsAll: tftags.TagsSchemaComputed(),
+ "workflow": {
+ Type: schema.TypeList,
+ Optional: true,
+ Computed: true,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "on_failure": {
+ Type: schema.TypeString,
+ Optional: true,
+ ValidateFunc: validation.StringInSlice(imagebuilder.OnWorkflowFailure_Values(), false),
+ },
+ "parallel_group": {
+ Type: schema.TypeString,
+ Optional: true,
+ ValidateFunc: validation.StringLenBetween(1, 100),
+ },
+ names.AttrParameter: {
+ Type: schema.TypeSet,
+ Optional: true,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ names.AttrName: {
+ Type: schema.TypeString,
+ Required: true,
+ ValidateFunc: validation.StringLenBetween(1, 128),
+ },
+ names.AttrValue: {
+ Type: schema.TypeString,
+ Required: true,
+ },
+ },
+ },
+ },
+ "workflow_arn": {
+ Type: schema.TypeString,
+ Required: true,
+ ValidateFunc: verify.ValidARN,
+ },
+ },
+ },
+ },
  },
 
  CustomizeDiff: verify.SetTagsDiff,
@@ -221,6 +267,10 @@ func resourceImagePipelineCreate(ctx context.Context, d *schema.ResourceData, me
  input.DistributionConfigurationArn = aws.String(v.(string))
  }
 
+ if v, ok := d.GetOk("execution_role"); ok {
+ input.ExecutionRole = aws.String(v.(string))
+ }
+
  if v, ok := d.GetOk("image_recipe_arn"); ok {
  input.ImageRecipeArn = aws.String(v.(string))
  }
@@ -249,6 +299,10 @@ func resourceImagePipelineCreate(ctx context.Context, d *schema.ResourceData, me
  input.Status = aws.String(v.(string))
  }
 
+ if v, ok := d.GetOk("workflow"); ok && len(v.([]interface{})) > 0 {
+ input.Workflows = expandWorkflowConfigurations(v.([]interface{}))
+ }
+
  output, err := conn.CreateImagePipelineWithContext(ctx, input)
 
  if err != nil {
@@ -299,6 +353,7 @@ func resourceImagePipelineRead(ctx context.Context, d *schema.ResourceData, meta
  d.Set(names.AttrDescription, imagePipeline.Description)
  d.Set("distribution_configuration_arn", imagePipeline.DistributionConfigurationArn)
  d.Set("enhanced_image_metadata_enabled", imagePipeline.EnhancedImageMetadataEnabled)
+ d.Set("execution_role", imagePipeline.ExecutionRole)
  d.Set("image_recipe_arn", imagePipeline.ImageRecipeArn)
  if imagePipeline.ImageScanningConfiguration != nil {
  d.Set("image_scanning_configuration", []interface{}{flattenImageScanningConfiguration(imagePipeline.ImageScanningConfiguration)})
@@ -319,6 +374,7 @@ func resourceImagePipelineRead(ctx context.Context, d *schema.ResourceData, meta
  d.Set(names.AttrSchedule, nil)
  }
  d.Set(names.AttrStatus, imagePipeline.Status)
+ d.Set("workflow", flattenWorkflowConfigurations(imagePipeline.Workflows))
 
  setTagsOut(ctx, imagePipeline.Tags)
 
@@ -333,11 +389,13 @@ func resourceImagePipelineUpdate(ctx context.Context, d *schema.ResourceData, me
  names.AttrDescription,
  "distribution_configuration_arn",
  "enhanced_image_metadata_enabled",
+ "execution_role",
  "image_scanning_configuration",
  "image_tests_configuration",
  "infrastructure_configuration_arn",
  names.AttrSchedule,
  names.AttrStatus,
+ "workflow",
  ) {
  input := &imagebuilder.UpdateImagePipelineInput{
  ClientToken: aws.String(id.UniqueId()),
@@ -357,6 +415,10 @@ func resourceImagePipelineUpdate(ctx context.Context, d *schema.ResourceData, me
  input.DistributionConfigurationArn = aws.String(v.(string))
  }
 
+ if v, ok := d.GetOk("execution_role"); ok {
+ input.ExecutionRole = aws.String(v.(string))
+ }
+
  if v, ok := d.GetOk("image_recipe_arn"); ok {
  input.ImageRecipeArn = aws.String(v.(string))
  }
@@ -381,6 +443,10 @@ func resourceImagePipelineUpdate(ctx context.Context, d *schema.ResourceData, me
  input.Status = aws.String(v.(string))
  }
 
+ if v, ok := d.GetOk("workflow"); ok && len(v.([]interface{})) > 0 {
+ input.Workflows = expandWorkflowConfigurations(v.([]interface{}))
+ }
+
  _, err := conn.UpdateImagePipelineWithContext(ctx, input)
 
  if err != nil {

internal/service/imagebuilder/image_pipeline_test.go

@@ -644,6 +644,80 @@ func TestAccImageBuilderImagePipeline_tags(t *testing.T) {
  })
 }
 
+func TestAccImageBuilderImagePipeline_workflow(t *testing.T) {
+ ctx := acctest.Context(t)
+ rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+ resourceName := "aws_imagebuilder_image_pipeline.test"
+
+ resource.ParallelTest(t, resource.TestCase{
+ PreCheck: func() { acctest.PreCheck(ctx, t) },
+ ErrorCheck: acctest.ErrorCheck(t, names.ImageBuilderServiceID),
+ ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+ CheckDestroy: testAccCheckImagePipelineDestroy(ctx),
+ Steps: []resource.TestStep{
+ {
+ Config: testAccImagePipelineConfig_workflow(rName, imagebuilder.OnWorkflowFailureAbort, "test1"),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckImagePipelineExists(ctx, resourceName),
+ resource.TestCheckResourceAttr(resourceName, "workflow.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.on_failure", imagebuilder.OnWorkflowFailureAbort),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.parallel_group", "test1"),
+ ),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ },
+ {
+ Config: testAccImagePipelineConfig_workflow(rName, imagebuilder.OnWorkflowFailureContinue, "test2"),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckImagePipelineExists(ctx, resourceName),
+ resource.TestCheckResourceAttr(resourceName, "workflow.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.on_failure", imagebuilder.OnWorkflowFailureContinue),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.parallel_group", "test2"),
+ ),
+ },
+ },
+ })
+}
+
+func TestAccImageBuilderImagePipeline_workflowParameter(t *testing.T) {
+ ctx := acctest.Context(t)
+ rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+ resourceName := "aws_imagebuilder_image_pipeline.test"
+
+ resource.ParallelTest(t, resource.TestCase{
+ PreCheck: func() { acctest.PreCheck(ctx, t) },
+ ErrorCheck: acctest.ErrorCheck(t, names.ImageBuilderServiceID),
+ ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+ CheckDestroy: testAccCheckImagePipelineDestroy(ctx),
+ Steps: []resource.TestStep{
+ {
+ Config: testAccImagePipelineConfig_workflowParameter(rName),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckImagePipelineExists(ctx, resourceName),
+ resource.TestCheckResourceAttr(resourceName, "workflow.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.parameter.#", acctest.Ct1),
+ ),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ },
+ {
+ Config: testAccImagePipelineConfig_workflowParameter(rName),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckImagePipelineExists(ctx, resourceName),
+ resource.TestCheckResourceAttr(resourceName, "workflow.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "workflow.0.parameter.#", acctest.Ct1),
+ ),
+ },
+ },
+ })
+}
+
 func testAccCheckImagePipelineDestroy(ctx context.Context) resource.TestCheckFunc {
  return func(s *terraform.State) error {
  conn := acctest.Provider.Meta().(*conns.AWSClient).ImageBuilderConn(ctx)
@@ -705,6 +779,8 @@ data "aws_region" "current" {}
 
 data "aws_partition" "current" {}
 
+data "aws_caller_identity" "current" {}
+
 resource "aws_iam_instance_profile" "test" {
  name = aws_iam_role.role.name
  role = aws_iam_role.role.name
@@ -1105,3 +1181,104 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
+
+func testAccImagePipelineConfig_workflow(rName, onFailure, parallelGroup string) string {
+ return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_imagebuilder_workflow" "test" {
+ name = %[1]q
+ version = "1.0.0"
+ type = "TEST"
+
+ data = <<-EOT
+ name: test-image
+ description: Workflow to test an image
+ schemaVersion: 1.0
+
+ steps:
+ - name: LaunchTestInstance
+ action: LaunchInstance
+ onFailure: Abort
+ inputs:
+ waitFor: "ssmAgent"
+
+ - name: TerminateTestInstance
+ action: TerminateInstance
+ onFailure: Continue
+ inputs:
+ instanceId.$: "$.stepOutputs.LaunchTestInstance.instanceId"
+ EOT
+}
+
+resource "aws_imagebuilder_image_pipeline" "test" {
+ image_recipe_arn = aws_imagebuilder_image_recipe.test.arn
+ infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+ name = %[1]q
+
+ execution_role = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder"
+
+ workflow {
+ on_failure = %[2]q
+ parallel_group = %[3]q
+ workflow_arn = aws_imagebuilder_workflow.test.arn
+ }
+}
+`, rName, onFailure, parallelGroup))
+}
+
+func testAccImagePipelineConfig_workflowParameter(rName string) string {
+ return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_imagebuilder_workflow" "test" {
+ name = %[1]q
+ version = "1.0.0"
+ type = "TEST"
+
+ data = <<-EOT
+ name: test-image
+ description: Workflow to test an image
+ schemaVersion: 1.0
+
+ parameters:
+ - name: waitForActionAtEnd
+ type: boolean
+
+ steps:
+ - name: LaunchTestInstance
+ action: LaunchInstance
+ onFailure: Abort
+ inputs:
+ waitFor: "ssmAgent"
+
+ - name: TerminateTestInstance
+ action: TerminateInstance
+ onFailure: Continue
+ inputs:
+ instanceId.$: "$.stepOutputs.LaunchTestInstance.instanceId"
+
+ - name: WaitForActionAtEnd
+ action: WaitForAction
+ if:
+ booleanEquals: true
+ value: "$.parameters.waitForActionAtEnd"
+ EOT
+}
+
+resource "aws_imagebuilder_image_pipeline" "test" {
+ image_recipe_arn = aws_imagebuilder_image_recipe.test.arn
+ infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+ name = %[1]q
+
+ execution_role = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder"
+
+ workflow {
+ on_failure = "ABORT"
+ parallel_group = "test"
+ workflow_arn = aws_imagebuilder_workflow.test.arn
+
+ parameter {
+ name = "waitForActionAtEnd"
+ value = "true"
+ }
+ }
+}
+`, rName))
+}

website/docs/r/imagebuilder_image_pipeline.html.markdown

@@ -37,11 +37,13 @@ The following arguments are optional:
 * `description` - (Optional) Description of the image pipeline.
 * `distribution_configuration_arn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
 * `enhanced_image_metadata_enabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
+* `execution_role` - (Optional) Amazon Resource Name (ARN) of the service-linked role to be used by Image Builder to [execute workflows](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-image-workflows.html).
 * `image_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
 * `image_scanning_configuration` - (Optional) Configuration block with image scanning configuration. Detailed below.
 * `image_tests_configuration` - (Optional) Configuration block with image tests configuration. Detailed below.
 * `schedule` - (Optional) Configuration block with schedule settings. Detailed below.
 * `status` - (Optional) Status of the image pipeline. Valid values are `DISABLED` and `ENABLED`. Defaults to `ENABLED`.
+* `workflow` - (Optional) Configuration block with the workflow configuration. Detailed below.
 * `tags` - (Optional) Key-value map of resource tags for the image pipeline. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### image_scanning_configuration
@@ -77,6 +79,25 @@ The following arguments are optional:
 
 * `timezone` - (Optional) The timezone that applies to the scheduling expression. For example, "Etc/UTC", "America/Los_Angeles" in the [IANA timezone format](https://www.joda.org/joda-time/timezones.html). If not specified this defaults to UTC.
 
+### workflow
+
+The following arguments are required:
+
+* `workflow_arn` - (Required) Amazon Resource Name (ARN) of the Image Builder Workflow.
+
+The following arguments are optional:
+
+* `on_failure` - (Optional) The action to take if the workflow fails. Must be one of `CONTINUE` or `ABORT`.
+* `parallel_group` - (Optional) The parallel group in which to run a test Workflow.
+* `parameter` - (Optional) Configuration block for the workflow parameters. Detailed below.
+
+### parameter
+
+The following arguments are required:
+
+* `name` - (Required) The name of the Workflow parameter.
+* `value` - (Required) The value of the Workflow parameter.
+
 ## Attribute Reference
 
 This resource exports the following attributes in addition to the arguments above: