Add support to import terraform aws_iam_group_policy resources

aws/resource_aws_iam_group_policy.go

@@ -22,6 +22,10 @@ func resourceAwsIamGroupPolicy() *schema.Resource {
 		Read:   resourceAwsIamGroupPolicyRead,
 		Delete: resourceAwsIamGroupPolicyDelete,
 
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"policy": {
 				Type:     schema.TypeString,
@@ -58,7 +62,13 @@ func resourceAwsIamGroupPolicyPut(d *schema.ResourceData, meta interface{}) erro
 	}
 
 	var policyName string
-	if v, ok := d.GetOk("name"); ok {
+	var err error
+	if !d.IsNewResource() {
+		_, policyName, err = resourceAwsIamGroupPolicyParseId(d.Id())
+		if err != nil {
+			return err
+		}
+	} else if v, ok := d.GetOk("name"); ok {
 		policyName = v.(string)
 	} else if v, ok := d.GetOk("name_prefix"); ok {
 		policyName = resource.PrefixedUniqueId(v.(string))
@@ -78,14 +88,16 @@ func resourceAwsIamGroupPolicyPut(d *schema.ResourceData, meta interface{}) erro
 func resourceAwsIamGroupPolicyRead(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
-	group, name := resourceAwsIamGroupPolicyParseId(d.Id())
+	group, name, err := resourceAwsIamGroupPolicyParseId(d.Id())
+	if err != nil {
+		return err
+	}
 
 	request := &iam.GetGroupPolicyInput{
 		PolicyName: aws.String(name),
 		GroupName:  aws.String(group),
 	}
 
-	var err error
 	getResp, err := iamconn.GetGroupPolicy(request)
 	if err != nil {
 		if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
@@ -105,17 +117,22 @@ func resourceAwsIamGroupPolicyRead(d *schema.ResourceData, meta interface{}) err
 		return err
 	}
 
-	d.Set("group", group)
-	d.Set("name", name)
-	d.Set("policy", policy)
-
-	return nil
+	if err := d.Set("policy", policy); err != nil {
+		return err
+	}
+	if err := d.Set("name", name); err != nil {
+		return err
+	}
+	return d.Set("group", group)
 }
 
 func resourceAwsIamGroupPolicyDelete(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
-	group, name := resourceAwsIamGroupPolicyParseId(d.Id())
+	group, name, err := resourceAwsIamGroupPolicyParseId(d.Id())
+	if err != nil {
+		return err
+	}
 
 	request := &iam.DeleteGroupPolicyInput{
 		PolicyName: aws.String(name),
@@ -131,8 +148,13 @@ func resourceAwsIamGroupPolicyDelete(d *schema.ResourceData, meta interface{}) e
 	return nil
 }
 
-func resourceAwsIamGroupPolicyParseId(id string) (groupName, policyName string) {
+func resourceAwsIamGroupPolicyParseId(id string) (groupName, policyName string, err error) {
 	parts := strings.SplitN(id, ":", 2)
+	if len(parts) != 2 {
+		err = fmt.Errorf("group_policy id must be of the form <group name>:<policy name>")
+		return
+	}
+
 	groupName = parts[0]
 	policyName = parts[1]
 	return

aws/resource_aws_iam_group_policy_test.go

@@ -139,6 +139,28 @@ func TestAccAWSIAMGroupPolicy_generatedName(t *testing.T) {
 	})
 }
 
+func TestAccAWSIAMGroupPolicy_importBasic(t *testing.T) {
+	suffix := randomString(10)
+	resourceName := fmt.Sprintf("aws_iam_group_policy.foo_%s", suffix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckIAMGroupPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsIamGroupPolicyConfig(suffix),
+			},
+
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckIAMGroupPolicyDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -147,23 +169,28 @@ func testAccCheckIAMGroupPolicyDestroy(s *terraform.State) error {
 			continue
 		}
 
-		group, name := resourceAwsIamGroupPolicyParseId(rs.Primary.ID)
+		group, name, err := resourceAwsIamGroupPolicyParseId(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
 
 		request := &iam.GetGroupPolicyInput{
 			PolicyName: aws.String(name),
 			GroupName:  aws.String(group),
 		}
 
-		_, err := conn.GetGroupPolicy(request)
+		getResp, err := conn.GetGroupPolicy(request)
 		if err != nil {
-			// Verify the error is what we want
-			if ae, ok := err.(awserr.Error); ok && ae.Code() == "NoSuchEntity" {
-				continue
+			if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
+				// none found, that's good
+				return nil
 			}
-			return err
+			return fmt.Errorf("Error reading IAM policy %s from group %s: %s", name, group, err)
 		}
 
-		return fmt.Errorf("still exists")
+		if getResp != nil {
+			return fmt.Errorf("Found IAM group policy, expected none: %s", getResp)
+		}
 	}
 
 	return nil
@@ -203,7 +230,11 @@ func testAccCheckIAMGroupPolicyExists(
 		}
 
 		iamconn := testAccProvider.Meta().(*AWSClient).iamconn
-		group, name := resourceAwsIamGroupPolicyParseId(policy.Primary.ID)
+		group, name, err := resourceAwsIamGroupPolicyParseId(policy.Primary.ID)
+		if err != nil {
+			return err
+		}
+
 		output, err := iamconn.GetGroupPolicy(&iam.GetGroupPolicyInput{
 			GroupName:  aws.String(group),
 			PolicyName: aws.String(name),
@@ -333,3 +364,26 @@ resource "aws_iam_group_policy" "bar" {
 }
 `, rInt, rInt, rInt)
 }
+
+func testAccAwsIamGroupPolicyConfig(suffix string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_group" "group_%[1]s" {
+	name = "tf_test_group_test_%[1]s"
+	path = "/"
+}
+resource "aws_iam_group_policy" "foo_%[1]s" {
+	name = "tf_test_policy_test_%[1]s"
+	group = "${aws_iam_group.group_%[1]s.name}"
+	policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": {
+    "Effect": "Allow",
+    "Action": "*",
+    "Resource": "*"
+  }
+}
+EOF
+}
+`, suffix)
+}

website/docs/r/iam_group_policy.html.markdown

@@ -56,3 +56,11 @@ assign a random, unique name.
 * `group` - The group to which this policy applies.
 * `name` - The name of the policy.
 * `policy` - The policy document attached to the group.
+
+## Import
+
+IAM Group Policies can be imported using the `group_name:group_policy_name`, e.g.
+
+```
+$ terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
+```