diff --git a/aws/resource_aws_ec2_client_vpn_endpoint.go b/aws/resource_aws_ec2_client_vpn_endpoint.go index dbfab48cac42..01a81abe5554 100644 --- a/aws/resource_aws_ec2_client_vpn_endpoint.go +++ b/aws/resource_aws_ec2_client_vpn_endpoint.go @@ -41,6 +41,11 @@ func resourceAwsEc2ClientVpnEndpoint() *schema.Resource { Type: schema.TypeString, Required: true, }, + "split_tunnel": { + Type: schema.TypeBool, + Optional: true, + Default: false, + }, "transport_protocol": { Type: schema.TypeString, Optional: true, @@ -120,6 +125,7 @@ func resourceAwsEc2ClientVpnEndpointCreate(d *schema.ResourceData, meta interfac ClientCidrBlock: aws.String(d.Get("client_cidr_block").(string)), ServerCertificateArn: aws.String(d.Get("server_certificate_arn").(string)), TransportProtocol: aws.String(d.Get("transport_protocol").(string)), + SplitTunnel: aws.Bool(d.Get("split_tunnel").(bool)), TagSpecifications: ec2TagSpecificationsFromMap(d.Get("tags").(map[string]interface{}), ec2.ResourceTypeClientVpnEndpoint), } @@ -226,6 +232,7 @@ func resourceAwsEc2ClientVpnEndpointRead(d *schema.ResourceData, meta interface{ d.Set("transport_protocol", result.ClientVpnEndpoints[0].TransportProtocol) d.Set("dns_name", result.ClientVpnEndpoints[0].DnsName) d.Set("status", result.ClientVpnEndpoints[0].Status) + d.Set("split_tunnel", result.ClientVpnEndpoints[0].SplitTunnel) err = d.Set("authentication_options", flattenAuthOptsConfig(result.ClientVpnEndpoints[0].AuthenticationOptions)) if err != nil { @@ -292,6 +299,10 @@ func resourceAwsEc2ClientVpnEndpointUpdate(d *schema.ResourceData, meta interfac req.ServerCertificateArn = aws.String(d.Get("server_certificate_arn").(string)) } + if d.HasChange("split_tunnel") { + req.SplitTunnel = aws.Bool(d.Get("split_tunnel").(bool)) + } + if d.HasChange("connection_log_options") { if v, ok := d.GetOk("connection_log_options"); ok { connSet := v.([]interface{}) diff --git a/aws/resource_aws_ec2_client_vpn_endpoint_test.go b/aws/resource_aws_ec2_client_vpn_endpoint_test.go index c1ef76bdd509..ee7324813153 100644 --- a/aws/resource_aws_ec2_client_vpn_endpoint_test.go +++ b/aws/resource_aws_ec2_client_vpn_endpoint_test.go @@ -223,6 +223,38 @@ func TestAccAwsEc2ClientVpnEndpoint_tags(t *testing.T) { }) } +func TestAccAwsEc2ClientVpnEndpoint_splitTunnel(t *testing.T) { + rName := acctest.RandomWithPrefix("tf-acc-test") + resourceName := "aws_ec2_client_vpn_endpoint.test" + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProvidersWithTLS, + CheckDestroy: testAccCheckAwsEc2ClientVpnEndpointDestroy, + Steps: []resource.TestStep{ + { + Config: testAccEc2ClientVpnEndpointConfigSplitTunnel(rName, true), + Check: resource.ComposeTestCheckFunc( + testAccCheckAwsEc2ClientVpnEndpointExists(resourceName), + resource.TestCheckResourceAttr(resourceName, "split_tunnel", "true"), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + { + Config: testAccEc2ClientVpnEndpointConfigSplitTunnel(rName, false), + Check: resource.ComposeTestCheckFunc( + testAccCheckAwsEc2ClientVpnEndpointExists(resourceName), + resource.TestCheckResourceAttr(resourceName, "split_tunnel", "false"), + ), + }, + }, + }) +} + func testAccCheckAwsEc2ClientVpnEndpointDestroy(s *terraform.State) error { conn := testAccProvider.Meta().(*AWSClient).ec2conn @@ -582,3 +614,49 @@ resource "aws_ec2_client_vpn_endpoint" "test" { } `, rName) } + +func testAccEc2ClientVpnEndpointConfigSplitTunnel(rName string, splitTunnel bool) string { + return fmt.Sprintf(` +resource "tls_private_key" "test" { + algorithm = "RSA" +} + +resource "tls_self_signed_cert" "test" { + allowed_uses = [ + "digital_signature", + "key_encipherment", + "server_auth", + ] + + key_algorithm = "RSA" + private_key_pem = "${tls_private_key.test.private_key_pem}" + validity_period_hours = 12 + + subject { + common_name = "example.com" + organization = "ACME Examples, Inc" + } +} + +resource "aws_acm_certificate" "test" { + certificate_body = "${tls_self_signed_cert.test.cert_pem}" + private_key = "${tls_private_key.test.private_key_pem}" +} + +resource "aws_ec2_client_vpn_endpoint" "test" { + client_cidr_block = "10.0.0.0/16" + description = %[1]q + server_certificate_arn = "${aws_acm_certificate.test.arn}" + split_tunnel = %[2]t + + authentication_options { + type = "certificate-authentication" + root_certificate_chain_arn = "${aws_acm_certificate.test.arn}" + } + + connection_log_options { + enabled = false + } +} +`, rName, splitTunnel) +} diff --git a/website/docs/r/ec2_client_vpn_endpoint.html.markdown b/website/docs/r/ec2_client_vpn_endpoint.html.markdown index 7699b32328f0..3aa8622667cb 100644 --- a/website/docs/r/ec2_client_vpn_endpoint.html.markdown +++ b/website/docs/r/ec2_client_vpn_endpoint.html.markdown @@ -36,14 +36,15 @@ resource "aws_ec2_client_vpn_endpoint" "example" { The following arguments are supported: -* `description` - (Optional) Name of the repository. +* `authentication_options` - (Required) Information about the authentication method to be used to authenticate clients. * `client_cidr_block` - (Required) The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater. +* `connection_log_options` - (Required) Information about the client connection logging options. +* `description` - (Optional) Name of the repository. * `dns_servers` - (Optional) Information about the DNS servers to be used for DNS resolution. A Client VPN endpoint can have up to two DNS servers. If no DNS server is specified, the DNS address of the VPC that is to be associated with Client VPN endpoint is used as the DNS server. * `server_certificate_arn` - (Required) The ARN of the ACM server certificate. -* `transport_protocol` - (Optional) The transport protocol to be used by the VPN session. Default value is `udp`. -* `authentication_options` - (Required) Information about the authentication method to be used to authenticate clients. -* `connection_log_options` - (Required) Information about the client connection logging options. +* `split_tunnel` - (Optional) Indicates whether split-tunnel is enabled on VPN endpoint. Default value is `false`. * `tags` - (Optional) A mapping of tags to assign to the resource. +* `transport_protocol` - (Optional) The transport protocol to be used by the VPN session. Default value is `udp`. ### `authentication_options` Argument Reference