Merge pull request #106 from DopplerHQ/andre/aws-resource-tags

Add ability to update AWS resource tags for SM and PS syncs
DopplerHQ · Nov 6, 2024 · 220278b · 220278b
2 parents a012e1a + b51cb8f
commit 220278b
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 0 deletions.
diff --git a/docs/resources/secrets_sync_aws_parameter_store.md b/docs/resources/secrets_sync_aws_parameter_store.md
@@ -99,6 +99,7 @@ resource "doppler_secrets_sync_aws_parameter_store" "backend_prod" {
 - `kms_key_id` (String) The AWS KMS key used to encrypt the parameter (ID, Alias, or ARN)
 - `secure_string` (Boolean) Whether or not the parameters are stored as a secure string
 - `tags` (Map of String) AWS tags to attach to the parameters
+- `update_resource_tags` (String) Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))
 
 ### Read-Only
 

diff --git a/docs/resources/secrets_sync_aws_secrets_manager.md b/docs/resources/secrets_sync_aws_secrets_manager.md
@@ -95,6 +95,7 @@ resource "doppler_secrets_sync_aws_secrets_manager" "backend_prod" {
 - `path_behavior` (String) The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.
 - `tags` (Map of String) AWS tags to attach to the secrets
 - `update_metadata` (Boolean) If enabled, Doppler will update the AWS secret metadata (e.g. KMS key) during every sync. If disabled, Doppler will only set secret metadata for new AWS secrets. Note that Doppler never updates tags for existing AWS secrets.
+- `update_resource_tags` (String) Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))
 
 ### Read-Only
 

diff --git a/doppler/resource_sync_types.go b/doppler/resource_sync_types.go
@@ -41,6 +41,24 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 				Optional:    true,
 				ForceNew:    true,
 			},
+
+			"update_resource_tags": {
+				Description:  "Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"never", "upsert", "replace"}, false),
+				DiffSuppressFunc: func(k, oldValue, newValue string, d *schema.ResourceData) bool {
+					if oldValue == "" && newValue == "never" {
+						return true
+					} else if oldValue == "never" && newValue == "" {
+						return true
+					} else {
+						return newValue == oldValue
+					}
+				},
+			},
+
 			"path_behavior": {
 				Description: "The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.",
 				Type:        schema.TypeString,
@@ -73,6 +91,9 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 			if updateMetadata, ok := d.GetOk("update_metadata"); ok {
 				payload["update_metadata"] = updateMetadata
 			}
+			if updateResourceTags, ok := d.GetOk("update_resource_tags"); ok {
+				payload["update_resource_tags"] = updateResourceTags
+			}
 			if pathBehavior, ok := d.GetOk("path_behavior"); ok {
 				payload["use_doppler_suffix"] = pathBehavior == "add_doppler_suffix"
 			} else {
@@ -121,6 +142,22 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 			},
+			"update_resource_tags": {
+				Description:  "Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"never", "upsert", "replace"}, false),
+				DiffSuppressFunc: func(k, oldValue, newValue string, d *schema.ResourceData) bool {
+					if oldValue == "" && newValue == "never" {
+						return true
+					} else if oldValue == "never" && newValue == "" {
+						return true
+					} else {
+						return newValue == oldValue
+					}
+				},
+			},
 		},
 		DataBuilder: func(d *schema.ResourceData) IntegrationData {
 			payload := map[string]interface{}{
@@ -132,6 +169,9 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 			if kmsKeyId, ok := d.GetOk("kms_key_id"); ok {
 				payload["kms_key_id"] = kmsKeyId
 			}
+			if updateResourceTags, ok := d.GetOk("update_resource_tags"); ok {
+				payload["update_resource_tags"] = updateResourceTags
+			}
 			return payload
 		},
 	}