Start of a security group attachment resource (attach a SG to a single instance or ENI)

resource_aws_security_group_attachment.go

package aws

import (
	"fmt"

	"github.com/hashicorp/terraform/helper/schema"
)

func resourceAwsSecurityGroupAttachment() *schema.Resource {
	return &schema.Resource{
		Create: resourceAwsSecurityGroupAttachmentCreate,
		Read:   resourceAwsSecurityGroupAttachmentRead,
		Update: resourceAwsSecurityGroupAttachmentUpdate,
		Delete: resourceAwsSecurityGroupAttachmentDelete,
		Schema: map[string]*schema.Schema{
			"security_group_id": {
				Type:     schema.TypeString,
				Required: true,
				ForceNew: true,
			},
			"instance_id": {
				Type:     schema.TypeString,
				Optional: true,
			},
			"network_interface_id": {
				Type:     schema.TypeString,
				Optional: true,
			},
		},
	}
}

func resourceAwsSecurityGroupAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
	var err error
	switch {
	case d.Get("instance_id").(string) != "":
		err = attachSecurityGroupToInstance(d, meta)
	case d.Get("network_interface_id").(string) != "":
		err = attachSecurityGroupToInterface(d, meta)
	default:
		err = fmt.Errorf("one of instance_id or network_interface_id needs to be defined")
	}
	if err != nil {
		return err
	}

	return resourceAwsSecurityGroupAttachmentRead(d, meta)
}

func attachSecurityGroupToInstance(d *schema.ResourceData meta interface{}) error {
	sgID := d.Get("security_group_id").(string)
	instanceID := d.Get("instance_id").(string)

	log.Printf("[INFO] Attaching security group %s to instance ID %s", sgID, instanceID)

	conn := meta.(*AWSClient).ec2conn

	params := &ec2.DescribeInstancesInput{
		InstanceIds: []string{aws.String(instanceID)},
	}

	resp, err := conn.DescribeInstances(params)
	if err != nil {
		return err
	}

	sgs := resp.Reservations[0].Instances[0]

	var primaryInterface ec2.InstanceNetworkInterface
		for _, ni := range instance.NetworkInterfaces {
			if *ni.Attachment.DeviceIndex == 0 {
				primaryInterface = *ni
			}
		}

		if primaryInterface.NetworkInterfaceId == nil {
			log.Print("[ERROR] Attempted to set vpc_security_group_ids on an instance without a primary network interface")
			return fmt.Errorf("instance ID %s, does not contain a primary network interface", instanceID)
		}





		if _, err := conn.ModifyNetworkInterfaceAttribute(&ec2.ModifyNetworkInterfaceAttributeInput{
			NetworkInterfaceId: primaryInterface.NetworkInterfaceId,
			Groups:             groups,
		}); err != nil {
			return err
		}
}

func attachSecurityGroupToInterface(d, meta) error {

}

func attachSecurityGroupToInterfaceI

func testResourceRead(d *schema.ResourceData, meta interface{}) error {
	d.Set("computed_read_only", "value_from_api")
	d.Set("computed_read_only_force_new", "value_from_api")
	if _, ok := d.GetOk("optional_computed_map"); !ok {
		d.Set("optional_computed_map", map[string]string{})
	}
	d.Set("computed_map", map[string]string{"key1": "value1"})
	d.Set("computed_list", []string{"listval1", "listval2"})
	d.Set("computed_set", []string{"setval1", "setval2"})
	return nil
}

func testResourceUpdate(d *schema.ResourceData, meta interface{}) error {
	return nil
}

func testResourceDelete(d *schema.ResourceData, meta interface{}) error {
	d.SetId("")
	return nil
}