eks: add ephemeral aws_eks_cluster_auth resource

.changelog/40660.txt

@@ -0,0 +1,3 @@
+```release-note:new-ephemeral
+aws_eks_cluster_auth
+```

internal/service/eks/cluster_auth_ephemeral.go

@@ -0,0 +1,87 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package eks
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	fwflex "github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+const (
+	ERNameClusterAuth = "Ephemeral Resource Cluster Auth"
+)
+
+// @EphemeralResource(aws_eks_cluster_auth, name="ClusterAuth")
+func newEphemeralClusterAuth(_ context.Context) (ephemeral.EphemeralResourceWithConfigure, error) {
+	return &ephemeralClusterAuth{}, nil
+}
+
+type ephemeralClusterAuth struct {
+	framework.EphemeralResourceWithConfigure
+}
+
+func (e *ephemeralClusterAuth) Metadata(_ context.Context, _ ephemeral.MetadataRequest, response *ephemeral.MetadataResponse) {
+	response.TypeName = "aws_eks_cluster_auth"
+}
+
+func (e *ephemeralClusterAuth) Schema(ctx context.Context, _ ephemeral.SchemaRequest, response *ephemeral.SchemaResponse) {
+	response.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			names.AttrName: schema.StringAttribute{
+				Required: true,
+			},
+			"token": schema.StringAttribute{
+				Computed:  true,
+				Sensitive: true,
+			},
+		},
+	}
+}
+
+func (e *ephemeralClusterAuth) Open(ctx context.Context, request ephemeral.OpenRequest, response *ephemeral.OpenResponse) {
+	conn := e.Meta().STSClient(ctx)
+	data := epClusterAuthData{}
+
+	response.Diagnostics.Append(request.Config.Get(ctx, &data)...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	generator, err := NewGenerator(false, false)
+	if err != nil {
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.EKS, create.ErrActionReading, ERNameClusterAuth, data.Name.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	token, err := generator.GetWithSTS(ctx, data.Name.ValueString(), conn)
+	if err != nil {
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.EKS, create.ErrActionReading, ERNameClusterAuth, data.Name.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	response.Diagnostics.Append(fwflex.Flatten(ctx, token, &data)...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	response.Diagnostics.Append(response.Result.Set(ctx, &data)...)
+}
+
+type epClusterAuthData struct {
+	Name  types.String `tfsdk:"name"`
+	Token types.String `tfsdk:"token"`
+}

internal/service/eks/cluster_auth_ephemeral_test.go

@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package eks_test
+
+import (
+	"fmt"
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+	"github.com/hashicorp/terraform-plugin-testing/tfversion"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccEKSClusterAuthEphemeral_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	echoResourceName := "echo.test"
+	dataPath := tfjsonpath.New("data")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:   func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck: acctest.ErrorCheck(t, names.SSMServiceID),
+		TerraformVersionChecks: []tfversion.TerraformVersionCheck{
+			tfversion.SkipBelow(tfversion.Version1_10_0),
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		ProtoV6ProviderFactories: acctest.ProtoV6ProviderFactories(ctx, acctest.ProviderNameEcho),
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterAuthEphemeralResourceConfig_basic(rName),
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue(echoResourceName, dataPath.AtMapKey(names.AttrName), knownvalue.NotNull()),
+					statecheck.ExpectKnownValue(echoResourceName, dataPath.AtMapKey("token"), knownvalue.NotNull()),
+				},
+			},
+		},
+	})
+}
+
+func testAccClusterAuthEphemeralResourceConfig_basic(clusterName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigWithEchoProvider("ephemeral.aws_eks_cluster_auth.test"),
+		fmt.Sprintf(`
+ephemeral "aws_eks_cluster_auth" "test" {
+  name =  %[1]q
+}
+`, clusterName))
+}

website/docs/ephemeral-resources/eks_cluster_auth.html.markdown

@@ -0,0 +1,45 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster_auth"
+description: |-
+  Retrieve an authentication token to communicate with an EKS cluster.
+---
+
+# Ephemeral: aws_eks_cluster_auth
+
+Retrieve an authentication token to communicate with an EKS cluster.
+
+~> **NOTE:** Ephemeral resources are a new feature and may evolve as we continue to explore their most effective uses. [Learn more](https://developer.hashicorp.com/terraform/language/v1.10.x/resources/ephemeral).
+
+## Example Usage
+
+```terraform
+ephemeral "aws_eks_cluster_auth" "example" {
+  name = data.aws_eks_cluster.example.id
+}
+
+provider "kubernetes" {
+  host                   = data.aws_eks_cluster.example.endpoint
+  cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
+  token                  = ephemeral.aws_eks_cluster_auth.example.token
+}
+
+provider "helm" {
+  kubernetes {
+    host                   = data.aws_eks_cluster.example.endpoint
+    cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
+    token                  = ephemeral.aws_eks_cluster_auth.example.token
+  }
+}
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the EKS cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `token` - Token to use to authenticate with the cluster.