AWS Managed Grafana - Network Access Control

[Mathias-ML]

Description

In the AWS Console when working with managed grafana under network access control you have the option to select either VPC endpoint or Managed prefix list. When using the terraform resource aws_grafana_workspace, in the network access control block it is required to specify both. Is it possible to make these optional since not specifiy the block defaults to public access anyways?

Affected Resource(s) or Data Source(s)

• aws_grafana_workspace

Potential Terraform Configuration

References

prefix_list_ids - (Optional) - An array of prefix list IDs.
vpce_ids - (Optional) - An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.

Would you like to implement the enhancement?

Yes

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[justinretzolk]

Hey @Mathias-ML 👋🏻 Thank you for taking the time to raise this! Both arguments are currently marked as required due to requirements of the upstream API (specifically, the NetworkAccessConfiguration object). Since the upstream API requires these arguments, the provider must require them as well. It's also worth noting that since the parent block (network_access_control) is marked as Optional: true, the arguments are not required if the network_access_control block is omitted entirely.

Something that's worth mentioning (and something that we should add to the resource documentation) is that the documentation for the upstream API mentions:

While both prefixListIds and vpceIds are required, you can pass in an empty array of strings for either parameter if you do not want to allow any of that type.

If both are passed as empty arrays, no traffic is allowed to the workspace, because only explicitly allowed connections are accepted.

While the resource schema marks both of these arguments as Required: true and MaxItems: 100, there is no MinItems defined. With that in mind, the following snippit should work:

resource "aws_grafana_workspace" "example" {
  # other configuration

  network_access_control {
    prefix_list_ids = []
    vpce_ids = []
  }
}

[Mathias-ML]

This looks good I will go ahead and make the changes to my code validate and close.

[taraspos]

Hi @justinretzolk, I'm facing the same issue.

Code:

  network_access_control {
    prefix_list_ids = var.grafana_ip_prefix_list_ids
    vpce_ids        = []
  }

Plan:

      + network_access_control {
          + prefix_list_ids = [
              + "pl-123123123",
            ]
        }

Error:

│ Error: updating Grafana Workspace (g-123123): operation error grafana: UpdateWorkspace, 1 validation error(s) found.
│ - missing required field, UpdateWorkspaceInput.NetworkAccessControl.VpceIds.

Seems like empty list value is ignored by terraform:

• terraform-provider-aws/internal/service/grafana/workspace.go

  Lines 595 to 597 in 8ad387e

  	if v, ok := tfMap["vpce_ids"].(*schema.Set); ok && v.Len() > 0 {
  	apiObject.VpceIds = flex.ExpandStringValueSet(v)
  	}

[taraspos]

I raised a fix here: #47379