fix: Support empty secrets in OnDeleteStorageBucket

go.mod

@@ -2,8 +2,6 @@ module github.com/hashicorp/boundary-plugin-aws
 
 go 1.20
 
-replace github.com/hashicorp/boundary/sdk => github.com/hashicorp/boundary/sdk v0.0.35-0.20230705165757-c7e98a6f1782
-
 require (
 	github.com/aws/aws-sdk-go v1.44.80
 	github.com/aws/aws-sdk-go-v2 v1.17.7
@@ -12,7 +10,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.31.1
 	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
-	github.com/hashicorp/boundary/sdk v0.0.35
+	github.com/hashicorp/boundary/sdk v0.0.33
 	github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6
 	github.com/hashicorp/terraform-json v0.14.0
 	github.com/mitchellh/mapstructure v1.5.0

go.sum

@@ -69,8 +69,8 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary/sdk v0.0.35-0.20230705165757-c7e98a6f1782 h1:MuBxNJCn7At92jVlc17GMOghSkTy+33/DOBh/JvaVxU=
-github.com/hashicorp/boundary/sdk v0.0.35-0.20230705165757-c7e98a6f1782/go.mod h1:jn9j5mM8v2pOk8aLeJNIszdm7WBf4gRSP68iy8Iu5Q0=
+github.com/hashicorp/boundary/sdk v0.0.33 h1:kHaVZ3b9j1QvYlG+vhAgrbXh8/+Rq2qlUIs8fKMQH7k=
+github.com/hashicorp/boundary/sdk v0.0.33/go.mod h1:jn9j5mM8v2pOk8aLeJNIszdm7WBf4gRSP68iy8Iu5Q0=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=

internal/credential/attributes.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package credential
 
 import (

internal/credential/const.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package credential
 
 const (

internal/credential/state.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package credential
 
 import (

internal/credential/state_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package credential
 
 import (

internal/credential/testing.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package credential
 
 import (

internal/errors/error.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package errors
 
 import (

internal/values/proto.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package values
 
 import (

internal/values/proto_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package values
 
 import (

plugin/plugin.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package plugin
 
 import (

plugin/service/host/README.md

@@ -105,7 +105,7 @@ a configured IAM user for this provider:
 The following `attributes` are valid on an AWS host catalog resource:
 
 - `disable_credential_rotation` (bool): If `true`, credential rotation will not
-  be performed. See the [Credential Rotation](../../../README.md#credential-rotation) section
+  be performed. See the [Credential Rotation](#credential-rotation) section
   above.
 - `region` (string): The region to configure the host catalog for. All host sets
   in this catalog will be configured for this region.

plugin/service/host/attributes.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/host/attributes_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/host/const.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 const (

plugin/service/host/plugin_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/host/state.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/host/state_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/host/testing.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package host
 
 import (

plugin/service/storage/README.md

@@ -66,7 +66,7 @@ Example policy:
 The following `attributes` are valid on an AWS storage bucket resource:
 
 - `disable_credential_rotation` (bool): If `true`, credential rotation will not
-  be performed. See the [Credential Rotation](../../../README.md#credential-rotation) section
+  be performed. See the [Credential Rotation](#credential-rotation) section
   above.
 - `region` (string): The region to configure the storage bucket for.
 - `endpoint-url` (string): The endpoint to configure the storage.

plugin/service/storage/attributes.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (

plugin/service/storage/attributes_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (

plugin/service/storage/const.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 const (

plugin/service/storage/plugin.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (
@@ -9,7 +6,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
-	"fmt"
 	"io"
 	"os"
 	"path"
@@ -18,7 +14,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws/retry"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/google/uuid"
 	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
@@ -239,6 +234,12 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 		return nil, err
 	}
 
+	// NOTE: This check was added to support the Boundary 0.13.2 release as a hotfix for
+	// empty secrets. Future releases of the plugin will correctly handle empty secrets.
+	if req.GetPersisted().GetData() == nil {
+		return &pb.OnDeleteStorageBucketResponse{}, nil
+	}
+
 	// Get the persisted data.
 	// NOTE: We return on error here, blocking the delete. This may or
 	// may not be an overzealous approach to maintaining database/state
@@ -716,41 +717,5 @@ func parseAWSErrCode(msg string, err error) error {
 	if retryErr.IsErrorThrottle(err).Bool() {
 		errCode = codes.Unavailable
 	}
-	st := status.New(errCode, fmt.Sprintf("%s: %s", msg, err))
-	if aerr, ok := err.(awserr.Error); ok {
-		detail := &pb.ErrorDetail{
-			Status:  500,
-			Code:    aerr.Code(),
-			Message: aerr.Message(),
-		}
-		// aws error codes are strings that are more granular than status codes
-		// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
-		switch aerr.Code() {
-		case "AccessDenied":
-			// generic 403 response, who knows, credentials were invalidated, etc
-			detail.Status = 403
-			errCode = codes.Unauthenticated
-		case "InvalidSecurity":
-			// these specific credentials aren't valid
-			fallthrough
-		case "InvalidAccessKeyId":
-			// a specific case for an access key being revoked. this is probably
-			// the one we want to watch out for
-			fallthrough
-		case "UnauthorizedAccess":
-			// standard 401 response, client is no longer authorized and may
-			// need new credentials
-			detail.Status = 401
-			errCode = codes.Unauthenticated
-		default:
-			// we didn't get a code we were expecting, just fallback to previous
-			// logic. if we need to parse more codes in the future, we can.
-		}
-
-		var sterr error
-		if st, sterr = st.WithDetails(detail); sterr != nil {
-			panic(fmt.Sprintf("Unexpected error while attaching AWS error metadata: %v", sterr))
-		}
-	}
-	return st.Err()
+	return status.Errorf(errCode, "%s: %s", msg, err)
 }

plugin/service/storage/plugin_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (

plugin/service/storage/state.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (

plugin/service/storage/state_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (

plugin/service/storage/testing.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage
 
 import (