test(e2e): Add dynamic host catalog test (AWS)

This adds the initial set of tests that validate setting up a dynamic host catalog on AWS

Co-authored-by: Josh Brand <jbrand@hashicorp.com>

enos/modules/generate_aws_host_tag_vars/main.tf

@@ -0,0 +1,19 @@
+variable "tag_name" {
+  type = string
+}
+variable "tag_value" {
+  type = string
+}
+
+locals {
+  tag_map    = { "e2e_${var.tag_name}" : var.tag_value }
+  tag_string = "tag:e2e_${var.tag_name}=${var.tag_value}"
+}
+
+output "tag_map" {
+  value = local.tag_map
+}
+
+output "tag_string" {
+  value = local.tag_string
+}

enos/modules/iam_setup/main.tf

@@ -0,0 +1,45 @@
+data "aws_caller_identity" "current" {}
+
+variable "test_id" {}
+variable "test_email" {}
+
+locals {
+  # Use the AWS provided email if users are running this, override with variable for CI
+  user_email = var.test_email == null ? split(":", data.aws_caller_identity.current.user_id)[1] : var.test_email
+}
+
+resource "aws_iam_user" "boundary" {
+  name                 = "boundary-e2e-${var.test_id}"
+  tags                 = { boundary-demo = local.user_email }
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/BoundaryDemoPermissionsBoundary"
+}
+
+resource "aws_iam_user_policy" "boundary" {
+  name = "boundary_e2e_${var.test_id}"
+  user = aws_iam_user.boundary.name
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Action" : [
+          "ec2:DescribeInstances"
+        ],
+        "Effect" : "Allow",
+        "Resource" : "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_access_key" "boundary" {
+  user = aws_iam_user.boundary.name
+}
+
+output "access_key_id" {
+  value = aws_iam_access_key.boundary.id
+}
+
+output "secret_access_key" {
+  value     = aws_iam_access_key.boundary.secret
+  sensitive = true
+}

enos/modules/random_stringifier/main.tf

@@ -1,5 +1,9 @@
+variable "length" {
+  type    = number
+  default = 10
+}
 resource "random_string" "string" {
-  length  = 10
+  length  = var.length
   lower   = true
   upper   = true
   numeric = true

enos/modules/target/main.tf

@@ -6,6 +6,9 @@ variable "project_name" {}
 variable "instance_type" {}
 variable "aws_ssh_keypair_name" {}
 variable "enos_user" {}
+variable "additional_tags" {
+  default = {}
+}
 
 data "aws_subnets" "infra" {
   filter {
@@ -15,7 +18,7 @@ data "aws_subnets" "infra" {
 }
 
 resource "aws_security_group" "boundary_target" {
-  name        = "boundary-target-sg"
+  name_prefix = "boundary-target-sg"
   description = "SSH and boundary Traffic"
   vpc_id      = var.vpc_id
 
@@ -47,12 +50,12 @@ resource "aws_instance" "target" {
   subnet_id              = tolist(data.aws_subnets.infra.ids)[count.index % length(data.aws_subnets.infra.ids)]
   key_name               = var.aws_ssh_keypair_name
 
-  tags = {
+  tags = merge(var.additional_tags, {
     "Name" : "boundary-target-${count.index}",
     "Type" : "target",
     "Environment" : var.environment
     "Enos User" : var.enos_user,
-  }
+  })
 }
 
 output "target_ips" {

enos/modules/test_e2e/main.tf

@@ -41,6 +41,7 @@ variable "aws_ssh_private_key_path" {
 variable "target_ips" {
   description = "List of IP Addresses of created hosts"
   type        = list(string)
+  default     = [""]
 }
 variable "vault_addr" {
   description = "URL of Vault instance"
@@ -52,10 +53,46 @@ variable "vault_root_token" {
   type        = string
   default     = ""
 }
+variable "aws_access_key_id" {
+  description = "Access Key Id for AWS IAM user used in dynamic host catalogs"
+  type        = string
+  default     = ""
+}
+variable "aws_secret_access_key" {
+  description = "Secret Access Key for AWS IAM user used in dynamic host catalogs"
+  type        = string
+  default     = ""
+}
+variable "aws_host_set_filter1" {
+  description = "Filter tag for host set used in dynamic host catalogs"
+  type        = string
+  default     = ""
+}
+variable "aws_host_set_count1" {
+  description = "Number of hosts in aws_host_set_filter1"
+  type        = number
+  default     = 0
+}
+variable "aws_host_set_ips1" {
+  description = "List of IP addresses in aws_host_set_filter1"
+  type        = list(string)
+  default     = [""]
+}
+variable "aws_host_set_filter2" {
+  description = "Filter tag for host set used in dynamic host catalogs"
+  type        = string
+  default     = ""
+}
+variable "aws_host_set_count2" {
+  description = "Number of hosts in aws_host_set_filter2"
+  type        = number
+  default     = 0
+}
 
 locals {
   aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path)
   vault_addr               = var.vault_addr != "" ? "http://${var.vault_addr}:8200" : ""
+  aws_host_set_ips1        = jsonencode(var.aws_host_set_ips1)
 }
 
 resource "enos_local_exec" "run_e2e_test" {
@@ -68,7 +105,14 @@ resource "enos_local_exec" "run_e2e_test" {
     E2E_SSH_USER                  = var.target_user,
     E2E_SSH_KEY_PATH              = local.aws_ssh_private_key_path,
     VAULT_ADDR                    = local.vault_addr,
-    VAULT_TOKEN                   = var.vault_root_token
+    VAULT_TOKEN                   = var.vault_root_token,
+    E2E_AWS_ACCESS_KEY_ID         = var.aws_access_key_id,
+    E2E_AWS_SECRET_ACCESS_KEY     = var.aws_secret_access_key,
+    E2E_AWS_HOST_SET_FILTER1      = var.aws_host_set_filter1,
+    E2E_AWS_HOST_SET_COUNT1       = var.aws_host_set_count1,
+    E2E_AWS_HOST_SET_IPS1         = local.aws_host_set_ips1,
+    E2E_AWS_HOST_SET_FILTER2      = var.aws_host_set_filter2,
+    E2E_AWS_HOST_SET_COUNT2       = var.aws_host_set_count2
   }
 
   inline = ["PATH=\"${var.local_boundary_dir}:$PATH\" go test -v ${var.test_package}"]