Add EKS cluster auth token data resource continued

[mbarrien]

This is a continuation of #4904 to create the aws_eks_cluster_auth data source for authentication tokens. This PR keeps the same interface (removing the duration flag), and on the backend uses the aws-iam-authenticator's token library directly instead of rolling our own implementation. It is also rebased against the head of master, so it includes the changeover to go modules mentioned in the predecessor PR.

Note that we had to specify a non-tagged version of aws-iam-authenticator; the most recent tagged version lacks the GetWithSTS api that we rely on. go.mod/go.sum reflects this.

Output from acceptance testing:

$  make testacc TESTARGS='-run=TestAccAWSEksClusterAuthDataSource_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -parallel 20 -run=TestAccAWSEksClusterAuthDataSource_basic -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccAWSEksClusterAuthDataSource_basic
--- PASS: TestAccAWSEksClusterAuthDataSource_basic (7.10s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	7.870s
...

[bflad]

Hi @mbarrien 👋 Thanks for continuing this work! I left a few smaller things below for review but the larger items are:

• This is still missing Terraform website documentation for the new data source (sidebar link in website/aws.erb and a new website/docs/d/eks_cluster_auth.html.markdown page as noted in https://github.com/terraform-providers/terraform-provider-aws/blob/master/.github/CONTRIBUTING.md#new-resource)
• We are vendoring our Go module dependencies in this repository until Go module caching becomes more stable and prevalent. This will also fix the TravisCI failures. Please run the following:

go mod tidy
go mod vendor

Please reach out if you have any questions or issues. Thanks!

[mbarrien]

All suggestions done. Please re-review.

[bflad]

Looks like the build is currently failing according to TravisCI:

148.55s$ make test
==> Checking that code complies with gofmt requirements...
go test ./... -timeout=30s -parallel=4
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
# github.com/terraform-providers/terraform-provider-aws/aws [github.com/terraform-providers/terraform-provider-aws/aws.test]
aws/data_source_aws_eks_cluster_auth_test.go:43:33: undefined: name
aws/data_source_aws_eks_cluster_auth_test.go:46:66: undefined: name
FAIL	github.com/terraform-providers/terraform-provider-aws/aws [build failed]
make: *** [test] Error 2
The command "make test" exited with 2.

[mbarrien]

Fixed, and added a missing file.

[mbarrien]

I'm going to hate raining on my own parade here, but since token gets written to the data source state, this essentially means that a valid authentication token can get written to a tfstate file. This can be a security risk.

(That said, other solutions like the following also suffer from the same issue.)

data "external" "aws-iam-authenticator" {
  program = ["sh", "-c", "result=$(aws-iam-authenticator token -i '${var.name}' --token-only) && echo {\\\"token\\\":\\\"$${result}\\\"}"]
}

[alexsomesan]

Nice one! Looks good to me.

[bflad]

Looks good to me, thanks so much @mbarrien and @evilmarty!!! 🚀

--- PASS: TestAccAWSEksClusterAuthDataSource_basic (3.95s)

[bflad]

This has been released in version 1.58.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!