account: add PrimaryContact managed resource - #2181
Merged
jonasz-lasut merged 3 commits intoAug 3, 2026
Merged
Conversation
Adds support for aws_account_primary_contact via the account family provider. Uses config.IdentifierFromProvider as the external name since the resource is a singleton identified by the AWS account ID. For Observe-only or import scenarios, the crossplane.io/external-name annotation must be set to the AWS account ID before applying. Signed-off-by: Dave McNeill <dave.mcneill@gmail.com>
…tion Signed-off-by: Dave McNeill <dave.mcneill@gmail.com>
Signed-off-by: Dave McNeill <dave.mcneill@gmail.com>
davemac30
requested review from
bobh66,
erhancagirici,
jastang,
jonasz-lasut,
sergenyalcin,
turkenf and
ulucinar
as code owners
August 3, 2026 14:08
jonasz-lasut
approved these changes
Aug 3, 2026
jonasz-lasut
left a comment
jonasz-lasut
left a comment
Collaborator
There was a problem hiding this comment.
Thank you @davemac30 LGTM!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
Adds the
PrimaryContactmanaged resource to theaccountfamily, corresponding to the Terraformaws_account_primary_contactresource.This is a rework of #2172 (reverted in #2180). The generated files have been regenerated from scratch on top of the current
main(crossplane-runtime ≥2.3) to eliminate the stale generated output that caused the revert.aws_account_primary_contactis a singleton resource — there is exactly one primary contact per AWS account — so it usesconfig.IdentifierFromProvider.External name behaviour (documented in the example manifests):
forProvider.accountIdis omitted (managing the account the provider credentials belong to), the Terraform provider uses"default"as the resource ID, so the external name will be"default".forProvider.accountIdis set explicitly, the external name is the target AWS account ID. Cross-account management requires the caller's IAM identity to haveaccount:GetContactInformationandaccount:PutContactInformationpermissions scoped to the target account.managementPolicies: [Observe]or import, setcrossplane.io/external-nameto"default"(current-account) or the explicit account ID, matching how the resource was originally created.Fixes #2165
I have:
make generateand committed the results (ideally in a separate commit).make check-diff.How has this code been tested
Tested manually against live AWS accounts using a local provider binary connected to a
kindcluster.Two scenarios were tested:
Scenario A — current-account management (member account managing itself, no
accountId)Apply, UpToDate, Import and Delete all confirmed working. External name
"default"is correctly assigned.Scenario B — cross-account management (management account targeting member account via
accountId)forProvider.accountIdandcrossplane.io/external-nameboth set to the member account ID.status.atProvidercorrectly reflects the member account's contact data (not the management account's), confirmingaccount_idis correctly propagated to the AWS API.Full test report was posted as a comment on #2172.