From 248dfa2563049bf1ebac1aea982d5e67c0920502 Mon Sep 17 00:00:00 2001
From: Leonard Cohnen <lc@edgeless.systems>
Date: Thu, 20 Feb 2025 21:12:58 +0100
Subject: [PATCH] cli: re-introduce iam upgrade check

---
 cli/internal/cmd/apply.go          |  2 +-
 cli/internal/cmd/applyterraform.go | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/cli/internal/cmd/apply.go b/cli/internal/cmd/apply.go
index d4390db21..199cc1d3b 100644
--- a/cli/internal/cmd/apply.go
+++ b/cli/internal/cmd/apply.go
@@ -368,7 +368,7 @@ func (a *applyCmd) apply(
 	// Check current Terraform state, if it exists and infrastructure upgrades are not skipped,
 	// and apply migrations if necessary.
 	if !a.flags.skipPhases.contains(skipInfrastructurePhase) {
-		if err := a.runTerraformApply(cmd, conf, stateFile, upgradeDir); err != nil {
+		if err := a.runTerraformApply(cmd, conf, stateFile, upgradeDir, a.flags.yes); err != nil {
 			return fmt.Errorf("applying Terraform configuration: %w", err)
 		}
 	}
diff --git a/cli/internal/cmd/applyterraform.go b/cli/internal/cmd/applyterraform.go
index 668ad0eed..327936531 100644
--- a/cli/internal/cmd/applyterraform.go
+++ b/cli/internal/cmd/applyterraform.go
@@ -22,7 +22,7 @@ import (
 )
 
 // runTerraformApply checks if changes to Terraform are required and applies them.
-func (a *applyCmd) runTerraformApply(cmd *cobra.Command, conf *config.Config, stateFile *state.State, upgradeDir string) error {
+func (a *applyCmd) runTerraformApply(cmd *cobra.Command, conf *config.Config, stateFile *state.State, upgradeDir string, yesFlag bool) error {
 	a.log.Debug("Checking if Terraform migrations are required")
 	terraformClient, removeClient, err := a.newInfraApplier(cmd.Context())
 	if err != nil {
@@ -36,6 +36,20 @@ func (a *applyCmd) runTerraformApply(cmd *cobra.Command, conf *config.Config, st
 		return fmt.Errorf("checking if Terraform workspace is empty: %w", err)
 	}
 
+	if !isNewCluster && cloudcmd.UpgradeRequiresIAMMigration(conf.GetProvider()) {
+		cmd.Println("WARNING: This upgrade requires an IAM migration. Please make sure you have applied the IAM migration using `iam upgrade apply` before continuing.")
+		if !yesFlag {
+			yes, err := askToConfirm(cmd, "Did you upgrade the IAM resources?")
+			if err != nil {
+				return fmt.Errorf("asking for confirmation: %w", err)
+			}
+			if !yes {
+				cmd.Println("Skipping upgrade.")
+				return nil
+			}
+		}
+	}
+
 	if changesRequired, err := a.planTerraformChanges(cmd, conf, terraformClient); err != nil {
 		return fmt.Errorf("planning Terraform migrations: %w", err)
 	} else if !changesRequired {