resource/msk_scram_secret_association: update secret handling on read/update

[anGie44]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #16791

Release note for CHANGELOG:

resource/msk_scram_secret_association: update secret handling on read/update

Output from acceptance testing:

--- PASS: TestAccAwsMskScramSecretAssociation_update (1696.19s)
--- PASS: TestAccAwsMskScramSecretAssociation_disappears (1714.16s)
--- PASS: TestAccAwsMskScramSecretAssociation_distributedKeyManagement (1719.34s)
--- PASS: TestAccAwsMskScramSecretAssociation_basic (1751.14s)
--- PASS: TestAccAwsMskScramSecretAssociation_disappears_Cluster (1796.78s)

[pandarouxbsd]

Hi @anGie44 ,

Great fix, thanks. It seems that 1 test is nos passing (goreleaser). Is it a normal behavior ?
And when I try to remove the resources, it appears like this:

  - resource "aws_msk_scram_secret_association" "attach_to_cluster" {
      - cluster_arn     = "arn:aws:kafka:eu-west-1:XXXXX:cluster/rio-kafka-sasl-default/99999999999" -> null
      - id              = "arn:aws:kafka:eu-west-1:XXXXX:cluster/rio-kafka-sasl-default/99999999999"" -> null
      - scram_secrets   = [
          - "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_ST_Akhq_20201013111302148600000001-ATFaph",
          - "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_ST_Schema-Registry_20201013111302148900000002-dTOIjg",
          - "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_Tf-Module_Test_20201222103500220200000001-J7Dl92",
        ] -> null
      - secret_arn_list = [
          - "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_Tf-Module_Test_20201222103500220200000001-J7Dl92",
        ] -> null
    }

Maybe it should appears like this:

  - resource "aws_msk_scram_secret_association" "attach_to_cluster" {
      - cluster_arn     = "arn:aws:kafka:eu-west-1:XXXXX:cluster/rio-kafka-sasl-default/99999999999" -> null
      - id              = "arn:aws:kafka:eu-west-1:XXXXX:cluster/rio-kafka-sasl-default/99999999999"" -> null
      - secret_arn_list = [
             "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_ST_Akhq_20201013111302148600000001-ATFaph",
             "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_ST_Schema-Registry_20201013111302148900000002-dTOIjg",
          - "arn:aws:secretsmanager:eu-west-1:XXXXX:secret:AmazonMSK_Tf-Module_Test_20201222103500220200000001-J7Dl92",
        ] -> null
    }

What do you think ?

Anyway, I tested it and it works very well.
I hope we can get it in upcoming release !

[bflad]

In general, trying to workaround how Terraform CLI and the Terraform Plugin SDK expect full management of all elements within a TypeList/TypeSet leads to problematic edge cases and breaks practitioner experience with the rest of the Terraform provider ecosystem. For example, setting up the resource in this manner prevents import from working correctly as noted by the ImportStateVerifyIgnore. It is likely best to approach the problem from a different angle.

If there really is a strong use case for 1:1 management like other association resources, it may be best to consider something along the lines of the following to treat that use case separately in the logic:

• Mark secret_arn_list as Optional + Computed
• Add secret_arn as new TypeString + Optional + Computed + ConflictsWith attribute
• In the import function, support an optional delimited import ID that triggers secondary behavior of d.Set("secret_arn", ...) and d.SetId() with the cluster ARN
• In the read function, perform d.Get("secret_arn") check against the list of secret ARNs to trigger resource recreation

Please reach out if you have questions.

[anGie44]

Closing this per comment above, as solution should be approached differently to ensure resource's behavior does not lose functionality like import.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.