From eadb31fc8f57909a5ced47e04d813ebc73530e9d Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 00:24:18 +0300
Subject: [PATCH 01/14] workteam initial commit

---
 .../service/sagemaker/finder/finder.go        |  23 ++
 aws/provider.go                               |   1 +
 aws/resource_aws_sagemaker_workteam.go        | 354 +++++++++++++++++
 aws/resource_aws_sagemaker_workteam_test.go   | 368 ++++++++++++++++++
 4 files changed, 746 insertions(+)
 create mode 100644 aws/resource_aws_sagemaker_workteam.go
 create mode 100644 aws/resource_aws_sagemaker_workteam_test.go

diff --git a/aws/internal/service/sagemaker/finder/finder.go b/aws/internal/service/sagemaker/finder/finder.go
index 9b3badf6934b..3938f360e96a 100644
--- a/aws/internal/service/sagemaker/finder/finder.go
+++ b/aws/internal/service/sagemaker/finder/finder.go
@@ -209,3 +209,26 @@ func WorkforceByName(conn *sagemaker.SageMaker, name string) (*sagemaker.Workfor
 
 	return output.Workforce, nil
 }
+
+// WorkteamByName returns the workteam corresponding to the specified name.
+// Returns nil if no workteam is found.
+func WorkteamByName(conn *sagemaker.SageMaker, name string) (*sagemaker.Workteam, error) {
+	input := &sagemaker.DescribeWorkteamInput{
+		WorkteamName: aws.String(name),
+	}
+
+	output, err := conn.DescribeWorkteam(input)
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, nil
+	}
+
+	if output.Workteam == nil {
+		return nil, nil
+	}
+
+	return output.Workteam, nil
+}
diff --git a/aws/provider.go b/aws/provider.go
index 6fdd030ea27b..3f9f86dacc41 100644
--- a/aws/provider.go
+++ b/aws/provider.go
@@ -1014,6 +1014,7 @@ func Provider() *schema.Provider {
 			"aws_sagemaker_notebook_instance":                         resourceAwsSagemakerNotebookInstance(),
 			"aws_sagemaker_user_profile":                              resourceAwsSagemakerUserProfile(),
 			"aws_sagemaker_workforce":                                 resourceAwsSagemakerWorkforce(),
+			"aws_sagemaker_workteam":                                  resourceAwsSagemakerWorkteam(),
 			"aws_schemas_discoverer":                                  resourceAwsSchemasDiscoverer(),
 			"aws_schemas_registry":                                    resourceAwsSchemasRegistry(),
 			"aws_schemas_schema":                                      resourceAwsSchemasSchema(),
diff --git a/aws/resource_aws_sagemaker_workteam.go b/aws/resource_aws_sagemaker_workteam.go
new file mode 100644
index 000000000000..25fc829fce16
--- /dev/null
+++ b/aws/resource_aws_sagemaker_workteam.go
@@ -0,0 +1,354 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+)
+
+func resourceAwsSagemakerWorkteam() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSagemakerWorkteamCreate,
+		Read:   resourceAwsSagemakerWorkteamRead,
+		Update: resourceAwsSagemakerWorkteamUpdate,
+		Delete: resourceAwsSagemakerWorkteamDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringLenBetween(1, 200),
+			},
+			"member_definition": {
+				Type:     schema.TypeList,
+				Required: true,
+				MinItems: 1,
+				MaxItems: 10,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cognito_member_definition": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"client_id": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+									"user_group": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+									"user_pool": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+								},
+							},
+						},
+						"oidc_member_definition": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"groups": {
+										Type:     schema.TypeSet,
+										MaxItems: 10,
+										Required: true,
+										Elem: &schema.Schema{
+											Type:         schema.TypeString,
+											ValidateFunc: validation.StringLenBetween(1, 63),
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"notification_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"notification_topic_arn": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validateArn,
+						},
+					},
+				},
+				DiffSuppressFunc: suppressMissingOptionalConfigurationBlock,
+			},
+			"subdomain": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"workforce_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"workforce_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"workteam_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 63),
+					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+				),
+			},
+		},
+	}
+}
+
+func resourceAwsSagemakerWorkteamCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	name := d.Get("workteam_name").(string)
+	input := &sagemaker.CreateWorkteamInput{
+		WorkteamName:      aws.String(name),
+		WorkforceName:     aws.String(d.Get("workforce_name").(string)),
+		Description:       aws.String(d.Get("description").(string)),
+		MemberDefinitions: expandSagemakerWorkteamMemberDefinition(d.Get("member_definition").([]interface{})),
+	}
+
+	if v, ok := d.GetOk("notification_configuration"); ok {
+		input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(v.([]interface{}))
+	}
+
+	log.Printf("[DEBUG] Sagemaker Workteam create config: %#v", *input)
+	_, err := retryOnAwsCode("ValidationException", func() (interface{}, error) {
+		return conn.CreateWorkteam(input)
+	})
+	if err != nil {
+		return fmt.Errorf("error creating SageMaker Workteam: %w", err)
+	}
+
+	d.SetId(name)
+
+	return resourceAwsSagemakerWorkteamRead(d, meta)
+}
+
+func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	workteam, err := finder.WorkteamByName(conn, d.Id())
+	if err != nil {
+		if isAWSErr(err, "ValidationException", " The work team") {
+			d.SetId("")
+			log.Printf("[WARN] Unable to find SageMaker workteam (%s); removing from state", d.Id())
+			return nil
+		}
+		return fmt.Errorf("error reading SageMaker workteam (%s): %w", d.Id(), err)
+
+	}
+
+	arn := aws.StringValue(workteam.WorkteamArn)
+	d.Set("arn", arn)
+	d.Set("subdomain", workteam.SubDomain)
+	d.Set("description", workteam.Description)
+
+	// d.Set("workforce_arn", workteam.WorkforceArn)
+	d.Set("workteam_name", workteam.WorkteamName)
+	// d.Set("workforce_name", workteam.WorkforceName)
+
+	if err := d.Set("member_definition", flattenSagemakerWorkteamMemberDefinition(workteam.MemberDefinitions)); err != nil {
+		return fmt.Errorf("error setting member_definition for Sagemaker Workteam (%s): %w", d.Id(), err)
+	}
+
+	if err := d.Set("notification_configuration", flattenSagemakerWorkteamNotificationConfiguration(workteam.NotificationConfiguration)); err != nil {
+		return fmt.Errorf("error setting notification_configuration for Sagemaker Workteam (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}
+
+func resourceAwsSagemakerWorkteamUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	input := &sagemaker.UpdateWorkteamInput{
+		WorkteamName:      aws.String(d.Id()),
+		MemberDefinitions: expandSagemakerWorkteamMemberDefinition(d.Get("member_definition").([]interface{})),
+	}
+
+	if d.HasChange("description") {
+		input.Description = aws.String(d.Get("description").(string))
+	}
+
+	if d.HasChange("notification_configuration") {
+		input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(d.Get("notification_configuration").([]interface{}))
+	}
+
+	log.Printf("[DEBUG] Sagemaker Workteam update config: %#v", *input)
+	_, err := conn.UpdateWorkteam(input)
+	if err != nil {
+		return fmt.Errorf("error updating SageMaker Workteam: %w", err)
+	}
+
+	return resourceAwsSagemakerWorkteamRead(d, meta)
+}
+
+func resourceAwsSagemakerWorkteamDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sagemakerconn
+
+	input := &sagemaker.DeleteWorkteamInput{
+		WorkteamName: aws.String(d.Id()),
+	}
+
+	if _, err := conn.DeleteWorkteam(input); err != nil {
+		if isAWSErr(err, "ValidationException", "No workteam found for account") {
+			return nil
+		}
+		return fmt.Errorf("error deleting SageMaker workteam (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}
+
+func expandSagemakerWorkteamMemberDefinition(l []interface{}) []*sagemaker.MemberDefinition {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	var members []*sagemaker.MemberDefinition
+
+	for _, mem := range l {
+		memRaw := mem.(map[string]interface{})
+		member := &sagemaker.MemberDefinition{}
+
+		if v, ok := memRaw["cognito_member_definition"].([]interface{}); ok && len(v) > 0 {
+			member.CognitoMemberDefinition = expandSagemakerWorkteamCognitoMemberDefinition(v)
+		}
+
+		if v, ok := memRaw["oidc_member_definition"].([]interface{}); ok && len(v) > 0 {
+			member.OidcMemberDefinition = expandSagemakerWorkteamOidcMemberDefinition(v)
+		}
+
+		members = append(members, member)
+	}
+
+	return members
+}
+
+func flattenSagemakerWorkteamMemberDefinition(config []*sagemaker.MemberDefinition) []map[string]interface{} {
+	members := make([]map[string]interface{}, 0, len(config))
+
+	for _, raw := range config {
+		member := make(map[string]interface{})
+
+		if raw.CognitoMemberDefinition != nil {
+			member["cognito_member_definition"] = flattenSagemakerWorkteamCognitoMemberDefinition(raw.CognitoMemberDefinition)
+		}
+
+		if raw.OidcMemberDefinition != nil {
+			member["oidc_member_definition"] = flattenSagemakerWorkteamOidcMemberDefinition(raw.OidcMemberDefinition)
+		}
+
+		members = append(members, member)
+	}
+
+	return members
+}
+
+func expandSagemakerWorkteamCognitoMemberDefinition(l []interface{}) *sagemaker.CognitoMemberDefinition {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.CognitoMemberDefinition{
+		ClientId:  aws.String(m["client_id"].(string)),
+		UserPool:  aws.String(m["user_pool"].(string)),
+		UserGroup: aws.String(m["user_group"].(string)),
+	}
+
+	return config
+}
+
+func flattenSagemakerWorkteamCognitoMemberDefinition(config *sagemaker.CognitoMemberDefinition) []map[string]interface{} {
+	if config == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"client_id":  aws.StringValue(config.ClientId),
+		"user_pool":  aws.StringValue(config.UserPool),
+		"user_group": aws.StringValue(config.UserGroup),
+	}
+
+	return []map[string]interface{}{m}
+}
+
+func expandSagemakerWorkteamOidcMemberDefinition(l []interface{}) *sagemaker.OidcMemberDefinition {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.OidcMemberDefinition{
+		Groups: expandStringSet(m["groups"].(*schema.Set)),
+	}
+
+	return config
+}
+
+func flattenSagemakerWorkteamOidcMemberDefinition(config *sagemaker.OidcMemberDefinition) []map[string]interface{} {
+	if config == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"groups": flattenStringSet(config.Groups),
+	}
+
+	return []map[string]interface{}{m}
+}
+
+func expandSagemakerWorkteamNotificationConfiguration(l []interface{}) *sagemaker.NotificationConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.NotificationConfiguration{
+		NotificationTopicArn: aws.String(m["notification_topic_arn"].(string)),
+	}
+
+	return config
+}
+
+func flattenSagemakerWorkteamNotificationConfiguration(config *sagemaker.NotificationConfiguration) []map[string]interface{} {
+	if config == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"notification_topic_arn": aws.StringValue(config.NotificationTopicArn),
+	}
+
+	return []map[string]interface{}{m}
+}
diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
new file mode 100644
index 000000000000..d4b5e0720282
--- /dev/null
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -0,0 +1,368 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+	"regexp"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
+	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+)
+
+func init() {
+	resource.AddTestSweepers("aws_sagemaker_workteam", &resource.Sweeper{
+		Name: "aws_sagemaker_workteam",
+		F:    testSweepSagemakerWorkteams,
+	})
+}
+
+func testSweepSagemakerWorkteams(region string) error {
+	client, err := sharedClientForRegion(region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.(*AWSClient).sagemakerconn
+	var sweeperErrs *multierror.Error
+
+	err = conn.ListWorkteamsPages(&sagemaker.ListWorkteamsInput{}, func(page *sagemaker.ListWorkteamsOutput, lastPage bool) bool {
+		for _, workteam := range page.Workteams {
+
+			r := resourceAwsSagemakerWorkteam()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(workteam.WorkteamName))
+			err := r.Delete(d, client)
+			if err != nil {
+				log.Printf("[ERROR] %s", err)
+				sweeperErrs = multierror.Append(sweeperErrs, err)
+				continue
+			}
+		}
+
+		return !lastPage
+	})
+
+	if testSweepSkipSweepError(err) {
+		log.Printf("[WARN] Skipping SageMaker workteam sweep for %s: %s", region, err)
+		return sweeperErrs.ErrorOrNil()
+	}
+
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving Sagemaker Workteams: %w", err))
+	}
+
+	return sweeperErrs.ErrorOrNil()
+}
+
+func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
+	var workteam sagemaker.Workteam
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_workteam.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerWorkteamCognitoConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.client_id", "aws_cognito_user_pool_client.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_pool", "aws_cognito_user_pool.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_group", "aws_cognito_user_group.test", "id"),
+					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"workforce_name"},
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamCognitoUpdatedConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.client_id", "aws_cognito_user_pool_client.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_pool", "aws_cognito_user_pool.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_group", "aws_cognito_user_group.test", "id"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.1.cognito_member_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.1.cognito_member_definition.0.client_id", "aws_cognito_user_pool_client.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.1.cognito_member_definition.0.user_pool", "aws_cognito_user_pool.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.1.cognito_member_definition.0.user_group", "aws_cognito_user_group.test2", "id"),
+					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+				),
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamCognitoConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.client_id", "aws_cognito_user_pool_client.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_pool", "aws_cognito_user_pool.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_group", "aws_cognito_user_group.test", "id"),
+					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+				),
+			},
+		},
+	})
+}
+
+// func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
+// 	var workteam sagemaker.Workteam
+// 	rName := acctest.RandomWithPrefix("tf-acc-test")
+// 	resourceName := "aws_sagemaker_workteam.test"
+// 	endpoint1 := "https://example.com"
+// 	endpoint2 := "https://test.example.com"
+
+// 	resource.Test(t, resource.TestCase{
+// 		PreCheck:     func() { testAccPreCheck(t) },
+// 		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+// 		Providers:    testAccProviders,
+// 		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+// 		Steps: []resource.TestStep{
+// 			{
+// 				Config: testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint1),
+// 				Check: resource.ComposeTestCheckFunc(
+// 					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+// 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+// 					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+// 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_id", rName),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_secret", rName),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.issuer", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.jwks_uri", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.logout_endpoint", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.token_endpoint", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.user_info_endpoint", endpoint1),
+// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.#", "1"),
+// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.0.cidrs.#", "0"),
+// 					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+// 				),
+// 			},
+// 			{
+// 				ResourceName:            resourceName,
+// 				ImportState:             true,
+// 				ImportStateVerify:       true,
+// 				ImportStateVerifyIgnore: []string{"oidc_config.0.client_secret"},
+// 			},
+// 			{
+// 				Config: testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint2),
+// 				Check: resource.ComposeTestCheckFunc(
+// 					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+// 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+// 					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+// 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_id", rName),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_secret", rName),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.issuer", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.jwks_uri", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.logout_endpoint", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.token_endpoint", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.user_info_endpoint", endpoint2),
+// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.#", "1"),
+// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.0.cidrs.#", "0"),
+// 					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+// 				),
+// 			},
+// 		},
+// 	})
+// }
+
+func TestAccAWSSagemakerWorkteam_disappears(t *testing.T) {
+	var workteam sagemaker.Workteam
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_workteam.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerWorkteamCognitoConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerWorkteam(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckAWSSagemakerWorkteamDestroy(s *terraform.State) error {
+	conn := testAccProvider.Meta().(*AWSClient).sagemakerconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_sagemaker_workteam" {
+			continue
+		}
+
+		workteam, err := finder.WorkteamByName(conn, rs.Primary.ID)
+		if tfawserr.ErrMessageContains(err, "ValidationException", "The work team") {
+			continue
+		}
+
+		if err != nil {
+			return fmt.Errorf("error reading Sagemaker Workteam (%s): %w", rs.Primary.ID, err)
+		}
+
+		if aws.StringValue(workteam.WorkteamName) == rs.Primary.ID {
+			return fmt.Errorf("SageMaker Workteam %q still exists", rs.Primary.ID)
+		}
+	}
+
+	return nil
+}
+
+func testAccCheckAWSSagemakerWorkteamExists(n string, workteam *sagemaker.Workteam) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No sagmaker workteam ID is set")
+		}
+
+		conn := testAccProvider.Meta().(*AWSClient).sagemakerconn
+		resp, err := finder.WorkteamByName(conn, rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		*workteam = *resp
+
+		return nil
+	}
+}
+
+func testAccAWSSagemakerWorkteamBaseConfig(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_cognito_user_pool" "test" {
+  name = %[1]q
+}
+
+resource "aws_cognito_user_pool_client" "test" {
+  name            = %[1]q
+  generate_secret = true
+  user_pool_id    = aws_cognito_user_pool.test.id
+}
+
+resource "aws_cognito_user_pool_domain" "test" {
+  domain       = %[1]q
+  user_pool_id = aws_cognito_user_pool.test.id
+}
+
+resource "aws_cognito_user_group" "test" {
+  name         = %[1]q
+  user_pool_id = aws_cognito_user_pool.test.id
+}
+
+resource "aws_sagemaker_workforce" "test" {
+  workforce_name = %[1]q
+
+  cognito_config {
+    client_id = aws_cognito_user_pool_client.test.id
+    user_pool = aws_cognito_user_pool_domain.test.user_pool_id
+  }
+}
+`, rName)
+}
+
+func testAccAWSSagemakerWorkteamCognitoConfig(rName string) string {
+	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    cognito_member_definition {
+      client_id  = aws_cognito_user_pool_client.test.id
+      user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
+	  user_group = aws_cognito_user_group.test.id
+	}
+  }
+}
+`, rName)
+}
+
+func testAccAWSSagemakerWorkteamCognitoUpdatedConfig(rName string) string {
+	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_cognito_user_group" "test2" {
+  name         = "%[1]s-2"
+  user_pool_id = aws_cognito_user_pool.test.id
+}
+
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    cognito_member_definition {
+      client_id  = aws_cognito_user_pool_client.test.id
+      user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
+	  user_group = aws_cognito_user_group.test.id
+	}
+  }
+
+  member_definition {
+	cognito_member_definition {
+      client_id  = aws_cognito_user_pool_client.test.id
+      user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
+	  user_group = aws_cognito_user_group.test2.id
+	}
+  }  
+}
+`, rName)
+}
+
+// func testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint string) string {
+// 	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
+// resource "aws_sagemaker_workteam" "test" {
+//   workteam_name = %[1]q
+
+//   oidc_config {
+//     authorization_endpoint = %[2]q
+//     client_id              = %[1]q
+//     client_secret          = %[1]q
+//     issuer                 = %[2]q
+//     jwks_uri               = %[2]q
+//     logout_endpoint        = %[2]q
+//     token_endpoint         = %[2]q
+//     user_info_endpoint     = %[2]q
+//   }
+// }
+// `, rName, endpoint)
+// }

From c61df5d2258b0db86d83836ea6371401ba863f70 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 17:32:14 +0300
Subject: [PATCH 02/14] add more tests

---
 aws/resource_aws_sagemaker_workteam.go      |   7 +-
 aws/resource_aws_sagemaker_workteam_test.go | 238 +++++++++++++-------
 2 files changed, 154 insertions(+), 91 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam.go b/aws/resource_aws_sagemaker_workteam.go
index 25fc829fce16..7d2e00bd7dae 100644
--- a/aws/resource_aws_sagemaker_workteam.go
+++ b/aws/resource_aws_sagemaker_workteam.go
@@ -155,7 +155,7 @@ func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{})
 
 	workteam, err := finder.WorkteamByName(conn, d.Id())
 	if err != nil {
-		if isAWSErr(err, "ValidationException", " The work team") {
+		if isAWSErr(err, "ValidationException", "The work team") {
 			d.SetId("")
 			log.Printf("[WARN] Unable to find SageMaker workteam (%s); removing from state", d.Id())
 			return nil
@@ -168,10 +168,7 @@ func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{})
 	d.Set("arn", arn)
 	d.Set("subdomain", workteam.SubDomain)
 	d.Set("description", workteam.Description)
-
-	// d.Set("workforce_arn", workteam.WorkforceArn)
 	d.Set("workteam_name", workteam.WorkteamName)
-	// d.Set("workforce_name", workteam.WorkforceName)
 
 	if err := d.Set("member_definition", flattenSagemakerWorkteamMemberDefinition(workteam.MemberDefinitions)); err != nil {
 		return fmt.Errorf("error setting member_definition for Sagemaker Workteam (%s): %w", d.Id(), err)
@@ -217,7 +214,7 @@ func resourceAwsSagemakerWorkteamDelete(d *schema.ResourceData, meta interface{}
 	}
 
 	if _, err := conn.DeleteWorkteam(input); err != nil {
-		if isAWSErr(err, "ValidationException", "No workteam found for account") {
+		if isAWSErr(err, "ValidationException", "The work team") {
 			return nil
 		}
 		return fmt.Errorf("error deleting SageMaker workteam (%s): %w", d.Id(), err)
diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index d4b5e0720282..5906ff0393a5 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -130,70 +130,58 @@ func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
 	})
 }
 
-// func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
-// 	var workteam sagemaker.Workteam
-// 	rName := acctest.RandomWithPrefix("tf-acc-test")
-// 	resourceName := "aws_sagemaker_workteam.test"
-// 	endpoint1 := "https://example.com"
-// 	endpoint2 := "https://test.example.com"
-
-// 	resource.Test(t, resource.TestCase{
-// 		PreCheck:     func() { testAccPreCheck(t) },
-// 		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
-// 		Providers:    testAccProviders,
-// 		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
-// 		Steps: []resource.TestStep{
-// 			{
-// 				Config: testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint1),
-// 				Check: resource.ComposeTestCheckFunc(
-// 					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
-// 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-// 					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
-// 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_id", rName),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_secret", rName),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.issuer", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.jwks_uri", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.logout_endpoint", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.token_endpoint", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.user_info_endpoint", endpoint1),
-// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.#", "1"),
-// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.0.cidrs.#", "0"),
-// 					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
-// 				),
-// 			},
-// 			{
-// 				ResourceName:            resourceName,
-// 				ImportState:             true,
-// 				ImportStateVerify:       true,
-// 				ImportStateVerifyIgnore: []string{"oidc_config.0.client_secret"},
-// 			},
-// 			{
-// 				Config: testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint2),
-// 				Check: resource.ComposeTestCheckFunc(
-// 					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
-// 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-// 					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
-// 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_id", rName),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.client_secret", rName),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.issuer", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.jwks_uri", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.logout_endpoint", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.token_endpoint", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.user_info_endpoint", endpoint2),
-// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.#", "1"),
-// 					resource.TestCheckResourceAttr(resourceName, "source_ip_config.0.cidrs.#", "0"),
-// 					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
-// 				),
-// 			},
-// 		},
-// 	})
-// }
+func TestAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
+	var workteam sagemaker.Workteam
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_workteam.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerWorkteamNotificationConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "notification_configuration.0.notification_topic_arn", "aws_sns_topic.test", "arn"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"workforce_name"},
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamOidcConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
+				),
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamNotificationConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "description", rName),
+					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "notification_configuration.0.notification_topic_arn", "aws_sns_topic.test", "arn"),
+				),
+			},
+		},
+	})
+}
 
 func TestAccAWSSagemakerWorkteam_disappears(t *testing.T) {
 	var workteam sagemaker.Workteam
@@ -207,7 +195,7 @@ func TestAccAWSSagemakerWorkteam_disappears(t *testing.T) {
 		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSSagemakerWorkteamCognitoConfig(rName),
+				Config: testAccAWSSagemakerWorkteamOidcConfig(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
 					testAccCheckResourceDisappears(testAccProvider, resourceAwsSagemakerWorkteam(), resourceName),
@@ -266,7 +254,7 @@ func testAccCheckAWSSagemakerWorkteamExists(n string, workteam *sagemaker.Workte
 	}
 }
 
-func testAccAWSSagemakerWorkteamBaseConfig(rName string) string {
+func testAccAWSSagemakerWorkteamCognitoBaseConfig(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_cognito_user_pool" "test" {
   name = %[1]q
@@ -300,7 +288,7 @@ resource "aws_sagemaker_workforce" "test" {
 }
 
 func testAccAWSSagemakerWorkteamCognitoConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
+	return testAccAWSSagemakerWorkteamCognitoBaseConfig(rName) + fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -318,7 +306,7 @@ resource "aws_sagemaker_workteam" "test" {
 }
 
 func testAccAWSSagemakerWorkteamCognitoUpdatedConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
+	return testAccAWSSagemakerWorkteamCognitoBaseConfig(rName) + fmt.Sprintf(`
 resource "aws_cognito_user_group" "test2" {
   name         = "%[1]s-2"
   user_pool_id = aws_cognito_user_pool.test.id
@@ -348,21 +336,99 @@ resource "aws_sagemaker_workteam" "test" {
 `, rName)
 }
 
-// func testAccAWSSagemakerWorkteamOidcConfig(rName, endpoint string) string {
-// 	return testAccAWSSagemakerWorkteamBaseConfig(rName) + fmt.Sprintf(`
-// resource "aws_sagemaker_workteam" "test" {
-//   workteam_name = %[1]q
-
-//   oidc_config {
-//     authorization_endpoint = %[2]q
-//     client_id              = %[1]q
-//     client_secret          = %[1]q
-//     issuer                 = %[2]q
-//     jwks_uri               = %[2]q
-//     logout_endpoint        = %[2]q
-//     token_endpoint         = %[2]q
-//     user_info_endpoint     = %[2]q
-//   }
-// }
-// `, rName, endpoint)
-// }
+func testAccAWSSagemakerWorkteamOidcBaseConfig(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_sagemaker_workforce" "test" {
+  workforce_name = %[1]q
+
+  oidc_config {
+    authorization_endpoint = "https://example.com"
+    client_id              = %[1]q
+    client_secret          = %[1]q
+    issuer                 = "https://example.com"
+    jwks_uri               = "https://example.com"
+    logout_endpoint        = "https://example.com"
+    token_endpoint         = "https://example.com"
+    user_info_endpoint     = "https://example.com"
+  }
+}
+`, rName)
+}
+
+func testAccAWSSagemakerWorkteamOidcConfig(rName string) string {
+	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    oidc_member_definition {
+	  groups  = [%[1]q]
+	}
+  }
+}
+`, rName)
+}
+
+func testAccAWSSagemakerWorkteamOidcConfig2(rName, group string) string {
+	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    oidc_member_definition {
+	  groups  = [%[1]q, %[2]q]
+	}
+  }
+}
+`, rName, group)
+}
+
+func testAccAWSSagemakerWorkteamNotificationConfig(rName string) string {
+	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sns_topic" "test" {
+  name  = %[1]q
+}
+
+resource "aws_sns_topic_policy" "test" {
+  arn = aws_sns_topic.test.arn
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Id" : "default",
+    "Statement" : [
+      {
+        "Sid" : "%[1]s",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "*"
+        },
+        "Action" : [
+          "sns:publish"
+        ],
+        "Resource" : "${aws_sns_topic.test.arn}"
+      }
+    ]
+  })
+}
+
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    oidc_member_definition {
+	  groups  = [%[1]q]
+	}
+  }
+
+  notification_configuration {
+    notification_topic_arn = aws_sns_topic.test.arn
+  }
+}
+`, rName)
+}

From 748ac69980cd704901a4266cb7b1701f0ad26b09 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 20:05:32 +0300
Subject: [PATCH 03/14] docs

---
 .../docs/r/sagemaker_workteam.html.markdown   | 92 +++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 website/docs/r/sagemaker_workteam.html.markdown

diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
new file mode 100644
index 000000000000..8024dada5795
--- /dev/null
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Sagemaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_workteam"
+description: |-
+  Provides a Sagemaker Workteam resource.
+---
+
+# Resource: aws_sagemaker_workteam
+
+Provides a Sagemaker Workteam resource.
+
+## Example Usage
+
+### Cognito Usage
+
+```terraform
+resource "aws_sagemaker_workteam" "example" {
+  workteam_name  = "example"
+  workforce_name = aws_sagemaker_workforce.example.id
+  description    = "example"
+
+  member_definition {
+    cognito_member_definition {
+      client_id  = aws_cognito_user_pool_client.example.id
+      user_pool  = aws_cognito_user_pool_domain.example.user_pool_id
+	    user_group = aws_cognito_user_group.example.id
+	}
+}
+```
+
+### Oidc Usage
+
+```terraform
+resource "aws_sagemaker_workteam" "example" {
+  workteam_name  = "example"
+  workforce_name = aws_sagemaker_workforce.example.id
+  description    = "example"
+
+  member_definition {
+    oidc_member_definition {
+	    groups  = ["example"]
+	  }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `description` - (Required) A description of the work team.
+* `workforce_name` - (Required) The name of the Workteam (must be unique).
+* `workteam_name` - (Required) The name of the workforce.
+* `member_definition` - (Required) A list of Member Definitions that contains objects that identify the workers that make up the work team. Workforces can be created using Amazon Cognito or your own OIDC Identity Provider (IdP). For private workforces created using Amazon Cognito use `cognito_member_definition`. For workforces created using your own OIDC identity provider (IdP) use `oidc_member_definition`. Do not provide input for both of these parameters in a single request. see [Member Definition](#member-definition) details below.
+* `notification_configuration` - (Required) Configures notification of workers regarding available or expiring work items. see [Notification Configuration](#notification-configuration) details below.
+
+### Member Definition
+
+* `cognito_member_definition` - (Optional) The Amazon Cognito user group that is part of the work team. See [Cognito Member Definition](#cognito-member-definition) details below.
+* `oidc_member_definition` - (Optional) A list user groups that exist in your OIDC Identity Provider (IdP). One to ten groups can be used to create a single private work team. See [Cognito Member Definition](#oidc-member-definition) details below.
+
+#### Cognito Member Definition
+
+* `client_id` - (Required) An identifier for an application client. You must create the app client ID using Amazon Cognito.
+* `user_pool` - (Required) An identifier for a user pool. The user pool must be in the same region as the service that you are calling.
+* `user_group` - (Required) An identifier for a user group.
+
+#### Oidc Member Definition
+
+* `groups` - (Required) A list of comma seperated strings that identifies user groups in your OIDC IdP. Each user group is made up of a group of private workers.
+
+### Notification Configuration
+
+* `notification_topic_arn` - (Required) The ARN for the SNS topic to which notifications should be published.
+
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workteam.
+* `id` - The name of the Workteam.
+* `subdomain` - The subdomain for your OIDC Identity Provider.
+
+## Import
+
+Sagemaker Workteams can be imported using the `workteam_name`, e.g.
+
+```
+$ terraform import aws_sagemaker_workteam.example example
+```

From de0e0a9bde2127c66a93bd7ec56192d82655fd75 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:06:27 +0300
Subject: [PATCH 04/14] changelog

---
 .changelog/20122.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 .changelog/20122.txt

diff --git a/.changelog/20122.txt b/.changelog/20122.txt
new file mode 100644
index 000000000000..f01f4efcce05
--- /dev/null
+++ b/.changelog/20122.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_sagemaker_workteam
+```
\ No newline at end of file

From b774a615f47ce5efb6bf81c7124f00324b2f4427 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:21:16 +0300
Subject: [PATCH 05/14] tests

---
 aws/resource_aws_sagemaker_workforce_test.go |  3 ++
 aws/resource_aws_sagemaker_workteam.go       |  8 ++-
 aws/resource_aws_sagemaker_workteam_test.go  | 57 ++++++++++++++++++++
 3 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workforce_test.go b/aws/resource_aws_sagemaker_workforce_test.go
index b280924f68c8..b76c10af7d90 100644
--- a/aws/resource_aws_sagemaker_workforce_test.go
+++ b/aws/resource_aws_sagemaker_workforce_test.go
@@ -20,6 +20,9 @@ func init() {
 	resource.AddTestSweepers("aws_sagemaker_workforce", &resource.Sweeper{
 		Name: "aws_sagemaker_workforce",
 		F:    testSweepSagemakerWorkforces,
+		Dependencies: []string{
+			"aws_sagemaker_workteam",
+		},
 	})
 }
 
diff --git a/aws/resource_aws_sagemaker_workteam.go b/aws/resource_aws_sagemaker_workteam.go
index 7d2e00bd7dae..5a5ddb43ff8f 100644
--- a/aws/resource_aws_sagemaker_workteam.go
+++ b/aws/resource_aws_sagemaker_workteam.go
@@ -331,8 +331,12 @@ func expandSagemakerWorkteamNotificationConfiguration(l []interface{}) *sagemake
 
 	m := l[0].(map[string]interface{})
 
-	config := &sagemaker.NotificationConfiguration{
-		NotificationTopicArn: aws.String(m["notification_topic_arn"].(string)),
+	config := &sagemaker.NotificationConfiguration{}
+
+	if v, ok := m["notification_topic_arn"].(string); ok && v != "" {
+		config.NotificationTopicArn = aws.String(v)
+	} else {
+		return nil
 	}
 
 	return config
diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index 5906ff0393a5..e9eda14019c2 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -130,6 +130,63 @@ func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
 	})
 }
 
+func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
+	var workteam sagemaker.Workteam
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_workteam.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerWorkteamOidcConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.*", rName),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"workforce_name"},
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamOidcConfig2(rName, "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "2"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.*", rName),
+					resource.TestCheckTypeSetElemAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.*", "test"),
+				),
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamOidcConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
+					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.*", rName)),
+			},
+		},
+	})
+}
+
 func TestAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")

From 9f6062f1437abf0c0c37d03822133569fe78a083 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:39:46 +0300
Subject: [PATCH 06/14] fmt

---
 aws/resource_aws_sagemaker_workteam_test.go   | 26 +++++++++----------
 .../docs/r/sagemaker_workteam.html.markdown   |  6 ++---
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index e9eda14019c2..6aad59fb3dab 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -355,8 +355,8 @@ resource "aws_sagemaker_workteam" "test" {
     cognito_member_definition {
       client_id  = aws_cognito_user_pool_client.test.id
       user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
-	  user_group = aws_cognito_user_group.test.id
-	}
+      user_group = aws_cognito_user_group.test.id
+    }
   }
 }
 `, rName)
@@ -378,16 +378,16 @@ resource "aws_sagemaker_workteam" "test" {
     cognito_member_definition {
       client_id  = aws_cognito_user_pool_client.test.id
       user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
-	  user_group = aws_cognito_user_group.test.id
-	}
+      user_group = aws_cognito_user_group.test.id
+    }
   }
 
   member_definition {
-	cognito_member_definition {
+    cognito_member_definition {
       client_id  = aws_cognito_user_pool_client.test.id
       user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
-	  user_group = aws_cognito_user_group.test2.id
-	}
+      user_group = aws_cognito_user_group.test2.id
+    }
   }  
 }
 `, rName)
@@ -421,8 +421,8 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-	  groups  = [%[1]q]
-	}
+      groups  = [%[1]q]
+    }
   }
 }
 `, rName)
@@ -437,8 +437,8 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-	  groups  = [%[1]q, %[2]q]
-	}
+      groups  = [%[1]q, %[2]q]
+    }
   }
 }
 `, rName, group)
@@ -479,8 +479,8 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-	  groups  = [%[1]q]
-	}
+      groups  = [%[1]q]
+    }
   }
 
   notification_configuration {
diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
index 8024dada5795..f1525d5572c7 100644
--- a/website/docs/r/sagemaker_workteam.html.markdown
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -39,8 +39,8 @@ resource "aws_sagemaker_workteam" "example" {
 
   member_definition {
     oidc_member_definition {
-	    groups  = ["example"]
-	  }
+      groups  = ["example"]
+    }
   }
 }
 ```
@@ -68,7 +68,7 @@ The following arguments are supported:
 
 #### Oidc Member Definition
 
-* `groups` - (Required) A list of comma seperated strings that identifies user groups in your OIDC IdP. Each user group is made up of a group of private workers.
+* `groups` - (Required) A list of comma separated strings that identifies user groups in your OIDC IdP. Each user group is made up of a group of private workers.
 
 ### Notification Configuration
 

From d307503ea63c9a82ee891b51de288a2e2611ed09 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:49:11 +0300
Subject: [PATCH 07/14] fmt

---
 aws/resource_aws_sagemaker_workteam_test.go     | 8 ++++----
 website/docs/r/sagemaker_workteam.html.markdown | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index 6aad59fb3dab..ab401c109dbe 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -388,7 +388,7 @@ resource "aws_sagemaker_workteam" "test" {
       user_pool  = aws_cognito_user_pool_domain.test.user_pool_id
       user_group = aws_cognito_user_group.test2.id
     }
-  }  
+  }
 }
 `, rName)
 }
@@ -421,7 +421,7 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-      groups  = [%[1]q]
+      groups = [%[1]q]
     }
   }
 }
@@ -437,7 +437,7 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-      groups  = [%[1]q, %[2]q]
+      groups = [%[1]q, %[2]q]
     }
   }
 }
@@ -479,7 +479,7 @@ resource "aws_sagemaker_workteam" "test" {
 
   member_definition {
     oidc_member_definition {
-      groups  = [%[1]q]
+      groups = [%[1]q]
     }
   }
 
diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
index f1525d5572c7..78846370e86e 100644
--- a/website/docs/r/sagemaker_workteam.html.markdown
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -39,7 +39,7 @@ resource "aws_sagemaker_workteam" "example" {
 
   member_definition {
     oidc_member_definition {
-      groups  = ["example"]
+      groups = ["example"]
     }
   }
 }

From 17b395961c8e7548528a1d23a0ee1d21bbe691e4 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:53:14 +0300
Subject: [PATCH 08/14] fmt

---
 aws/resource_aws_sagemaker_workteam_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index ab401c109dbe..e7aeb13c1012 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -447,7 +447,7 @@ resource "aws_sagemaker_workteam" "test" {
 func testAccAWSSagemakerWorkteamNotificationConfig(rName string) string {
 	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
 resource "aws_sns_topic" "test" {
-  name  = %[1]q
+  name = %[1]q
 }
 
 resource "aws_sns_topic_policy" "test" {

From 032c2f12dc387620542f6ae837b71c60f21585c8 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sat, 10 Jul 2021 21:54:56 +0300
Subject: [PATCH 09/14] docs fmt

---
 website/docs/r/sagemaker_workteam.html.markdown | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
index 78846370e86e..35afb355854d 100644
--- a/website/docs/r/sagemaker_workteam.html.markdown
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -24,8 +24,9 @@ resource "aws_sagemaker_workteam" "example" {
     cognito_member_definition {
       client_id  = aws_cognito_user_pool_client.example.id
       user_pool  = aws_cognito_user_pool_domain.example.user_pool_id
-	    user_group = aws_cognito_user_group.example.id
-	}
+      user_group = aws_cognito_user_group.example.id
+    }
+  }
 }
 ```
 

From 002e4ccfc0b8a02b4914bc682a5a4424a662e957 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sun, 11 Jul 2021 11:24:15 +0300
Subject: [PATCH 10/14] tags

---
 aws/resource_aws_sagemaker_workteam.go        | 69 +++++++++++----
 aws/resource_aws_sagemaker_workteam_test.go   | 88 +++++++++++++++++++
 .../docs/r/sagemaker_workteam.html.markdown   |  4 +-
 3 files changed, 143 insertions(+), 18 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam.go b/aws/resource_aws_sagemaker_workteam.go
index 5a5ddb43ff8f..c67f4aa5adc5 100644
--- a/aws/resource_aws_sagemaker_workteam.go
+++ b/aws/resource_aws_sagemaker_workteam.go
@@ -9,6 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
 )
 
@@ -100,10 +101,8 @@ func resourceAwsSagemakerWorkteam() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"workforce_arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+			"tags":     tagsSchema(),
+			"tags_all": tagsSchemaComputed(),
 			"workforce_name": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -119,11 +118,14 @@ func resourceAwsSagemakerWorkteam() *schema.Resource {
 				),
 			},
 		},
+		CustomizeDiff: SetTagsDiff,
 	}
 }
 
 func resourceAwsSagemakerWorkteamCreate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).sagemakerconn
+	defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+	tags := defaultTagsConfig.MergeTags(keyvaluetags.New(d.Get("tags").(map[string]interface{})))
 
 	name := d.Get("workteam_name").(string)
 	input := &sagemaker.CreateWorkteamInput{
@@ -137,6 +139,10 @@ func resourceAwsSagemakerWorkteamCreate(d *schema.ResourceData, meta interface{}
 		input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(v.([]interface{}))
 	}
 
+	if len(tags) > 0 {
+		input.Tags = tags.IgnoreAws().SagemakerTags()
+	}
+
 	log.Printf("[DEBUG] Sagemaker Workteam create config: %#v", *input)
 	_, err := retryOnAwsCode("ValidationException", func() (interface{}, error) {
 		return conn.CreateWorkteam(input)
@@ -152,6 +158,8 @@ func resourceAwsSagemakerWorkteamCreate(d *schema.ResourceData, meta interface{}
 
 func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).sagemakerconn
+	defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+	ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
 
 	workteam, err := finder.WorkteamByName(conn, d.Id())
 	if err != nil {
@@ -178,29 +186,56 @@ func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("error setting notification_configuration for Sagemaker Workteam (%s): %w", d.Id(), err)
 	}
 
+	tags, err := keyvaluetags.SagemakerListTags(conn, arn)
+
+	if err != nil {
+		return fmt.Errorf("error listing tags for SageMaker User Profile (%s): %w", d.Id(), err)
+	}
+
+	tags = tags.IgnoreAws().IgnoreConfig(ignoreTagsConfig)
+
+	//lintignore:AWSR002
+	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+		return fmt.Errorf("error setting tags: %w", err)
+	}
+
+	if err := d.Set("tags_all", tags.Map()); err != nil {
+		return fmt.Errorf("error setting tags_all: %w", err)
+	}
+
 	return nil
 }
 
 func resourceAwsSagemakerWorkteamUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).sagemakerconn
 
-	input := &sagemaker.UpdateWorkteamInput{
-		WorkteamName:      aws.String(d.Id()),
-		MemberDefinitions: expandSagemakerWorkteamMemberDefinition(d.Get("member_definition").([]interface{})),
-	}
+	if d.HasChangeExcept("tags_all") {
+		input := &sagemaker.UpdateWorkteamInput{
+			WorkteamName:      aws.String(d.Id()),
+			MemberDefinitions: expandSagemakerWorkteamMemberDefinition(d.Get("member_definition").([]interface{})),
+		}
 
-	if d.HasChange("description") {
-		input.Description = aws.String(d.Get("description").(string))
-	}
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
 
-	if d.HasChange("notification_configuration") {
-		input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(d.Get("notification_configuration").([]interface{}))
+		if d.HasChange("notification_configuration") {
+			input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(d.Get("notification_configuration").([]interface{}))
+		}
+
+		log.Printf("[DEBUG] Sagemaker Workteam update config: %#v", *input)
+		_, err := conn.UpdateWorkteam(input)
+		if err != nil {
+			return fmt.Errorf("error updating SageMaker Workteam: %w", err)
+		}
 	}
 
-	log.Printf("[DEBUG] Sagemaker Workteam update config: %#v", *input)
-	_, err := conn.UpdateWorkteam(input)
-	if err != nil {
-		return fmt.Errorf("error updating SageMaker Workteam: %w", err)
+	if d.HasChange("tags_all") {
+		o, n := d.GetChange("tags_all")
+
+		if err := keyvaluetags.SagemakerUpdateTags(conn, d.Get("arn").(string), o, n); err != nil {
+			return fmt.Errorf("error updating SageMaker UserProfile (%s) tags: %w", d.Id(), err)
+		}
 	}
 
 	return resourceAwsSagemakerWorkteamRead(d, meta)
diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index e7aeb13c1012..bf92add8568a 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -84,6 +84,7 @@ func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_pool", "aws_cognito_user_pool.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "member_definition.0.cognito_member_definition.0.user_group", "aws_cognito_user_group.test", "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "subdomain"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
@@ -187,6 +188,52 @@ func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
 	})
 }
 
+func TestAccAWSSagemakerWorkteam_tags(t *testing.T) {
+	var workteam sagemaker.Workteam
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_sagemaker_workteam.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		ErrorCheck:   testAccErrorCheck(t, sagemaker.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSagemakerWorkteamDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSagemakerWorkteamTagsConfig1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"workforce_name"},
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamTagsConfig2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccAWSSagemakerWorkteamTagsConfig1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSagemakerWorkteamExists(resourceName, &workteam),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
@@ -489,3 +536,44 @@ resource "aws_sagemaker_workteam" "test" {
 }
 `, rName)
 }
+
+func testAccAWSSagemakerWorkteamTagsConfig1(rName, tagKey1, tagValue1 string) string {
+	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    oidc_member_definition {
+      groups = [%[1]q]
+    }
+  }
+
+  tags = {
+    %[2]q = %[3]q
+  }  
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccAWSSagemakerWorkteamTagsConfig2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+resource "aws_sagemaker_workteam" "test" {
+  workteam_name  = %[1]q
+  workforce_name = aws_sagemaker_workforce.test.id
+  description    = %[1]q
+
+  member_definition {
+    oidc_member_definition {
+      groups = [%[1]q]
+    }
+  }
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q	
+  }  
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
index 35afb355854d..970b34965453 100644
--- a/website/docs/r/sagemaker_workteam.html.markdown
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -54,7 +54,8 @@ The following arguments are supported:
 * `workforce_name` - (Required) The name of the Workteam (must be unique).
 * `workteam_name` - (Required) The name of the workforce.
 * `member_definition` - (Required) A list of Member Definitions that contains objects that identify the workers that make up the work team. Workforces can be created using Amazon Cognito or your own OIDC Identity Provider (IdP). For private workforces created using Amazon Cognito use `cognito_member_definition`. For workforces created using your own OIDC identity provider (IdP) use `oidc_member_definition`. Do not provide input for both of these parameters in a single request. see [Member Definition](#member-definition) details below.
-* `notification_configuration` - (Required) Configures notification of workers regarding available or expiring work items. see [Notification Configuration](#notification-configuration) details below.
+* `notification_configuration` - (Optional) Configures notification of workers regarding available or expiring work items. see [Notification Configuration](#notification-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### Member Definition
 
@@ -83,6 +84,7 @@ In addition to all arguments above, the following attributes are exported:
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workteam.
 * `id` - The name of the Workteam.
 * `subdomain` - The subdomain for your OIDC Identity Provider.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
 
 ## Import
 

From 416e06fbc3c4adcfc9080c181145d4ffd14c0eb0 Mon Sep 17 00:00:00 2001
From: drfaust92 <ilia.lazebnik@gmail.com>
Date: Sun, 11 Jul 2021 13:11:54 +0300
Subject: [PATCH 11/14] docs fmt

---
 aws/resource_aws_sagemaker_workteam_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index bf92add8568a..7edf44b0e407 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -552,7 +552,7 @@ resource "aws_sagemaker_workteam" "test" {
 
   tags = {
     %[2]q = %[3]q
-  }  
+  }
 }
 `, rName, tagKey1, tagValue1)
 }
@@ -573,7 +573,7 @@ resource "aws_sagemaker_workteam" "test" {
   tags = {
     %[2]q = %[3]q
     %[4]q = %[5]q	
-  }  
+  }
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }

From 9a7ee091a99eecbffdbdc0a89de0c19fecd45349 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Wed, 28 Jul 2021 13:59:29 -0400
Subject: [PATCH 12/14] Use 'composeConfig'.

---
 aws/resource_aws_sagemaker_workteam_test.go | 28 ++++++++++-----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index 7edf44b0e407..4103e8f41b52 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -392,7 +392,7 @@ resource "aws_sagemaker_workforce" "test" {
 }
 
 func testAccAWSSagemakerWorkteamCognitoConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamCognitoBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamCognitoBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -406,11 +406,11 @@ resource "aws_sagemaker_workteam" "test" {
     }
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccAWSSagemakerWorkteamCognitoUpdatedConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamCognitoBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamCognitoBaseConfig(rName), fmt.Sprintf(`
 resource "aws_cognito_user_group" "test2" {
   name         = "%[1]s-2"
   user_pool_id = aws_cognito_user_pool.test.id
@@ -437,7 +437,7 @@ resource "aws_sagemaker_workteam" "test" {
     }
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccAWSSagemakerWorkteamOidcBaseConfig(rName string) string {
@@ -460,7 +460,7 @@ resource "aws_sagemaker_workforce" "test" {
 }
 
 func testAccAWSSagemakerWorkteamOidcConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamOidcBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -472,11 +472,11 @@ resource "aws_sagemaker_workteam" "test" {
     }
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccAWSSagemakerWorkteamOidcConfig2(rName, group string) string {
-	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamOidcBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -488,11 +488,11 @@ resource "aws_sagemaker_workteam" "test" {
     }
   }
 }
-`, rName, group)
+`, rName, group))
 }
 
 func testAccAWSSagemakerWorkteamNotificationConfig(rName string) string {
-	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamOidcBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sns_topic" "test" {
   name = %[1]q
 }
@@ -534,11 +534,11 @@ resource "aws_sagemaker_workteam" "test" {
     notification_topic_arn = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccAWSSagemakerWorkteamTagsConfig1(rName, tagKey1, tagValue1 string) string {
-	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamOidcBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -554,11 +554,11 @@ resource "aws_sagemaker_workteam" "test" {
     %[2]q = %[3]q
   }
 }
-`, rName, tagKey1, tagValue1)
+`, rName, tagKey1, tagValue1))
 }
 
 func testAccAWSSagemakerWorkteamTagsConfig2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return testAccAWSSagemakerWorkteamOidcBaseConfig(rName) + fmt.Sprintf(`
+	return composeConfig(testAccAWSSagemakerWorkteamOidcBaseConfig(rName), fmt.Sprintf(`
 resource "aws_sagemaker_workteam" "test" {
   workteam_name  = %[1]q
   workforce_name = aws_sagemaker_workforce.test.id
@@ -575,5 +575,5 @@ resource "aws_sagemaker_workteam" "test" {
     %[4]q = %[5]q	
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }

From 87bf2ffcaaa69d9fee914bf062870771b5133eb8 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Wed, 28 Jul 2021 15:00:05 -0400
Subject: [PATCH 13/14] r/aws_sagemaker_workteam: Serialize tests.

---
 aws/aws_sagemaker_test.go                     | 60 +++++++++++++++++++
 .../service/sagemaker/finder/finder.go        | 21 ++++---
 aws/resource_aws_sagemaker_domain_test.go     | 47 ---------------
 aws/resource_aws_sagemaker_workforce.go       |  1 -
 aws/resource_aws_sagemaker_workteam.go        | 56 ++++++++++-------
 aws/resource_aws_sagemaker_workteam_test.go   | 31 +++++-----
 6 files changed, 122 insertions(+), 94 deletions(-)
 create mode 100644 aws/aws_sagemaker_test.go

diff --git a/aws/aws_sagemaker_test.go b/aws/aws_sagemaker_test.go
new file mode 100644
index 000000000000..3a3301ff05c8
--- /dev/null
+++ b/aws/aws_sagemaker_test.go
@@ -0,0 +1,60 @@
+package aws
+
+import (
+	"testing"
+)
+
+// Tests are serialized as SagmMaker Domain resources are limited to 1 per account by default.
+// SageMaker UserProfile and App depend on the Domain resources and as such are also part of the serialized test suite.
+// Sagemaker Workteam tests must also be serialized
+func TestAccAWSSagemaker_serial(t *testing.T) {
+	testCases := map[string]map[string]func(t *testing.T){
+		"App": {
+			"basic":        testAccAWSSagemakerApp_basic,
+			"disappears":   testAccAWSSagemakerApp_tags,
+			"tags":         testAccAWSSagemakerApp_disappears,
+			"resourceSpec": testAccAWSSagemakerApp_resourceSpec,
+		},
+		"Domain": {
+			"basic":                                testAccAWSSagemakerDomain_basic,
+			"disappears":                           testAccAWSSagemakerDomain_tags,
+			"tags":                                 testAccAWSSagemakerDomain_disappears,
+			"tensorboardAppSettings":               testAccAWSSagemakerDomain_tensorboardAppSettings,
+			"tensorboardAppSettingsWithImage":      testAccAWSSagemakerDomain_tensorboardAppSettingsWithImage,
+			"kernelGatewayAppSettings":             testAccAWSSagemakerDomain_kernelGatewayAppSettings,
+			"kernelGatewayAppSettings_customImage": testAccAWSSagemakerDomain_kernelGatewayAppSettings_customImage,
+			"jupyterServerAppSettings":             testAccAWSSagemakerDomain_jupyterServerAppSettings,
+			"kms":                                  testAccAWSSagemakerDomain_kms,
+			"securityGroup":                        testAccAWSSagemakerDomain_securityGroup,
+			"sharingSettings":                      testAccAWSSagemakerDomain_sharingSettings,
+		},
+		"UserProfile": {
+			"basic":                           testAccAWSSagemakerUserProfile_basic,
+			"disappears":                      testAccAWSSagemakerUserProfile_tags,
+			"tags":                            testAccAWSSagemakerUserProfile_disappears,
+			"tensorboardAppSettings":          testAccAWSSagemakerUserProfile_tensorboardAppSettings,
+			"tensorboardAppSettingsWithImage": testAccAWSSagemakerUserProfile_tensorboardAppSettingsWithImage,
+			"kernelGatewayAppSettings":        testAccAWSSagemakerUserProfile_kernelGatewayAppSettings,
+			"jupyterServerAppSettings":        testAccAWSSagemakerUserProfile_jupyterServerAppSettings,
+		},
+		"Workteam": {
+			"disappears":         testAccAWSSagemakerWorkteam_disappears,
+			"CognitoConfig":      testAccAWSSagemakerWorkteam_cognitoConfig,
+			"NotificationConfig": testAccAWSSagemakerWorkteam_notificationConfig,
+			"OidcConfig":         testAccAWSSagemakerWorkteam_oidcConfig,
+			"Tags":               testAccAWSSagemakerWorkteam_tags,
+		},
+	}
+
+	for group, m := range testCases {
+		m := m
+		t.Run(group, func(t *testing.T) {
+			for name, tc := range m {
+				tc := tc
+				t.Run(name, func(t *testing.T) {
+					tc(t)
+				})
+			}
+		})
+	}
+}
diff --git a/aws/internal/service/sagemaker/finder/finder.go b/aws/internal/service/sagemaker/finder/finder.go
index 3938f360e96a..0ea02c403e78 100644
--- a/aws/internal/service/sagemaker/finder/finder.go
+++ b/aws/internal/service/sagemaker/finder/finder.go
@@ -210,24 +210,29 @@ func WorkforceByName(conn *sagemaker.SageMaker, name string) (*sagemaker.Workfor
 	return output.Workforce, nil
 }
 
-// WorkteamByName returns the workteam corresponding to the specified name.
-// Returns nil if no workteam is found.
 func WorkteamByName(conn *sagemaker.SageMaker, name string) (*sagemaker.Workteam, error) {
 	input := &sagemaker.DescribeWorkteamInput{
 		WorkteamName: aws.String(name),
 	}
 
 	output, err := conn.DescribeWorkteam(input)
-	if err != nil {
-		return nil, err
+
+	if tfawserr.ErrMessageContains(err, "ValidationException", "The work team") {
+		return nil, &resource.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	if output == nil {
-		return nil, nil
+	if err != nil {
+		return nil, err
 	}
 
-	if output.Workteam == nil {
-		return nil, nil
+	if output == nil || output.Workteam == nil {
+		return nil, &resource.NotFoundError{
+			Message:     "Empty result",
+			LastRequest: input,
+		}
 	}
 
 	return output.Workteam, nil
diff --git a/aws/resource_aws_sagemaker_domain_test.go b/aws/resource_aws_sagemaker_domain_test.go
index b11720bff587..7fce7fcbd142 100644
--- a/aws/resource_aws_sagemaker_domain_test.go
+++ b/aws/resource_aws_sagemaker_domain_test.go
@@ -17,53 +17,6 @@ import (
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
 )
 
-// Tests are serialized as SagmMaker Domain resources are limited to 1 per account by default.
-// SageMaker UserProfile and App depend on the Domain resources and as such are also part of the serialized test suite.
-func TestAccAWSSagemakerDomain_serial(t *testing.T) {
-	testCases := map[string]map[string]func(t *testing.T){
-		"Domain": {
-			"basic":                                testAccAWSSagemakerDomain_basic,
-			"disappears":                           testAccAWSSagemakerDomain_tags,
-			"tags":                                 testAccAWSSagemakerDomain_disappears,
-			"tensorboardAppSettings":               testAccAWSSagemakerDomain_tensorboardAppSettings,
-			"tensorboardAppSettingsWithImage":      testAccAWSSagemakerDomain_tensorboardAppSettingsWithImage,
-			"kernelGatewayAppSettings":             testAccAWSSagemakerDomain_kernelGatewayAppSettings,
-			"kernelGatewayAppSettings_customImage": testAccAWSSagemakerDomain_kernelGatewayAppSettings_customImage,
-			"jupyterServerAppSettings":             testAccAWSSagemakerDomain_jupyterServerAppSettings,
-			"kms":                                  testAccAWSSagemakerDomain_kms,
-			"securityGroup":                        testAccAWSSagemakerDomain_securityGroup,
-			"sharingSettings":                      testAccAWSSagemakerDomain_sharingSettings,
-		},
-		"UserProfile": {
-			"basic":                           testAccAWSSagemakerUserProfile_basic,
-			"disappears":                      testAccAWSSagemakerUserProfile_tags,
-			"tags":                            testAccAWSSagemakerUserProfile_disappears,
-			"tensorboardAppSettings":          testAccAWSSagemakerUserProfile_tensorboardAppSettings,
-			"tensorboardAppSettingsWithImage": testAccAWSSagemakerUserProfile_tensorboardAppSettingsWithImage,
-			"kernelGatewayAppSettings":        testAccAWSSagemakerUserProfile_kernelGatewayAppSettings,
-			"jupyterServerAppSettings":        testAccAWSSagemakerUserProfile_jupyterServerAppSettings,
-		},
-		"App": {
-			"basic":        testAccAWSSagemakerApp_basic,
-			"disappears":   testAccAWSSagemakerApp_tags,
-			"tags":         testAccAWSSagemakerApp_disappears,
-			"resourceSpec": testAccAWSSagemakerApp_resourceSpec,
-		},
-	}
-
-	for group, m := range testCases {
-		m := m
-		t.Run(group, func(t *testing.T) {
-			for name, tc := range m {
-				tc := tc
-				t.Run(name, func(t *testing.T) {
-					tc(t)
-				})
-			}
-		})
-	}
-}
-
 func init() {
 	resource.AddTestSweepers("aws_sagemaker_domain", &resource.Sweeper{
 		Name: "aws_sagemaker_domain",
diff --git a/aws/resource_aws_sagemaker_workforce.go b/aws/resource_aws_sagemaker_workforce.go
index 44297042145f..bee2694141da 100644
--- a/aws/resource_aws_sagemaker_workforce.go
+++ b/aws/resource_aws_sagemaker_workforce.go
@@ -194,7 +194,6 @@ func resourceAwsSagemakerWorkforceRead(d *schema.ResourceData, meta interface{})
 
 	if err != nil {
 		return fmt.Errorf("error reading SageMaker Workforce (%s): %w", d.Id(), err)
-
 	}
 
 	d.Set("arn", workforce.WorkforceArn)
diff --git a/aws/resource_aws_sagemaker_workteam.go b/aws/resource_aws_sagemaker_workteam.go
index c67f4aa5adc5..63d3931258ac 100644
--- a/aws/resource_aws_sagemaker_workteam.go
+++ b/aws/resource_aws_sagemaker_workteam.go
@@ -4,13 +4,16 @@ import (
 	"fmt"
 	"log"
 	"regexp"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/tfresource"
 )
 
 func resourceAwsSagemakerWorkteam() *schema.Resource {
@@ -19,6 +22,7 @@ func resourceAwsSagemakerWorkteam() *schema.Resource {
 		Read:   resourceAwsSagemakerWorkteamRead,
 		Update: resourceAwsSagemakerWorkteamUpdate,
 		Delete: resourceAwsSagemakerWorkteamDelete,
+
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
 		},
@@ -118,6 +122,7 @@ func resourceAwsSagemakerWorkteam() *schema.Resource {
 				),
 			},
 		},
+
 		CustomizeDiff: SetTagsDiff,
 	}
 }
@@ -143,12 +148,13 @@ func resourceAwsSagemakerWorkteamCreate(d *schema.ResourceData, meta interface{}
 		input.Tags = tags.IgnoreAws().SagemakerTags()
 	}
 
-	log.Printf("[DEBUG] Sagemaker Workteam create config: %#v", *input)
-	_, err := retryOnAwsCode("ValidationException", func() (interface{}, error) {
+	log.Printf("[DEBUG] Updating SageMaker Workteam: %s", input)
+	_, err := tfresource.RetryWhenAwsErrCodeEquals(2*time.Minute, func() (interface{}, error) {
 		return conn.CreateWorkteam(input)
-	})
+	}, "ValidationException")
+
 	if err != nil {
-		return fmt.Errorf("error creating SageMaker Workteam: %w", err)
+		return fmt.Errorf("error creating SageMaker Workteam (%s): %w", name, err)
 	}
 
 	d.SetId(name)
@@ -162,14 +168,15 @@ func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{})
 	ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
 
 	workteam, err := finder.WorkteamByName(conn, d.Id())
-	if err != nil {
-		if isAWSErr(err, "ValidationException", "The work team") {
-			d.SetId("")
-			log.Printf("[WARN] Unable to find SageMaker workteam (%s); removing from state", d.Id())
-			return nil
-		}
-		return fmt.Errorf("error reading SageMaker workteam (%s): %w", d.Id(), err)
 
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SageMaker Workteam (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error reading SageMaker Workteam (%s): %w", d.Id(), err)
 	}
 
 	arn := aws.StringValue(workteam.WorkteamArn)
@@ -179,17 +186,17 @@ func resourceAwsSagemakerWorkteamRead(d *schema.ResourceData, meta interface{})
 	d.Set("workteam_name", workteam.WorkteamName)
 
 	if err := d.Set("member_definition", flattenSagemakerWorkteamMemberDefinition(workteam.MemberDefinitions)); err != nil {
-		return fmt.Errorf("error setting member_definition for Sagemaker Workteam (%s): %w", d.Id(), err)
+		return fmt.Errorf("error setting member_definition: %w", err)
 	}
 
 	if err := d.Set("notification_configuration", flattenSagemakerWorkteamNotificationConfiguration(workteam.NotificationConfiguration)); err != nil {
-		return fmt.Errorf("error setting notification_configuration for Sagemaker Workteam (%s): %w", d.Id(), err)
+		return fmt.Errorf("error setting notification_configuration: %w", err)
 	}
 
 	tags, err := keyvaluetags.SagemakerListTags(conn, arn)
 
 	if err != nil {
-		return fmt.Errorf("error listing tags for SageMaker User Profile (%s): %w", d.Id(), err)
+		return fmt.Errorf("error listing tags for SageMaker Workteam (%s): %w", d.Id(), err)
 	}
 
 	tags = tags.IgnoreAws().IgnoreConfig(ignoreTagsConfig)
@@ -223,10 +230,11 @@ func resourceAwsSagemakerWorkteamUpdate(d *schema.ResourceData, meta interface{}
 			input.NotificationConfiguration = expandSagemakerWorkteamNotificationConfiguration(d.Get("notification_configuration").([]interface{}))
 		}
 
-		log.Printf("[DEBUG] Sagemaker Workteam update config: %#v", *input)
+		log.Printf("[DEBUG] Updating SageMaker Workteam: %s", input)
 		_, err := conn.UpdateWorkteam(input)
+
 		if err != nil {
-			return fmt.Errorf("error updating SageMaker Workteam: %w", err)
+			return fmt.Errorf("error updating SageMaker Workteam (%s): %w", d.Id(), err)
 		}
 	}
 
@@ -234,7 +242,7 @@ func resourceAwsSagemakerWorkteamUpdate(d *schema.ResourceData, meta interface{}
 		o, n := d.GetChange("tags_all")
 
 		if err := keyvaluetags.SagemakerUpdateTags(conn, d.Get("arn").(string), o, n); err != nil {
-			return fmt.Errorf("error updating SageMaker UserProfile (%s) tags: %w", d.Id(), err)
+			return fmt.Errorf("error updating SageMaker Workteam (%s) tags: %w", d.Id(), err)
 		}
 	}
 
@@ -244,15 +252,17 @@ func resourceAwsSagemakerWorkteamUpdate(d *schema.ResourceData, meta interface{}
 func resourceAwsSagemakerWorkteamDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).sagemakerconn
 
-	input := &sagemaker.DeleteWorkteamInput{
+	log.Printf("[DEBUG] Deleting SageMaker Workteam: %s", d.Id())
+	_, err := conn.DeleteWorkteam(&sagemaker.DeleteWorkteamInput{
 		WorkteamName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrMessageContains(err, "ValidationException", "The work team") {
+		return nil
 	}
 
-	if _, err := conn.DeleteWorkteam(input); err != nil {
-		if isAWSErr(err, "ValidationException", "The work team") {
-			return nil
-		}
-		return fmt.Errorf("error deleting SageMaker workteam (%s): %w", d.Id(), err)
+	if err != nil {
+		return fmt.Errorf("error deleting SageMaker Workteam (%s): %w", d.Id(), err)
 	}
 
 	return nil
diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index 4103e8f41b52..bf139f13c056 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -8,12 +8,12 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
-	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/sagemaker/finder"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/tfresource"
 )
 
 func init() {
@@ -60,7 +60,7 @@ func testSweepSagemakerWorkteams(region string) error {
 	return sweeperErrs.ErrorOrNil()
 }
 
-func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
+func testAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_sagemaker_workteam.test"
@@ -131,7 +131,7 @@ func TestAccAWSSagemakerWorkteam_cognitoConfig(t *testing.T) {
 	})
 }
 
-func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
+func testAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_sagemaker_workteam.test"
@@ -188,7 +188,7 @@ func TestAccAWSSagemakerWorkteam_oidcConfig(t *testing.T) {
 	})
 }
 
-func TestAccAWSSagemakerWorkteam_tags(t *testing.T) {
+func testAccAWSSagemakerWorkteam_tags(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_sagemaker_workteam.test"
@@ -234,7 +234,7 @@ func TestAccAWSSagemakerWorkteam_tags(t *testing.T) {
 	})
 }
 
-func TestAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
+func testAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_sagemaker_workteam.test"
@@ -287,7 +287,7 @@ func TestAccAWSSagemakerWorkteam_notificationConfig(t *testing.T) {
 	})
 }
 
-func TestAccAWSSagemakerWorkteam_disappears(t *testing.T) {
+func testAccAWSSagemakerWorkteam_disappears(t *testing.T) {
 	var workteam sagemaker.Workteam
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_sagemaker_workteam.test"
@@ -318,18 +318,17 @@ func testAccCheckAWSSagemakerWorkteamDestroy(s *terraform.State) error {
 			continue
 		}
 
-		workteam, err := finder.WorkteamByName(conn, rs.Primary.ID)
-		if tfawserr.ErrMessageContains(err, "ValidationException", "The work team") {
+		_, err := finder.WorkteamByName(conn, rs.Primary.ID)
+
+		if tfresource.NotFound(err) {
 			continue
 		}
 
 		if err != nil {
-			return fmt.Errorf("error reading Sagemaker Workteam (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
-		if aws.StringValue(workteam.WorkteamName) == rs.Primary.ID {
-			return fmt.Errorf("SageMaker Workteam %q still exists", rs.Primary.ID)
-		}
+		return fmt.Errorf("SageMaker Workteam %s still exists", rs.Primary.ID)
 	}
 
 	return nil
@@ -343,16 +342,18 @@ func testAccCheckAWSSagemakerWorkteamExists(n string, workteam *sagemaker.Workte
 		}
 
 		if rs.Primary.ID == "" {
-			return fmt.Errorf("No sagmaker workteam ID is set")
+			return fmt.Errorf("No SageMaker Workteam ID is set")
 		}
 
 		conn := testAccProvider.Meta().(*AWSClient).sagemakerconn
-		resp, err := finder.WorkteamByName(conn, rs.Primary.ID)
+
+		output, err := finder.WorkteamByName(conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		*workteam = *resp
+		*workteam = *output
 
 		return nil
 	}

From f66c5dbce5c6758c6f6dc9161f4fd6f75f9abd87 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Wed, 28 Jul 2021 15:01:46 -0400
Subject: [PATCH 14/14] Fix terrafmt error.

---
 aws/resource_aws_sagemaker_workteam_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/aws/resource_aws_sagemaker_workteam_test.go b/aws/resource_aws_sagemaker_workteam_test.go
index bf139f13c056..36b0b32f6f82 100644
--- a/aws/resource_aws_sagemaker_workteam_test.go
+++ b/aws/resource_aws_sagemaker_workteam_test.go
@@ -573,7 +573,7 @@ resource "aws_sagemaker_workteam" "test" {
 
   tags = {
     %[2]q = %[3]q
-    %[4]q = %[5]q	
+    %[4]q = %[5]q
   }
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))