linting: Restores Semgrep checks

.semgrep.yml

@@ -4,7 +4,7 @@ rules:
     message: Prefer naming acceptance tests with _disappears_Parent suffix
     paths:
       include:
-        - 'aws/*_test.go'
+        - "internal/**/*_test.go"
     patterns:
       - pattern: func $FUNCNAME(t *testing.T) { ... }
       - metavariable-regex:
@@ -17,28 +17,12 @@ rules:
     message: Resources should not implement multiple AWS service functionality
     paths:
       exclude:
-        - aws/config.go
-        - aws/structure.go
-        - aws/validators.go
-        - aws/*wafregional*.go
-        - aws/resource_aws_serverlessapplicationrepository_cloudformation_stack.go
-        - aws/resource_aws_transfer_server.go
-        - aws/*_test.go
-        - aws/internal/keyvaluetags/
-        - aws/internal/namevaluesfilters/
-        - aws/internal/service/wafregional/
-        # Legacy resource handling
-        - aws/resource_aws_autoscaling_group.go
-        - aws/resource_aws_efs_mount_target.go
-        - aws/resource_aws_elastic_beanstalk_environment.go
-        - aws/resource_aws_elb.go
-        - aws/resource_aws_iam_server_certificate.go
-        - aws/resource_aws_lambda_event_source_mapping.go
-        - aws/resource_aws_launch_configuration.go
-        - aws/resource_aws_lb.go
-        - aws/resource_aws_s3_bucket_object.go
+        - "internal/service/**/*_test.go"
+        - "internal/service/**/sweep.go"
+        - "internal/acctest/acctest.go"
+        - "internal/conns/conns.go"
       include:
-        - aws/
+        - internal/
     patterns:
       - pattern: |
           import ("$X")
@@ -49,6 +33,10 @@ rules:
       - metavariable-regex:
           metavariable: '$Y'
           regex: '^"github.com/aws/aws-sdk-go/service/[^/]+"$'
+      # wafregional uses a number of resources from waf
+      - pattern-not: |
+          import ("github.com/aws/aws-sdk-go/service/waf")
+          import ("github.com/aws/aws-sdk-go/service/wafregional")
     severity: WARNING
 
   - id: prefer-aws-go-sdk-pointer-conversion-assignment

internal/generate/namevaluesfilters/generators/servicefilters/main.go

@@ -92,7 +92,7 @@ var templateBody = `
 
 package namevaluesfilters
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"github.com/aws/aws-sdk-go/aws"
 {{- range .SliceServiceNames }}
 {{- if eq . (. | FilterPackage) }}

internal/service/autoscaling/group.go

@@ -1,6 +1,6 @@
 package autoscaling
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"bytes"
 	"context"
 	"fmt"

internal/service/autoscaling/launch_configuration.go

@@ -1,6 +1,6 @@
 package autoscaling
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"bytes"
 	"crypto/sha1"
 	"encoding/base64"

internal/service/backup/vault_notifications_test.go

@@ -14,7 +14,7 @@ import (
 	tfbackup "github.com/hashicorp/terraform-provider-aws/internal/service/backup"
 )
 
-func TestAccBackupVaultNotifications_Notification_basic(t *testing.T) {
+func TestAccBackupVaultNotification_basic(t *testing.T) {
 	var vault backup.GetBackupVaultNotificationsOutput
 
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -41,7 +41,7 @@ func TestAccBackupVaultNotifications_Notification_basic(t *testing.T) {
 	})
 }
 
-func TestAccBackupVaultNotifications_Notification_disappears(t *testing.T) {
+func TestAccBackupVaultNotification_disappears(t *testing.T) {
 	var vault backup.GetBackupVaultNotificationsOutput
 
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)

internal/service/cognitoidp/user_pool_ui_customization_test.go

@@ -15,7 +15,7 @@ import (
 	tfcognitoidp "github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp"
 )
 
-func TestAccCognitoIDPUserPoolUICustomization_AllClients_cSS(t *testing.T) {
+func TestAccCognitoIDPUserPoolUICustomization_AllClients_CSS(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cognito_user_pool_ui_customization.test"
 	userPoolResourceName := "aws_cognito_user_pool.test"
@@ -67,7 +67,7 @@ func TestAccCognitoIDPUserPoolUICustomization_AllClients_cSS(t *testing.T) {
 	})
 }
 
-func TestAccCognitoIDPUserPoolUICustomization_AllClients_disappears(t *testing.T) {
+func TestAccCognitoIDPUserPoolUICustomization_AllClients_disappears(t *testing.T) { // nosemgrep: acceptance-test-naming-parent-disappears
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cognito_user_pool_ui_customization.test"
 
@@ -143,7 +143,7 @@ func TestAccCognitoIDPUserPoolUICustomization_AllClients_imageFile(t *testing.T)
 	})
 }
 
-func TestAccCognitoIDPUserPoolUICustomization_AllClients_cSSAndImageFile(t *testing.T) {
+func TestAccCognitoIDPUserPoolUICustomization_AllClients_CSSAndImageFile(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cognito_user_pool_ui_customization.test"
 	userPoolResourceName := "aws_cognito_user_pool.test"
@@ -210,7 +210,7 @@ func TestAccCognitoIDPUserPoolUICustomization_AllClients_cSSAndImageFile(t *test
 	})
 }
 
-func TestAccCognitoIDPUserPoolUICustomization_Client_cSS(t *testing.T) {
+func TestAccCognitoIDPUserPoolUICustomization_Client_CSS(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cognito_user_pool_ui_customization.test"
 	clientResourceName := "aws_cognito_user_pool_client.test"
@@ -263,7 +263,7 @@ func TestAccCognitoIDPUserPoolUICustomization_Client_cSS(t *testing.T) {
 	})
 }
 
-func TestAccCognitoIDPUserPoolUICustomization_Client_disappears(t *testing.T) {
+func TestAccCognitoIDPUserPoolUICustomization_Client_disappears(t *testing.T) { // nosemgrep: acceptance-test-naming-parent-disappears
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cognito_user_pool_ui_customization.test"
 

internal/service/ec2/network_interface_sg_attachment_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccEC2NetworkInterfaceSgAttachment_SG_basic(t *testing.T) {
+func TestAccEC2NetworkInterfaceSgAttachment_basic(t *testing.T) {
 	networkInterfaceResourceName := "aws_network_interface.test"
 	securityGroupResourceName := "aws_security_group.test"
 	resourceName := "aws_network_interface_sg_attachment.test"
@@ -38,7 +38,7 @@ func TestAccEC2NetworkInterfaceSgAttachment_SG_basic(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterfaceSgAttachment_SG_disappears(t *testing.T) {
+func TestAccEC2NetworkInterfaceSgAttachment_disappears(t *testing.T) {
 	resourceName := "aws_network_interface_sg_attachment.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -60,7 +60,7 @@ func TestAccEC2NetworkInterfaceSgAttachment_SG_disappears(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterfaceSgAttachment_SG_instance(t *testing.T) {
+func TestAccEC2NetworkInterfaceSgAttachment_instance(t *testing.T) {
 	instanceResourceName := "aws_instance.test"
 	securityGroupResourceName := "aws_security_group.test"
 	resourceName := "aws_network_interface_sg_attachment.test"
@@ -84,7 +84,7 @@ func TestAccEC2NetworkInterfaceSgAttachment_SG_instance(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterfaceSgAttachment_SG_multiple(t *testing.T) {
+func TestAccEC2NetworkInterfaceSgAttachment_multiple(t *testing.T) {
 	networkInterfaceResourceName := "aws_network_interface.test"
 	securityGroupResourceName1 := "aws_security_group.test.0"
 	securityGroupResourceName2 := "aws_security_group.test.1"

internal/service/ec2/network_interface_test.go

@@ -18,7 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccEC2NetworkInterface_ENI_basic(t *testing.T) {
+func TestAccEC2NetworkInterface_basic(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	subnetResourceName := "aws_subnet.test"
@@ -61,7 +61,7 @@ func TestAccEC2NetworkInterface_ENI_basic(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_ipv6(t *testing.T) {
+func TestAccEC2NetworkInterface_ipv6(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -105,7 +105,7 @@ func TestAccEC2NetworkInterface_ENI_ipv6(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_tags(t *testing.T) {
+func TestAccEC2NetworkInterface_tags(t *testing.T) {
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var conf ec2.NetworkInterface
@@ -150,7 +150,7 @@ func TestAccEC2NetworkInterface_ENI_tags(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_ipv6Count(t *testing.T) {
+func TestAccEC2NetworkInterface_ipv6Count(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -198,7 +198,7 @@ func TestAccEC2NetworkInterface_ENI_ipv6Count(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_disappears(t *testing.T) {
+func TestAccEC2NetworkInterface_disappears(t *testing.T) {
 	var networkInterface ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -221,7 +221,7 @@ func TestAccEC2NetworkInterface_ENI_disappears(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_description(t *testing.T) {
+func TestAccEC2NetworkInterface_description(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	subnetResourceName := "aws_subnet.test"
@@ -289,7 +289,7 @@ func TestAccEC2NetworkInterface_ENI_description(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_attachment(t *testing.T) {
+func TestAccEC2NetworkInterface_attachment(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -322,7 +322,7 @@ func TestAccEC2NetworkInterface_ENI_attachment(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_ignoreExternalAttachment(t *testing.T) {
+func TestAccEC2NetworkInterface_ignoreExternalAttachment(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -349,7 +349,7 @@ func TestAccEC2NetworkInterface_ENI_ignoreExternalAttachment(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_sourceDestCheck(t *testing.T) {
+func TestAccEC2NetworkInterface_sourceDestCheck(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -390,7 +390,7 @@ func TestAccEC2NetworkInterface_ENI_sourceDestCheck(t *testing.T) {
 	})
 }
 
-func TestAccEC2NetworkInterface_ENI_privateIPsCount(t *testing.T) {
+func TestAccEC2NetworkInterface_privateIPsCount(t *testing.T) {
 	var conf ec2.NetworkInterface
 	resourceName := "aws_network_interface.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)

internal/service/efs/mount_target.go

@@ -7,14 +7,14 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/efs"
 	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
 )
 
 const (
@@ -105,7 +105,7 @@ func resourceMountTargetCreate(d *schema.ResourceData, meta interface{}) error {
 	// to parallel requests if they both include the same AZ
 	// and we would end up managing the same MT as 2 resources.
 	// So we make it fail by calling 1 request per AZ at a time.
-	az, err := getAzFromSubnetId(subnetId, meta.(*conns.AWSClient).EC2Conn)
+	az, err := getAzFromSubnetId(subnetId, meta)
 	if err != nil {
 		return fmt.Errorf("Failed getting Availability Zone from subnet ID (%s): %s", subnetId, err)
 	}
@@ -247,20 +247,14 @@ func resourceMountTargetRead(d *schema.ResourceData, meta interface{}) error {
 	return nil
 }
 
-func getAzFromSubnetId(subnetId string, conn *ec2.EC2) (string, error) {
-	input := ec2.DescribeSubnetsInput{
-		SubnetIds: []*string{aws.String(subnetId)},
-	}
-	out, err := conn.DescribeSubnets(&input)
+func getAzFromSubnetId(subnetId string, meta interface{}) (string, error) {
+	conn := meta.(*conns.AWSClient).EC2Conn
+	subnet, err := ec2.FindSubnetByID(conn, subnetId)
 	if err != nil {
 		return "", err
 	}
 
-	if l := len(out.Subnets); l != 1 {
-		return "", fmt.Errorf("Expected exactly 1 subnet returned for %q, got: %d", subnetId, l)
-	}
-
-	return aws.StringValue(out.Subnets[0].AvailabilityZone), nil
+	return aws.StringValue(subnet.AvailabilityZone), nil
 }
 
 func resourceMountTargetDelete(d *schema.ResourceData, meta interface{}) error {

internal/service/elasticbeanstalk/environment.go

@@ -1,6 +1,6 @@
 package elasticbeanstalk
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"fmt"
 	"log"
 	"regexp"

internal/service/elasticsearch/domain_saml_options_test.go

@@ -15,7 +15,7 @@ import (
 	tfelasticsearch "github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch"
 )
 
-func TestAccElasticsearchDomainSamlOptions_SAML_basic(t *testing.T) {
+func TestAccElasticSearchDomainSamlOptions_basic(t *testing.T) {
 	var domain elasticsearch.ElasticsearchDomainStatus
 
 	rName := sdkacctest.RandomWithPrefix("acc-test")
@@ -49,7 +49,7 @@ func TestAccElasticsearchDomainSamlOptions_SAML_basic(t *testing.T) {
 	})
 }
 
-func TestAccElasticsearchDomainSamlOptions_SAML_disappears(t *testing.T) {
+func TestAccElasticSearchDomainSamlOptions_disappears(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix("acc-test")
 	rUserName := sdkacctest.RandomWithPrefix("es-master-user")
 	resourceName := "aws_elasticsearch_domain_saml_options.main"
@@ -72,7 +72,7 @@ func TestAccElasticsearchDomainSamlOptions_SAML_disappears(t *testing.T) {
 	})
 }
 
-func TestAccElasticsearchDomainSamlOptions_SAMLDisappears_domain(t *testing.T) {
+func TestAccElasticSearchDomainSamlOptions_disappears_domain(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix("acc-test")
 	rUserName := sdkacctest.RandomWithPrefix("es-master-user")
 	resourceName := "aws_elasticsearch_domain_saml_options.main"
@@ -96,7 +96,7 @@ func TestAccElasticsearchDomainSamlOptions_SAMLDisappears_domain(t *testing.T) {
 	})
 }
 
-func TestAccElasticsearchDomainSamlOptions_SAML_update(t *testing.T) {
+func TestAccElasticSearchDomainSamlOptions_update(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix("acc-test")
 	rUserName := sdkacctest.RandomWithPrefix("es-master-user")
 	resourceName := "aws_elasticsearch_domain_saml_options.main"
@@ -128,7 +128,7 @@ func TestAccElasticsearchDomainSamlOptions_SAML_update(t *testing.T) {
 	})
 }
 
-func TestAccElasticsearchDomainSamlOptions_SAML_disabled(t *testing.T) {
+func TestAccElasticSearchDomainSamlOptions_disabled(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix("acc-test")
 	rUserName := sdkacctest.RandomWithPrefix("es-master-user")
 	resourceName := "aws_elasticsearch_domain_saml_options.main"

internal/service/elb/load_balancer.go

@@ -1,6 +1,6 @@
 package elb
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"bytes"
 	"fmt"
 	"log"

internal/service/elb/load_balancer_test.go

@@ -1,6 +1,6 @@
 package elb_test
 
-import (
+import ( // nosemgrep: aws-sdk-go-multiple-service-imports
 	"fmt"
 	"math/rand"
 	"reflect"