r/aws_config_organization_custom_policy_rule: New resource

.changelog/21373.txt

@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_config_organization_custom_policy_rule
+```
+
+```release-note:note
+resource/aws_config_organization_custom_policy_rule: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```

internal/service/configservice/configservice.go

@@ -269,10 +269,16 @@ func refreshConformancePackStatus(ctx context.Context, conn *configservice.Confi
 	}
 }
 
-func refreshOrganizationConfigRuleStatus(ctx context.Context, conn *configservice.ConfigService, name string) retry.StateRefreshFunc {
+func refreshOrganizationConfigRuleStatus(ctx context.Context, conn *configservice.ConfigService, name string, target string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		status, err := describeOrganizationConfigRuleStatus(ctx, conn, name)
 
+		// Transient ResourceDoesNotExist error after creation caught here
+		// in cases where the StateChangeConf's delay time is not sufficient
+		if target != configservice.OrganizationResourceDetailedStatusDeleteSuccessful && tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchOrganizationConfigRuleException) {
+			return nil, "", nil
+		}
+
 		if err != nil {
 			return nil, "", err
 		}
@@ -456,11 +462,12 @@ func waitForOrganizationConformancePackStatusDeleteSuccessful(ctx context.Contex
 
 func waitForOrganizationRuleStatusCreateSuccessful(ctx context.Context, conn *configservice.ConfigService, name string, timeout time.Duration) error {
 	stateChangeConf := &retry.StateChangeConf{
-		Pending: []string{configservice.OrganizationRuleStatusCreateInProgress},
-		Target:  []string{configservice.OrganizationRuleStatusCreateSuccessful},
-		Refresh: refreshOrganizationConfigRuleStatus(ctx, conn, name),
-		Timeout: timeout,
-		Delay:   10 * time.Second,
+		Pending:        []string{configservice.OrganizationRuleStatusCreateInProgress},
+		Target:         []string{configservice.OrganizationRuleStatusCreateSuccessful},
+		Refresh:        refreshOrganizationConfigRuleStatus(ctx, conn, name, configservice.OrganizationRuleStatusCreateSuccessful),
+		Timeout:        timeout,
+		NotFoundChecks: 10,
+		Delay:          30 * time.Second,
 	}
 
 	_, err := stateChangeConf.WaitForStateContext(ctx)
@@ -472,7 +479,7 @@ func waitForOrganizationRuleStatusDeleteSuccessful(ctx context.Context, conn *co
 	stateChangeConf := &retry.StateChangeConf{
 		Pending: []string{configservice.OrganizationRuleStatusDeleteInProgress},
 		Target:  []string{configservice.OrganizationRuleStatusDeleteSuccessful},
-		Refresh: refreshOrganizationConfigRuleStatus(ctx, conn, name),
+		Refresh: refreshOrganizationConfigRuleStatus(ctx, conn, name, configservice.OrganizationRuleStatusDeleteSuccessful),
 		Timeout: timeout,
 		Delay:   10 * time.Second,
 	}
@@ -490,7 +497,7 @@ func waitForOrganizationRuleStatusUpdateSuccessful(ctx context.Context, conn *co
 	stateChangeConf := &retry.StateChangeConf{
 		Pending: []string{configservice.OrganizationRuleStatusUpdateInProgress},
 		Target:  []string{configservice.OrganizationRuleStatusUpdateSuccessful},
-		Refresh: refreshOrganizationConfigRuleStatus(ctx, conn, name),
+		Refresh: refreshOrganizationConfigRuleStatus(ctx, conn, name, configservice.OrganizationRuleStatusUpdateSuccessful),
 		Timeout: timeout,
 		Delay:   10 * time.Second,
 	}

internal/service/configservice/find.go

@@ -33,3 +33,27 @@ func FindConfigRule(ctx context.Context, conn *configservice.ConfigService, name
 
 	return output.ConfigRules[0], nil
 }
+
+func FindOrganizationConfigRule(ctx aws.Context, conn *configservice.ConfigService, name string) (*configservice.OrganizationConfigRule, error) {
+	input := &configservice.DescribeOrganizationConfigRulesInput{
+		OrganizationConfigRuleNames: []*string{aws.String(name)},
+	}
+
+	output, err := conn.DescribeOrganizationConfigRulesWithContext(ctx, input)
+	if tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchOrganizationConfigRuleException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if output == nil {
+		return nil, nil
+	}
+
+	if output == nil || output.OrganizationConfigRules == nil || len(output.OrganizationConfigRules) == 0 || output.OrganizationConfigRules[0] == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.OrganizationConfigRules[0], nil
+}