Not retrieve EMR AD Domain Join User from AWS API

[joelthompson]

The AWS API returns ******** for the ADDomainJoinUser attribute, the
same as for ADDomainJoinPassword, CrossRealmTrustPrincipalPassword, and
KdcAdminPassword. This causes a terraform plan to always attempt to
rebuild the cluster since the ad_domain_join_user attribute is seen as
changing from ******** to what is specified and desired in the plan.
This now configures EMR to not retrieve this attribute from the AWS APIs
so that it doesn't always attempt to rebuild the cluster.

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

Fix bug with AWS EMR clusters that have an `ad_domain_join_user` specified in the `kerberos_attributes` always attempting to recreate the cluster even when no changes are specified.

Output from acceptance testing:

N/A: I didn't run the acceptance tests as it looks like there is any test behavior for this aspect of EMR, and spinning up EMR clusters

[bflad]

Thanks for this, @joelthompson 🚀 Given #9129 I'd like to pull this in, even without the acceptance testing being 100% since I'm familiar with the code here. Post merge I'm going to ensure the documentation notes that Terraform cannot perform drift detection on these arguments just to clear up any confusion regarding that. 👍

[bflad]

This has been released in version 2.18.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[suryadevarauday]

Still not working on 2.18.0

$ terraform version
Terraform v0.11.14

• provider.aws v2.18.0

Your version of Terraform is out of date! The latest version
is 0.12.5. You can update by downloading from www.terraform.io/downloads.html

kerberos_attributes.0.ad_domain_join_user: "********" => "newvalue" (forces new resource)

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!