Added custom key stores for aws_kms_key & custom key store data source

[ZeePal]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #16491

• Updated: aws_kms_key (added custom_key_store_id field)
• New: data source aws_kms_custom_key_store

Output from acceptance testing:

$ make testacc TESTS=TestAccKMSKey PKG=kms
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20 -run='TestAccKMSKey'  -timeout 180m
=== RUN   TestAccKMSKeyDataSource_basic
=== PAUSE TestAccKMSKeyDataSource_basic
=== RUN   TestAccKMSKeyDataSource_grantToken
=== PAUSE TestAccKMSKeyDataSource_grantToken
=== RUN   TestAccKMSKeyDataSource_multiRegionConfiguration
=== PAUSE TestAccKMSKeyDataSource_multiRegionConfiguration
=== RUN   TestAccKMSKey_basic
=== PAUSE TestAccKMSKey_basic
=== RUN   TestAccKMSKey_disappears
=== PAUSE TestAccKMSKey_disappears
=== RUN   TestAccKMSKey_multiRegion
=== PAUSE TestAccKMSKey_multiRegion
=== RUN   TestAccKMSKey_asymmetricKey
=== PAUSE TestAccKMSKey_asymmetricKey
=== RUN   TestAccKMSKey_Policy_basic
=== PAUSE TestAccKMSKey_Policy_basic
=== RUN   TestAccKMSKey_Policy_bypass
=== PAUSE TestAccKMSKey_Policy_bypass
=== RUN   TestAccKMSKey_Policy_bypassUpdate
=== PAUSE TestAccKMSKey_Policy_bypassUpdate
=== RUN   TestAccKMSKey_Policy_iamRole
=== PAUSE TestAccKMSKey_Policy_iamRole
=== RUN   TestAccKMSKey_Policy_iamRoleUpdate
=== PAUSE TestAccKMSKey_Policy_iamRoleUpdate
=== RUN   TestAccKMSKey_Policy_iamRoleOrder
=== PAUSE TestAccKMSKey_Policy_iamRoleOrder
=== RUN   TestAccKMSKey_Policy_iamServiceLinkedRole
=== PAUSE TestAccKMSKey_Policy_iamServiceLinkedRole
=== RUN   TestAccKMSKey_Policy_booleanCondition
=== PAUSE TestAccKMSKey_Policy_booleanCondition
=== RUN   TestAccKMSKey_isEnabled
=== PAUSE TestAccKMSKey_isEnabled
=== RUN   TestAccKMSKey_tags
=== PAUSE TestAccKMSKey_tags
=== CONT  TestAccKMSKeyDataSource_basic
=== CONT  TestAccKMSKey_Policy_iamServiceLinkedRole
=== CONT  TestAccKMSKey_Policy_bypass
=== CONT  TestAccKMSKey_Policy_basic
=== CONT  TestAccKMSKey_Policy_bypassUpdate
=== CONT  TestAccKMSKey_Policy_iamRole
=== CONT  TestAccKMSKey_Policy_iamRoleOrder
=== CONT  TestAccKMSKey_Policy_iamRoleUpdate
=== CONT  TestAccKMSKey_disappears
=== CONT  TestAccKMSKey_asymmetricKey
=== CONT  TestAccKMSKey_isEnabled
=== CONT  TestAccKMSKey_multiRegion
=== CONT  TestAccKMSKeyDataSource_multiRegionConfiguration
=== CONT  TestAccKMSKey_tags
=== CONT  TestAccKMSKeyDataSource_grantToken
=== CONT  TestAccKMSKey_Policy_booleanCondition
=== CONT  TestAccKMSKey_basic
--- PASS: TestAccKMSKey_disappears (24.44s)
--- PASS: TestAccKMSKey_asymmetricKey (28.83s)
--- PASS: TestAccKMSKeyDataSource_basic (29.20s)
--- PASS: TestAccKMSKeyDataSource_multiRegionConfiguration (29.98s)
--- PASS: TestAccKMSKey_basic (32.70s)
--- PASS: TestAccKMSKey_multiRegion (33.34s)
--- PASS: TestAccKMSKey_Policy_booleanCondition (37.15s)
--- PASS: TestAccKMSKeyDataSource_grantToken (40.75s)
--- PASS: TestAccKMSKey_Policy_iamRole (52.29s)
--- PASS: TestAccKMSKey_Policy_basic (54.59s)
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (58.96s)
--- PASS: TestAccKMSKey_Policy_bypassUpdate (59.60s)
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (73.36s)
--- PASS: TestAccKMSKey_tags (89.23s)
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (100.89s)
--- PASS: TestAccKMSKey_isEnabled (151.57s)
--- PASS: TestAccKMSKey_Policy_bypass (172.15s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	172.209s

I haven't added/updated any acceptance testing as to test these you need to have KMS configured with CloudHSM which isn't a trivial build: https://github.com/ZeePal/test-kms-with-cloudhsm
Not sure what we would like to do as it requires expect scripts to automate due to the nature of the CloudHSM cli tool (cloudhsm_mgmt_util):

• https://github.com/ZeePal/test-kms-with-cloudhsm/blob/master/activate_cloudhsm/activate_cloudhsm.expect
• https://github.com/ZeePal/test-kms-with-cloudhsm/blob/master/create_kmsuser/create_kmsuser.expect

[ZeePal]

golangci-lint seems to work for me:

❯ make golangci-lint
==> Checking source code with golangci-lint...

but providerlint I assume I've got something setup wrong as its failing on stuff I haven't changed:

❯ make providerlint 
==> Checking source code with providerlint...
providerlint: internal error: package "fmt" without types was imported from "github.com/hashicorp/terraform-provider-aws/internal/service/greengrass"
make: *** [GNUmakefile:114: providerlint] Error 1

[johnsonaj]

 $ make testacc TESTARGS='-run=TestAccKMSCustomKeyStoreDataSource_' PKG=kms ACCTEST_TIMEOUT=180m                                                                                                                                              

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20  -run=TestAccKMSCustomKeyStoreDataSource_ -timeout 180m
=== RUN   TestAccKMSCustomKeyStoreDataSource_basic
=== PAUSE TestAccKMSCustomKeyStoreDataSource_basic
=== CONT  TestAccKMSCustomKeyStoreDataSource_basic
--- PASS: TestAccKMSCustomKeyStoreDataSource_basic (13.40s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	16.515s

[johnsonaj]

$ make testacc TESTARGS='-run=TestAccKMSKey_' PKG=kms ACCTEST_TIMEOUT=180m
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20  -run=TestAccKMSKey_ -timeout 180m
=== RUN   TestAccKMSKey_basic
=== PAUSE TestAccKMSKey_basic
=== RUN   TestAccKMSKey_disappears
=== PAUSE TestAccKMSKey_disappears
=== RUN   TestAccKMSKey_multiRegion
=== PAUSE TestAccKMSKey_multiRegion
=== RUN   TestAccKMSKey_asymmetricKey
=== PAUSE TestAccKMSKey_asymmetricKey
=== RUN   TestAccKMSKey_hmacKey
=== PAUSE TestAccKMSKey_hmacKey
=== RUN   TestAccKMSKey_Policy_basic
=== PAUSE TestAccKMSKey_Policy_basic
=== RUN   TestAccKMSKey_Policy_bypass
=== PAUSE TestAccKMSKey_Policy_bypass
=== RUN   TestAccKMSKey_Policy_bypassUpdate
=== PAUSE TestAccKMSKey_Policy_bypassUpdate
=== RUN   TestAccKMSKey_Policy_iamRole
=== PAUSE TestAccKMSKey_Policy_iamRole
=== RUN   TestAccKMSKey_Policy_iamRoleUpdate
=== PAUSE TestAccKMSKey_Policy_iamRoleUpdate
=== RUN   TestAccKMSKey_Policy_iamRoleOrder
=== PAUSE TestAccKMSKey_Policy_iamRoleOrder
=== RUN   TestAccKMSKey_Policy_iamServiceLinkedRole
=== PAUSE TestAccKMSKey_Policy_iamServiceLinkedRole
=== RUN   TestAccKMSKey_Policy_booleanCondition
=== PAUSE TestAccKMSKey_Policy_booleanCondition
=== RUN   TestAccKMSKey_isEnabled
=== PAUSE TestAccKMSKey_isEnabled
=== RUN   TestAccKMSKey_tags
=== PAUSE TestAccKMSKey_tags
=== CONT  TestAccKMSKey_basic
=== CONT  TestAccKMSKey_Policy_iamRole
=== CONT  TestAccKMSKey_hmacKey
=== CONT  TestAccKMSKey_Policy_booleanCondition
=== CONT  TestAccKMSKey_Policy_iamRoleOrder
=== CONT  TestAccKMSKey_Policy_iamServiceLinkedRole
=== CONT  TestAccKMSKey_multiRegion
=== CONT  TestAccKMSKey_asymmetricKey
=== CONT  TestAccKMSKey_tags
=== CONT  TestAccKMSKey_disappears
=== CONT  TestAccKMSKey_isEnabled
=== CONT  TestAccKMSKey_Policy_iamRoleUpdate
=== CONT  TestAccKMSKey_Policy_bypass
=== CONT  TestAccKMSKey_Policy_bypassUpdate
=== CONT  TestAccKMSKey_Policy_basic
--- PASS: TestAccKMSKey_disappears (18.89s)
--- PASS: TestAccKMSKey_hmacKey (22.17s)
--- PASS: TestAccKMSKey_asymmetricKey (22.19s)
--- PASS: TestAccKMSKey_multiRegion (24.88s)
--- PASS: TestAccKMSKey_basic (25.05s)
--- PASS: TestAccKMSKey_Policy_booleanCondition (26.42s)
--- PASS: TestAccKMSKey_Policy_basic (38.44s)
--- PASS: TestAccKMSKey_Policy_bypassUpdate (39.74s)
--- PASS: TestAccKMSKey_Policy_iamRole (45.35s)
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (55.62s)
--- PASS: TestAccKMSKey_tags (60.18s)
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (69.67s)
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (69.86s)
--- PASS: TestAccKMSKey_isEnabled (119.75s)
--- PASS: TestAccKMSKey_Policy_bypass (152.29s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	154.808s

[johnsonaj]

LGTM! 🚀

[johnsonaj]

@ZeePal Thanks for the contribution! 👏🏾 🎉

[github-actions]

This functionality has been released in v4.33.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.