r/aws_kms_key: Add xks_key_id argument

[albgus]

Description

This adds the xks_key_id argument to the aws_kms_key resource, allowing creation of KMS Keys backed by an External Key Store.

Note that the input for this is not fully consistent with the aws_kms_key data source, which returns a xks_key_configuration attribute with an id subkey. The xks_key_id parameter is consistent with the XksKeyId parameter to the CreateKey API Operation though. Not sure what the preferred way would be here but I could try to change the input to take xks_key_confiuguration.id as well.

Relations

Relates #28092

References

Output from Acceptance Testing

$ make testacc TESTS='TestAccKMSKey_' PKG=kms TESTARGS=-short
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20 -run='TestAccKMSKey_' -short -timeout 180m
=== RUN   TestAccKMSKey_basic
=== PAUSE TestAccKMSKey_basic
=== RUN   TestAccKMSKey_disappears
=== PAUSE TestAccKMSKey_disappears
=== RUN   TestAccKMSKey_multiRegion
=== PAUSE TestAccKMSKey_multiRegion
=== RUN   TestAccKMSKey_asymmetricKey
=== PAUSE TestAccKMSKey_asymmetricKey
=== RUN   TestAccKMSKey_hmacKey
=== PAUSE TestAccKMSKey_hmacKey
=== RUN   TestAccKMSKey_Policy_basic
=== PAUSE TestAccKMSKey_Policy_basic
=== RUN   TestAccKMSKey_Policy_bypass
=== PAUSE TestAccKMSKey_Policy_bypass
=== RUN   TestAccKMSKey_Policy_bypassUpdate
=== PAUSE TestAccKMSKey_Policy_bypassUpdate
=== RUN   TestAccKMSKey_Policy_iamRole
=== PAUSE TestAccKMSKey_Policy_iamRole
=== RUN   TestAccKMSKey_Policy_iamRoleUpdate
=== PAUSE TestAccKMSKey_Policy_iamRoleUpdate
=== RUN   TestAccKMSKey_Policy_iamRoleOrder
=== PAUSE TestAccKMSKey_Policy_iamRoleOrder
=== RUN   TestAccKMSKey_Policy_iamServiceLinkedRole
=== PAUSE TestAccKMSKey_Policy_iamServiceLinkedRole
=== RUN   TestAccKMSKey_Policy_booleanCondition
=== PAUSE TestAccKMSKey_Policy_booleanCondition
=== RUN   TestAccKMSKey_isEnabled
=== PAUSE TestAccKMSKey_isEnabled
=== RUN   TestAccKMSKey_tags
=== PAUSE TestAccKMSKey_tags
=== CONT  TestAccKMSKey_basic
=== CONT  TestAccKMSKey_Policy_iamRole
=== CONT  TestAccKMSKey_Policy_iamServiceLinkedRole
=== CONT  TestAccKMSKey_tags
=== CONT  TestAccKMSKey_multiRegion
=== CONT  TestAccKMSKey_asymmetricKey
=== CONT  TestAccKMSKey_hmacKey
=== CONT  TestAccKMSKey_Policy_bypassUpdate
=== CONT  TestAccKMSKey_Policy_bypass
=== CONT  TestAccKMSKey_Policy_basic
=== CONT  TestAccKMSKey_Policy_booleanCondition
=== CONT  TestAccKMSKey_disappears
=== CONT  TestAccKMSKey_Policy_iamRoleOrder
=== CONT  TestAccKMSKey_Policy_iamRoleUpdate
=== CONT  TestAccKMSKey_isEnabled
--- PASS: TestAccKMSKey_disappears (34.06s)
--- PASS: TestAccKMSKey_asymmetricKey (37.41s)
--- PASS: TestAccKMSKey_hmacKey (37.58s)
--- PASS: TestAccKMSKey_basic (42.68s)
--- PASS: TestAccKMSKey_multiRegion (45.12s)
--- PASS: TestAccKMSKey_Policy_booleanCondition (45.18s)
--- PASS: TestAccKMSKey_Policy_iamRole (55.55s)
== NAME  TestAccKMSKey_Policy_bypassUpdate                                                                                                                                                                                                                                                                          [4/46665]
    key_test.go:228: Step 2/2 error: After applying this test step and performing a `terraform refresh`, the plan was not empty.
        stdout


        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place

        Terraform will perform the following actions:

          # aws_kms_key.test will be updated in-place
          ~ resource "aws_kms_key" "test" {
                id                                 = "8a3b5c04-a82d-4807-96ac-b1228ccc8ea0"
              ~ policy                             = jsonencode(
                  ~ {
                      ~ Id        = "key-default-1" -> "tf-acc-test-97906145721771766"
                      ~ Statement = [
                          ~ {
                              ~ Action    = "kms:*" -> [
                                  + "kms:CreateKey",
                                  + "kms:DescribeKey",
                                  + "kms:ScheduleKeyDeletion",
                                  + "kms:Describe*",
                                  + "kms:Get*",
                                  + "kms:List*",
                                  + "kms:TagResource",
                                  + "kms:UntagResource",
                                ]
                              ~ Principal = {
                                  ~ AWS = "arn:aws:iam::378223253773:root" -> "arn:aws:sts::378223253773:assumed-role/AWSReservedSSO_AdministratorAccess_604f010862187885/[REDACTED]"
                                }
                                # (3 unchanged attributes hidden)
                            },
                        ]
                        # (1 unchanged attribute hidden)
                    }
                )
                tags                               = {}
                # (11 unchanged attributes hidden)
            }

        Plan: 0 to add, 1 to change, 0 to destroy.
--- PASS: TestAccKMSKey_Policy_basic (62.66s)
--- FAIL: TestAccKMSKey_Policy_bypassUpdate (63.17s)
=== NAME  TestAccKMSKey_tags
    key_test.go:455: Step 3/4 error: After applying this test step and performing a `terraform refresh`, the plan was not empty.
        stdout


        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place

        Terraform will perform the following actions:

          # aws_kms_key.test will be updated in-place
          ~ resource "aws_kms_key" "test" {
                id                                 = "bdc7a736-8357-47e5-84ca-6c9588873ba4"
              ~ tags                               = {
                  ~ "key1" = "value1" -> "value1updated"
                  + "key2" = "value2"
                }
              ~ tags_all                           = {
                  ~ "key1" = "value1" -> "value1updated"
                  + "key2" = "value2"
                }
                # (10 unchanged attributes hidden)
            }

        Plan: 0 to add, 1 to change, 0 to destroy.
--- FAIL: TestAccKMSKey_tags (68.74s)
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (73.32s)
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (79.14s)
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (83.25s)
--- PASS: TestAccKMSKey_isEnabled (135.39s)
--- PASS: TestAccKMSKey_Policy_bypass (161.72s)
...

---

Obviously two of the tests failed, however they tags test fails for me on the v4.66.0 tag as well.. The second test seems to fail a bit intermittently, as it succeeded when I re-ran only that test.

Also, I haven't attempted to write any tests for these changes as I don't see any good way to solve this, given that the external key service needs a connection to a 3rd party provider. I suppose the same is true for the Cloud HSM custom key store as well as IIRC the Cloud HSM requires manual initialisation steps.

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @albgus 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[johnsonaj]

LGTM 🚀

% make testacc TESTARGS='-run=TestAccKMSKey_' PKG=kms

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20  -run=TestAccKMSKey_ -timeout 360m
--- PASS: TestAccKMSKey_asymmetricKey (95.13s)
--- PASS: TestAccKMSKey_hmacKey (95.68s)
--- PASS: TestAccKMSKey_disappears (99.46s)
--- PASS: TestAccKMSKey_multiRegion (103.30s)
--- PASS: TestAccKMSKey_Policy_basic (138.54s)
--- PASS: TestAccKMSKey_updateTagsEmptyValue (138.92s)
--- PASS: TestAccKMSKey_basic (139.59s)
--- PASS: TestAccKMSKey_Policy_bypassUpdate (161.08s)
--- PASS: TestAccKMSKey_ignoreTags (165.50s)
--- PASS: TestAccKMSKey_Policy_booleanCondition (167.95s)
--- PASS: TestAccKMSKey_Policy_iamRole (182.49s)
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (197.53s)
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (198.94s)
--- PASS: TestAccKMSKey_tags (202.04s)
--- PASS: TestAccKMSKey_isEnabled (220.30s)
--- PASS: TestAccKMSKey_Policy_bypass (226.63s)
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (359.66s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	363.249s

[johnsonaj]

@albgus thank you for the contribution! 🎉

[github-actions]

This functionality has been released in v5.32.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.