add resource aws kms policy attachment

[silvaalbert]

Description

This PR adds an aws_kms_key_policy_attachment resource, while deprecating the policy attribute in aws_kms_key.

aws_kms_key tests were modified for least privilege, as several used Principal":{"AWS":"*"} unnecessarily.

Relations

Closes #464

References

https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html

Output from Acceptance Testing

aws_kms_key_policy_attachment

make testacc TESTS=TestAccKMSKeyPolicyAttachment PKG=kms ACCTEST_PARALLELISM=5
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 5 -run='TestAccKMSKeyPolicyAttachment'  -timeout 180m
=== RUN   TestAccKMSKeyPolicyAttachment_basic
=== PAUSE TestAccKMSKeyPolicyAttachment_basic
=== RUN   TestAccKMSKeyPolicyAttachment_disappears
=== PAUSE TestAccKMSKeyPolicyAttachment_disappears
=== RUN   TestAccKMSKeyPolicyAttachment_bypass
=== PAUSE TestAccKMSKeyPolicyAttachment_bypass
=== RUN   TestAccKMSKeyPolicyAttachment_bypassUpdate
=== PAUSE TestAccKMSKeyPolicyAttachment_bypassUpdate
=== RUN   TestAccKMSKeyPolicyAttachment_keyIsEnabled
=== PAUSE TestAccKMSKeyPolicyAttachment_keyIsEnabled
=== RUN   TestAccKMSKeyPolicyAttachment_iamRole
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRole
=== RUN   TestAccKMSKeyPolicyAttachment_iamRoleUpdate
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRoleUpdate
=== RUN   TestAccKMSKeyPolicyAttachment_iamRoleOrder
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRoleOrder
=== RUN   TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
=== PAUSE TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
=== RUN   TestAccKMSKeyPolicyAttachment_booleanCondition
=== PAUSE TestAccKMSKeyPolicyAttachment_booleanCondition
=== CONT  TestAccKMSKeyPolicyAttachment_basic
=== CONT  TestAccKMSKeyPolicyAttachment_iamRole
=== CONT  TestAccKMSKeyPolicyAttachment_bypassUpdate
=== CONT  TestAccKMSKeyPolicyAttachment_keyIsEnabled
=== CONT  TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
--- PASS: TestAccKMSKeyPolicyAttachment_bypassUpdate (21.39s)
=== CONT  TestAccKMSKeyPolicyAttachment_bypass
--- PASS: TestAccKMSKeyPolicyAttachment_basic (30.66s)
=== CONT  TestAccKMSKeyPolicyAttachment_booleanCondition
--- PASS: TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole (43.28s)
=== CONT  TestAccKMSKeyPolicyAttachment_disappears
--- PASS: TestAccKMSKeyPolicyAttachment_iamRole (44.27s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamRoleOrder
--- PASS: TestAccKMSKeyPolicyAttachment_booleanCondition (14.69s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamRoleUpdate
--- PASS: TestAccKMSKeyPolicyAttachment_keyIsEnabled (50.39s)
--- PASS: TestAccKMSKeyPolicyAttachment_disappears (11.39s)
--- PASS: TestAccKMSKeyPolicyAttachment_iamRoleUpdate (41.99s)
--- PASS: TestAccKMSKeyPolicyAttachment_iamRoleOrder (43.89s)
--- PASS: TestAccKMSKeyPolicyAttachment_bypass (135.27s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	159.762s

aws_kms_key

make testacc TESTS=TestAccKMSKey PKG=kms ACCTEST_PARALLELISM=5
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 5 -run='TestAccKMSKey'  -timeout 180m
=== RUN   TestAccKMSKeyDataSource_byKeyARN
=== PAUSE TestAccKMSKeyDataSource_byKeyARN
=== RUN   TestAccKMSKeyDataSource_byKeyID
=== PAUSE TestAccKMSKeyDataSource_byKeyID
=== RUN   TestAccKMSKeyDataSource_byAliasARN
=== PAUSE TestAccKMSKeyDataSource_byAliasARN
=== RUN   TestAccKMSKeyDataSource_byAliasID
=== PAUSE TestAccKMSKeyDataSource_byAliasID
=== RUN   TestAccKMSKeyDataSource_grantToken
=== PAUSE TestAccKMSKeyDataSource_grantToken
=== RUN   TestAccKMSKeyDataSource_multiRegionConfigurationByARN
=== PAUSE TestAccKMSKeyDataSource_multiRegionConfigurationByARN
=== RUN   TestAccKMSKeyDataSource_multiRegionConfigurationByID
=== PAUSE TestAccKMSKeyDataSource_multiRegionConfigurationByID
=== RUN   TestAccKMSKeyPolicyAttachment_basic
=== PAUSE TestAccKMSKeyPolicyAttachment_basic
=== RUN   TestAccKMSKeyPolicyAttachment_disappears
=== PAUSE TestAccKMSKeyPolicyAttachment_disappears
=== RUN   TestAccKMSKeyPolicyAttachment_bypass
=== PAUSE TestAccKMSKeyPolicyAttachment_bypass
=== RUN   TestAccKMSKeyPolicyAttachment_bypassUpdate
=== PAUSE TestAccKMSKeyPolicyAttachment_bypassUpdate
=== RUN   TestAccKMSKeyPolicyAttachment_keyIsEnabled
=== PAUSE TestAccKMSKeyPolicyAttachment_keyIsEnabled
=== RUN   TestAccKMSKeyPolicyAttachment_iamRole
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRole
=== RUN   TestAccKMSKeyPolicyAttachment_iamRoleUpdate
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRoleUpdate
=== RUN   TestAccKMSKeyPolicyAttachment_iamRoleOrder
=== PAUSE TestAccKMSKeyPolicyAttachment_iamRoleOrder
=== RUN   TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
=== PAUSE TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
=== RUN   TestAccKMSKeyPolicyAttachment_booleanCondition
=== PAUSE TestAccKMSKeyPolicyAttachment_booleanCondition
=== RUN   TestAccKMSKey_basic
=== PAUSE TestAccKMSKey_basic
=== RUN   TestAccKMSKey_disappears
=== PAUSE TestAccKMSKey_disappears
=== RUN   TestAccKMSKey_multiRegion
=== PAUSE TestAccKMSKey_multiRegion
=== RUN   TestAccKMSKey_asymmetricKey
=== PAUSE TestAccKMSKey_asymmetricKey
=== RUN   TestAccKMSKey_hmacKey
=== PAUSE TestAccKMSKey_hmacKey
=== RUN   TestAccKMSKey_Policy_basic
=== PAUSE TestAccKMSKey_Policy_basic
=== RUN   TestAccKMSKey_Policy_bypass
=== PAUSE TestAccKMSKey_Policy_bypass
=== RUN   TestAccKMSKey_Policy_bypassUpdate
=== PAUSE TestAccKMSKey_Policy_bypassUpdate
=== RUN   TestAccKMSKey_Policy_iamRole
=== PAUSE TestAccKMSKey_Policy_iamRole
=== RUN   TestAccKMSKey_Policy_iamRoleUpdate
=== PAUSE TestAccKMSKey_Policy_iamRoleUpdate
=== RUN   TestAccKMSKey_Policy_iamRoleOrder
=== PAUSE TestAccKMSKey_Policy_iamRoleOrder
=== RUN   TestAccKMSKey_Policy_iamServiceLinkedRole
=== PAUSE TestAccKMSKey_Policy_iamServiceLinkedRole
=== RUN   TestAccKMSKey_Policy_booleanCondition
=== PAUSE TestAccKMSKey_Policy_booleanCondition
=== RUN   TestAccKMSKey_isEnabled
=== PAUSE TestAccKMSKey_isEnabled
=== RUN   TestAccKMSKey_tags
=== PAUSE TestAccKMSKey_tags
=== CONT  TestAccKMSKeyDataSource_byKeyARN
=== CONT  TestAccKMSKey_Policy_bypassUpdate
=== CONT  TestAccKMSKeyPolicyAttachment_booleanCondition
=== CONT  TestAccKMSKey_Policy_bypass
=== CONT  TestAccKMSKey_Policy_basic
--- PASS: TestAccKMSKeyDataSource_byKeyARN (7.30s)
=== CONT  TestAccKMSKey_hmacKey
--- PASS: TestAccKMSKey_hmacKey (7.31s)
=== CONT  TestAccKMSKey_asymmetricKey
--- PASS: TestAccKMSKeyPolicyAttachment_booleanCondition (16.22s)
=== CONT  TestAccKMSKey_multiRegion
--- PASS: TestAccKMSKey_Policy_bypassUpdate (17.19s)
=== CONT  TestAccKMSKey_disappears
--- PASS: TestAccKMSKey_Policy_basic (18.93s)
=== CONT  TestAccKMSKey_basic
--- PASS: TestAccKMSKey_asymmetricKey (8.08s)
=== CONT  TestAccKMSKeyPolicyAttachment_disappears
--- PASS: TestAccKMSKey_disappears (7.38s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole
--- PASS: TestAccKMSKey_multiRegion (9.97s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamRoleOrder
--- PASS: TestAccKMSKey_basic (9.21s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamRoleUpdate
--- PASS: TestAccKMSKeyPolicyAttachment_disappears (10.20s)
=== CONT  TestAccKMSKeyPolicyAttachment_iamRole
--- PASS: TestAccKMSKeyPolicyAttachment_iamRole (32.25s)
=== CONT  TestAccKMSKeyPolicyAttachment_keyIsEnabled
--- PASS: TestAccKMSKeyPolicyAttachment_iamServiceLinkedRole (42.11s)
=== CONT  TestAccKMSKeyPolicyAttachment_bypassUpdate
--- PASS: TestAccKMSKeyPolicyAttachment_iamRoleOrder (41.13s)
=== CONT  TestAccKMSKeyPolicyAttachment_bypass
--- PASS: TestAccKMSKeyPolicyAttachment_iamRoleUpdate (40.01s)
=== CONT  TestAccKMSKeyDataSource_grantToken
--- PASS: TestAccKMSKeyPolicyAttachment_bypassUpdate (20.13s)
=== CONT  TestAccKMSKeyPolicyAttachment_basic
--- PASS: TestAccKMSKeyDataSource_grantToken (24.17s)
=== CONT  TestAccKMSKeyDataSource_multiRegionConfigurationByID
--- PASS: TestAccKMSKeyDataSource_multiRegionConfigurationByID (7.03s)
=== CONT  TestAccKMSKeyDataSource_multiRegionConfigurationByARN
--- PASS: TestAccKMSKeyDataSource_multiRegionConfigurationByARN (6.64s)
=== CONT  TestAccKMSKeyDataSource_byAliasARN
--- PASS: TestAccKMSKeyDataSource_byAliasARN (6.51s)
=== CONT  TestAccKMSKeyDataSource_byAliasID
--- PASS: TestAccKMSKeyPolicyAttachment_keyIsEnabled (48.37s)
=== CONT  TestAccKMSKeyDataSource_byKeyID
--- PASS: TestAccKMSKeyPolicyAttachment_basic (30.17s)
=== CONT  TestAccKMSKey_Policy_iamServiceLinkedRole
--- PASS: TestAccKMSKeyDataSource_byAliasID (7.41s)
=== CONT  TestAccKMSKey_tags
--- PASS: TestAccKMSKeyDataSource_byKeyID (6.92s)
=== CONT  TestAccKMSKey_isEnabled
--- PASS: TestAccKMSKey_Policy_bypass (135.26s)
=== CONT  TestAccKMSKey_Policy_booleanCondition
--- PASS: TestAccKMSKey_Policy_booleanCondition (10.43s)
=== CONT  TestAccKMSKey_Policy_iamRoleUpdate
--- PASS: TestAccKMSKey_tags (30.05s)
=== CONT  TestAccKMSKey_Policy_iamRoleOrder
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (49.30s)
=== CONT  TestAccKMSKey_Policy_iamRole
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (35.73s)
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (36.99s)
--- PASS: TestAccKMSKey_Policy_iamRole (28.09s)
--- PASS: TestAccKMSKeyPolicyAttachment_bypass (134.46s)
--- PASS: TestAccKMSKey_isEnabled (88.43s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	211.851s

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[AdamTylerLynch]

One clarification about sharing the updateKeyPolicy() method.

LGTM otherwise 🚀

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccKMSKeyPolicy_\|TestAccKMSKey_' PKG=kms ACCTEST_PARALLELISM=2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 2  -run=TestAccKMSKeyPolicy_\|TestAccKMSKey_ -timeout 180m
=== RUN   TestAccKMSKeyPolicy_basic
=== PAUSE TestAccKMSKeyPolicy_basic
=== RUN   TestAccKMSKeyPolicy_disappears
=== PAUSE TestAccKMSKeyPolicy_disappears
=== RUN   TestAccKMSKeyPolicy_bypass
=== PAUSE TestAccKMSKeyPolicy_bypass
=== RUN   TestAccKMSKeyPolicy_bypassUpdate
=== PAUSE TestAccKMSKeyPolicy_bypassUpdate
=== RUN   TestAccKMSKeyPolicy_keyIsEnabled
=== PAUSE TestAccKMSKeyPolicy_keyIsEnabled
=== RUN   TestAccKMSKeyPolicy_iamRole
=== PAUSE TestAccKMSKeyPolicy_iamRole
=== RUN   TestAccKMSKeyPolicy_iamRoleUpdate
=== PAUSE TestAccKMSKeyPolicy_iamRoleUpdate
=== RUN   TestAccKMSKeyPolicy_iamRoleOrder
=== PAUSE TestAccKMSKeyPolicy_iamRoleOrder
=== RUN   TestAccKMSKeyPolicy_iamServiceLinkedRole
=== PAUSE TestAccKMSKeyPolicy_iamServiceLinkedRole
=== RUN   TestAccKMSKeyPolicy_booleanCondition
=== PAUSE TestAccKMSKeyPolicy_booleanCondition
=== RUN   TestAccKMSKey_basic
=== PAUSE TestAccKMSKey_basic
=== RUN   TestAccKMSKey_disappears
=== PAUSE TestAccKMSKey_disappears
=== RUN   TestAccKMSKey_multiRegion
=== PAUSE TestAccKMSKey_multiRegion
=== RUN   TestAccKMSKey_asymmetricKey
=== PAUSE TestAccKMSKey_asymmetricKey
=== RUN   TestAccKMSKey_hmacKey
=== PAUSE TestAccKMSKey_hmacKey
=== RUN   TestAccKMSKey_Policy_basic
=== PAUSE TestAccKMSKey_Policy_basic
=== RUN   TestAccKMSKey_Policy_bypass
=== PAUSE TestAccKMSKey_Policy_bypass
=== RUN   TestAccKMSKey_Policy_bypassUpdate
=== PAUSE TestAccKMSKey_Policy_bypassUpdate
=== RUN   TestAccKMSKey_Policy_iamRole
=== PAUSE TestAccKMSKey_Policy_iamRole
=== RUN   TestAccKMSKey_Policy_iamRoleUpdate
=== PAUSE TestAccKMSKey_Policy_iamRoleUpdate
=== RUN   TestAccKMSKey_Policy_iamRoleOrder
=== PAUSE TestAccKMSKey_Policy_iamRoleOrder
=== RUN   TestAccKMSKey_Policy_iamServiceLinkedRole
=== PAUSE TestAccKMSKey_Policy_iamServiceLinkedRole
=== RUN   TestAccKMSKey_Policy_booleanCondition
=== PAUSE TestAccKMSKey_Policy_booleanCondition
=== RUN   TestAccKMSKey_isEnabled
=== PAUSE TestAccKMSKey_isEnabled
=== RUN   TestAccKMSKey_tags
=== PAUSE TestAccKMSKey_tags
=== CONT  TestAccKMSKeyPolicy_basic
=== CONT  TestAccKMSKey_asymmetricKey
--- PASS: TestAccKMSKey_asymmetricKey (21.31s)
=== CONT  TestAccKMSKeyPolicy_iamRoleOrder
--- PASS: TestAccKMSKeyPolicy_basic (61.57s)
=== CONT  TestAccKMSKey_multiRegion
--- PASS: TestAccKMSKey_multiRegion (25.12s)
=== CONT  TestAccKMSKey_disappears
--- PASS: TestAccKMSKeyPolicy_iamRoleOrder (80.57s)
=== CONT  TestAccKMSKey_basic
--- PASS: TestAccKMSKey_disappears (17.79s)
=== CONT  TestAccKMSKeyPolicy_booleanCondition
--- PASS: TestAccKMSKey_basic (23.50s)
=== CONT  TestAccKMSKeyPolicy_iamServiceLinkedRole
--- PASS: TestAccKMSKeyPolicy_booleanCondition (28.86s)
=== CONT  TestAccKMSKey_Policy_iamRoleUpdate
--- PASS: TestAccKMSKey_Policy_iamRoleUpdate (50.63s)
=== CONT  TestAccKMSKey_tags
--- PASS: TestAccKMSKeyPolicy_iamServiceLinkedRole (59.78s)
=== CONT  TestAccKMSKey_isEnabled
--- PASS: TestAccKMSKey_tags (63.67s)
=== CONT  TestAccKMSKey_Policy_booleanCondition
--- PASS: TestAccKMSKey_Policy_booleanCondition (22.00s)
=== CONT  TestAccKMSKey_Policy_iamServiceLinkedRole
--- PASS: TestAccKMSKey_isEnabled (120.95s)
=== CONT  TestAccKMSKey_Policy_iamRoleOrder
--- PASS: TestAccKMSKey_Policy_iamServiceLinkedRole (63.23s)
=== CONT  TestAccKMSKeyPolicy_keyIsEnabled
--- PASS: TestAccKMSKey_Policy_iamRoleOrder (67.10s)
=== CONT  TestAccKMSKeyPolicy_iamRoleUpdate
--- PASS: TestAccKMSKeyPolicy_keyIsEnabled (72.22s)
=== CONT  TestAccKMSKeyPolicy_iamRole
--- PASS: TestAccKMSKeyPolicy_iamRoleUpdate (73.76s)
=== CONT  TestAccKMSKey_Policy_bypass
--- PASS: TestAccKMSKeyPolicy_iamRole (46.55s)
=== CONT  TestAccKMSKey_Policy_iamRole
--- PASS: TestAccKMSKey_Policy_iamRole (42.22s)
=== CONT  TestAccKMSKey_Policy_bypassUpdate
--- PASS: TestAccKMSKey_Policy_bypassUpdate (36.25s)
=== CONT  TestAccKMSKey_Policy_basic
--- PASS: TestAccKMSKey_Policy_basic (32.77s)
=== CONT  TestAccKMSKeyPolicy_bypass
--- PASS: TestAccKMSKey_Policy_bypass (146.22s)
=== CONT  TestAccKMSKeyPolicy_bypassUpdate
--- PASS: TestAccKMSKeyPolicy_bypassUpdate (34.47s)
=== CONT  TestAccKMSKeyPolicy_disappears
--- PASS: TestAccKMSKeyPolicy_disappears (15.95s)
=== CONT  TestAccKMSKey_hmacKey
--- PASS: TestAccKMSKey_hmacKey (12.89s)
--- PASS: TestAccKMSKeyPolicy_bypass (145.43s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kms	721.687s

[ewbankkit]

@silvaalbert Thanks for the contribution 🎉 👏.
To match other resource types with separate policy resource (e.q. SNS Topic or SQS Queue), I changed the resource name to aws_kms_key_policy. We use _attachment in the resource name when you can attach more than 1 thing to its parent (e.g. policies to IAM roles).
Also, to match Queues and Topics, I removed the deprecation from aws_kms_key.policy -- if you feel that the attribute should be deprecated, please open a separate Issue and we can consider for the next major provider version (v5.0.0).

[github-actions]

This functionality has been released in v4.59.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.