Mark Grafana API key as sensitive.

.changelog/34105.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_grafana_workspace_api_key: Change `key` to [`Sensitive`](https://developer.hashicorp.com/terraform/plugin/best-practices/sensitive-state#using-sensitive-flag-functionality)
+```

.teamcity/scripts/provider_tests/acceptance_tests.sh

@@ -53,6 +53,7 @@ TF_ACC=1 go test \
     ./internal/tags/... \
     ./internal/tfresource/... \
     ./internal/types/... \
+    ./internal/ujson/... \
     ./internal/vault/... \
     ./internal/verify/... \
     -json -v -count=1 -parallel "%ACCTEST_PARALLELISM%" -timeout=0 -run=TestAcc

.teamcity/scripts/provider_tests/unit_tests.sh

@@ -25,6 +25,7 @@ go test \
     ./internal/tags/... \
     ./internal/tfresource/... \
     ./internal/types/... \
+    ./internal/ujson/... \
     ./internal/vault/... \
     ./internal/verify/... \
     -json

internal/acctest/acctest.go

@@ -744,6 +744,16 @@ func CheckResourceAttrJMESPair(nameFirst, keyFirst, jmesPath, nameSecond, keySec
 	}
 }
 
+// CheckResourceAttrContains ensures the Terraform state value contains the specified substr.
+func CheckResourceAttrContains(name, key, substr string) resource.TestCheckFunc {
+	return resource.TestCheckResourceAttrWith(name, key, func(value string) error {
+		if strings.Contains(value, substr) {
+			return nil
+		}
+		return fmt.Errorf("%s: Attribute '%s' expected contains %#v, got %#v", name, key, substr, value)
+	})
+}
+
 // CheckResourceAttrHasPrefix ensures the Terraform state value has the specified prefix.
 func CheckResourceAttrHasPrefix(name, key, prefix string) resource.TestCheckFunc {
 	return resource.TestCheckResourceAttrWith(name, key, func(value string) error {

internal/service/fms/managed_service_data.go

@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-aws/internal/service/fms/ujson"
+	"github.com/hashicorp/terraform-provider-aws/internal/ujson"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 

internal/service/grafana/grafana_test.go

@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package grafana_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccGrafana_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]map[string]func(t *testing.T){
+		"Workspace": {
+			"saml":                     testAccWorkspace_saml,
+			"sso":                      testAccWorkspace_sso,
+			"disappears":               testAccWorkspace_disappears,
+			"organization":             testAccWorkspace_organization,
+			"dataSources":              testAccWorkspace_dataSources,
+			"permissionType":           testAccWorkspace_permissionType,
+			"notificationDestinations": testAccWorkspace_notificationDestinations,
+			"tags":                     testAccWorkspace_tags,
+			"vpc":                      testAccWorkspace_vpc,
+			"configuration":            testAccWorkspace_configuration,
+			"networkAccess":            testAccWorkspace_networkAccess,
+			"version":                  testAccWorkspace_version,
+		},
+		"ApiKey": {
+			"basic": testAccWorkspaceAPIKey_basic,
+		},
+		"DataSource": {
+			"basic": testAccWorkspaceDataSource_basic,
+		},
+		"LicenseAssociation": {
+			"enterpriseFreeTrial": testAccLicenseAssociation_freeTrial,
+		},
+		"SamlConfiguration": {
+			"basic":         testAccWorkspaceSAMLConfiguration_basic,
+			"loginValidity": testAccWorkspaceSAMLConfiguration_loginValidity,
+			"assertions":    testAccWorkspaceSAMLConfiguration_assertions,
+		},
+		"RoleAssociation": {
+			"usersAdmin":           testAccRoleAssociation_usersAdmin,
+			"usersEditor":          testAccRoleAssociation_usersEditor,
+			"groupsAdmin":          testAccRoleAssociation_groupsAdmin,
+			"groupsEditor":         testAccRoleAssociation_groupsEditor,
+			"usersAndGroupsAdmin":  testAccRoleAssociation_usersAndGroupsAdmin,
+			"usersAndGroupsEditor": testAccRoleAssociation_usersAndGroupsEditor,
+		},
+	}
+
+	acctest.RunSerialTests2Levels(t, testCases, 0)
+}

internal/service/grafana/workspace.go

@@ -65,11 +65,12 @@ func ResourceWorkspace() *schema.Resource {
 				},
 			},
 			"configuration": {
-				Type:             schema.TypeString,
-				Optional:         true,
-				Computed:         true,
-				ValidateFunc:     validation.StringIsJSON,
-				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+				Type:                  schema.TypeString,
+				Optional:              true,
+				Computed:              true,
+				ValidateFunc:          validation.StringIsJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentJSONDiffs,
+				DiffSuppressOnRefresh: true,
 				StateFunc: func(v interface{}) string {
 					json, _ := structure.NormalizeJsonString(v)
 					return json

internal/service/grafana/workspace_api_key.go

@@ -29,8 +29,9 @@ func ResourceWorkspaceAPIKey() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"key": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:      schema.TypeString,
+				Computed:  true,
+				Sensitive: true,
 			},
 			"key_name": {
 				Type:         schema.TypeString,

internal/service/grafana/workspace_test.go

@@ -21,51 +21,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccGrafana_serial(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]map[string]func(t *testing.T){
-		"Workspace": {
-			"saml":                     testAccWorkspace_saml,
-			"sso":                      testAccWorkspace_sso,
-			"disappears":               testAccWorkspace_disappears,
-			"organization":             testAccWorkspace_organization,
-			"dataSources":              testAccWorkspace_dataSources,
-			"permissionType":           testAccWorkspace_permissionType,
-			"notificationDestinations": testAccWorkspace_notificationDestinations,
-			"tags":                     testAccWorkspace_tags,
-			"vpc":                      testAccWorkspace_vpc,
-			"configuration":            testAccWorkspace_configuration,
-			"networkAccess":            testAccWorkspace_networkAccess,
-			"version":                  testAccWorkspace_version,
-		},
-		"ApiKey": {
-			"basic": testAccWorkspaceAPIKey_basic,
-		},
-		"DataSource": {
-			"basic": testAccWorkspaceDataSource_basic,
-		},
-		"LicenseAssociation": {
-			"enterpriseFreeTrial": testAccLicenseAssociation_freeTrial,
-		},
-		"SamlConfiguration": {
-			"basic":         testAccWorkspaceSAMLConfiguration_basic,
-			"loginValidity": testAccWorkspaceSAMLConfiguration_loginValidity,
-			"assertions":    testAccWorkspaceSAMLConfiguration_assertions,
-		},
-		"RoleAssociation": {
-			"usersAdmin":           testAccRoleAssociation_usersAdmin,
-			"usersEditor":          testAccRoleAssociation_usersEditor,
-			"groupsAdmin":          testAccRoleAssociation_groupsAdmin,
-			"groupsEditor":         testAccRoleAssociation_groupsEditor,
-			"usersAndGroupsAdmin":  testAccRoleAssociation_usersAndGroupsAdmin,
-			"usersAndGroupsEditor": testAccRoleAssociation_usersAndGroupsEditor,
-		},
-	}
-
-	acctest.RunSerialTests2Levels(t, testCases, 0)
-}
-
 func testAccWorkspace_saml(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v managedgrafana.WorkspaceDescription
@@ -450,10 +405,10 @@ func testAccWorkspace_configuration(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": true }}`),
+				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": true }, "plugins": {"pluginAdminEnabled": false}}`),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":true}}`),
+					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":true},"plugins":{"pluginAdminEnabled":false}}`),
 				),
 			},
 			{
@@ -462,10 +417,10 @@ func testAccWorkspace_configuration(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": false }}`),
+				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": false }, "plugins": {"pluginAdminEnabled": true}}`),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":false}}`),
+					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":false},"plugins":{"pluginAdminEnabled":true}}`),
 				),
 			},
 		},

internal/service/fms/ujson/quote_test.go → internal/ujson/quote_test.go

@@ -7,7 +7,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/hashicorp/terraform-provider-aws/internal/service/fms/ujson"
+	"github.com/hashicorp/terraform-provider-aws/internal/ujson"
 )
 
 type quoteTest struct {