Amazon S3 Access Grants

.changelog/34564.txt

@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_s3control_access_grants_instance
+```
+
+```release-note:new-resource
+aws_s3control_access_grants_location
+```
+
+```release-note:new-resource
+aws_s3control_access_grant
+```
+
+```release-note:new-resource
+aws_s3control_access_grants_instance_resource_policy
+```

internal/framework/validators/json.go

@@ -0,0 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+)
+
+// jsonValidator validates that a string Attribute's value is valid JSON.
+type jsonValidator struct{}
+
+// Description describes the validation in plain text formatting.
+func (validator jsonValidator) Description(_ context.Context) string {
+	return "value must be valid JSON"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (validator jsonValidator) MarkdownDescription(ctx context.Context) string {
+	return validator.Description(ctx)
+}
+
+// Validate performs the validation.
+func (validator jsonValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	configValue := request.ConfigValue
+
+	if configValue.IsNull() || configValue.IsUnknown() {
+		return
+	}
+
+	// https://datatracker.ietf.org/doc/html/rfc7159.
+	if valueString := configValue.ValueString(); !json.Valid([]byte(valueString)) {
+		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
+			request.Path,
+			validator.Description(ctx),
+			valueString,
+		))
+		return
+	}
+}
+
+// JSON returns a string validator which ensures that any configured
+// attribute value:
+//
+//   - Is a string, which represents valid JSON.
+//
+// Null (unconfigured) and unknown (known after apply) values are skipped.
+func JSON() validator.String {
+	return jsonValidator{}
+}

internal/framework/validators/json_test.go

@@ -0,0 +1,67 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
+)
+
+func TestJSONValidator(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		val                 types.String
+		expectedDiagnostics diag.Diagnostics
+	}
+	tests := map[string]testCase{
+		"unknown String": {
+			val: types.StringUnknown(),
+		},
+		"null String": {
+			val: types.StringNull(),
+		},
+		"invalid String": {
+			val: types.StringValue("test-value"),
+			expectedDiagnostics: diag.Diagnostics{
+				diag.NewAttributeErrorDiagnostic(
+					path.Root("test"),
+					"Invalid Attribute Value",
+					`Attribute test value must be valid JSON, got: test-value`,
+				),
+			},
+		},
+		"valid JSON": {
+			val: types.StringValue(`{"Key1": "Value", "Key2": [1, 2, 3]}`),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			request := validator.StringRequest{
+				Path:           path.Root("test"),
+				PathExpression: path.MatchRoot("test"),
+				ConfigValue:    test.val,
+			}
+			response := validator.StringResponse{}
+			fwvalidators.JSON().ValidateString(ctx, request, &response)
+
+			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
+				t.Errorf("unexpected diagnostics difference: %s", diff)
+			}
+		})
+	}
+}

internal/service/s3/sweep.go

@@ -35,6 +35,7 @@ func RegisterSweepers() {
 		Dependencies: []string{
 			"aws_s3_access_point",
 			"aws_s3_object",
+			"aws_s3control_access_grants_instance",
 			"aws_s3control_multi_region_access_point",
 		},
 	})