resource/aws_cloudwatch_log_group: Remove tags restrictions in AWS GovCloud (US) and AWS China

[bflad]

At some point (sorry, I cannot find the relevant blog post if there was one), AWS GovCloud (US) started supporting resource tags with CloudWatch Log groups.

Changes proposed in this pull request:

• Remove aws_cloudwatch_log_group resource tags handling restrictions in AWS GovCloud (US) and AWS China
• Remove IsGovCloud() function
• Simplify CloudWatch Log group lookup to use paginated SDK function and remove extraneous exists boolean return value

Output from acceptance testing (AWS Commercial):

$ make testacc TEST=./aws TESTARGS='-run=TestAccAWSCloudWatchLogGroup'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSCloudWatchLogGroup -timeout 120m
=== RUN   TestAccAWSCloudWatchLogGroup_importBasic
--- PASS: TestAccAWSCloudWatchLogGroup_importBasic (14.59s)
=== RUN   TestAccAWSCloudWatchLogGroup_basic
--- PASS: TestAccAWSCloudWatchLogGroup_basic (10.61s)
=== RUN   TestAccAWSCloudWatchLogGroup_namePrefix
--- PASS: TestAccAWSCloudWatchLogGroup_namePrefix (11.89s)
=== RUN   TestAccAWSCloudWatchLogGroup_namePrefix_retention
--- PASS: TestAccAWSCloudWatchLogGroup_namePrefix_retention (20.23s)
=== RUN   TestAccAWSCloudWatchLogGroup_generatedName
--- PASS: TestAccAWSCloudWatchLogGroup_generatedName (11.10s)
=== RUN   TestAccAWSCloudWatchLogGroup_retentionPolicy
--- PASS: TestAccAWSCloudWatchLogGroup_retentionPolicy (21.01s)
=== RUN   TestAccAWSCloudWatchLogGroup_multiple
--- PASS: TestAccAWSCloudWatchLogGroup_multiple (12.12s)
=== RUN   TestAccAWSCloudWatchLogGroup_disappears
--- PASS: TestAccAWSCloudWatchLogGroup_disappears (8.48s)
=== RUN   TestAccAWSCloudWatchLogGroup_tagging
--- PASS: TestAccAWSCloudWatchLogGroup_tagging (37.42s)
=== RUN   TestAccAWSCloudWatchLogGroup_kmsKey
--- PASS: TestAccAWSCloudWatchLogGroup_kmsKey (51.95s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	199.426s

Output from acceptance testing (AWS GovCloud (US)):

$ make testacc TEST=./aws TESTARGS='-run=TestAccAWSCloudWatchLogGroup'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSCloudWatchLogGroup -timeout 120m
=== RUN   TestAccAWSCloudWatchLogGroup_importBasic
--- PASS: TestAccAWSCloudWatchLogGroup_importBasic (19.56s)
=== RUN   TestAccAWSCloudWatchLogGroup_basic
--- PASS: TestAccAWSCloudWatchLogGroup_basic (17.06s)
=== RUN   TestAccAWSCloudWatchLogGroup_namePrefix
--- PASS: TestAccAWSCloudWatchLogGroup_namePrefix (16.04s)
=== RUN   TestAccAWSCloudWatchLogGroup_namePrefix_retention
--- PASS: TestAccAWSCloudWatchLogGroup_namePrefix_retention (29.74s)
=== RUN   TestAccAWSCloudWatchLogGroup_generatedName
--- PASS: TestAccAWSCloudWatchLogGroup_generatedName (15.42s)
=== RUN   TestAccAWSCloudWatchLogGroup_retentionPolicy
--- PASS: TestAccAWSCloudWatchLogGroup_retentionPolicy (28.87s)
=== RUN   TestAccAWSCloudWatchLogGroup_multiple
--- PASS: TestAccAWSCloudWatchLogGroup_multiple (18.56s)
=== RUN   TestAccAWSCloudWatchLogGroup_disappears
--- PASS: TestAccAWSCloudWatchLogGroup_disappears (11.86s)
=== RUN   TestAccAWSCloudWatchLogGroup_tagging
--- PASS: TestAccAWSCloudWatchLogGroup_tagging (54.80s)
=== RUN   TestAccAWSCloudWatchLogGroup_kmsKey
--- PASS: TestAccAWSCloudWatchLogGroup_kmsKey (58.14s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	270.097s

[tombuildsstuff]

otherwise LGTM 👍

[tombuildsstuff]

since this also affects China - does this fix work in that DC too?

[bflad]

I'm not 100% positive since we cannot test AWS China directly (at the moment), but there are some reasons why its likely okay. Its probably important to note that we do not have any access or acceptance testing in place for AWS China and its support is currently best effort based on bug reports. We should probably include this in our documentation/README. 🤔

It doesn't appear this was ever explicitly requested to be restricted like this as far as I can tell. I did some Git spelunking and I couldn't find an associated reason why AWS China was being included (although probably just for "good measure" when the GovCloud logic was added):

• hashicorp/terraform@55000e4
• hashicorp/terraform@0285407

I don't see any particular announcement in the AWS China What's New blog for this CloudWatch Log resource tagging, but the GovCloud blog didn't seem to announce it either unless its hidden under another post.

The AWS China CloudWatch documentation points to the regular CloudWatch documentation, which does not list any restrictions in its tagging section.

In the end, I think its worth switching the logic (at the risk of a regression). If the resource tagging is still not supported, we can get a bug report the appropriate error message and can switch it to a more future-proof solution based on that handling rather than depending on a hardcoded conditional that has to be updated in the code.

[bflad]

This has been released in version 1.28.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!