aws_secret_backend: allow role_arns with policy_arns

[adongy]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Closes #709

Release note for CHANGELOG:

aws_secret_backend: when `credential_type = assumed_role`, allow `policy_arns`

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSSecretBackend'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run=TestAccAWSSecretBackend -timeout 120m
?   	github.com/terraform-providers/terraform-provider-vault	[no test files]
?   	github.com/terraform-providers/terraform-provider-vault/cmd/coverage	[no test files]
testing: warning: no tests to run
PASS
ok  	github.com/terraform-providers/terraform-provider-vault/util	(cached) [no tests to run]
=== RUN   TestAccAWSSecretBackendRole_basic
--- PASS: TestAccAWSSecretBackendRole_basic (0.23s)
=== RUN   TestAccAWSSecretBackendRole_import
--- PASS: TestAccAWSSecretBackendRole_import (0.19s)
=== RUN   TestAccAWSSecretBackendRole_nested
--- PASS: TestAccAWSSecretBackendRole_nested (0.27s)
=== RUN   TestAccAWSSecretBackend_basic
--- PASS: TestAccAWSSecretBackend_basic (0.25s)
=== RUN   TestAccAWSSecretBackend_import
--- PASS: TestAccAWSSecretBackend_import (0.12s)
PASS
ok  	github.com/terraform-providers/terraform-provider-vault/vault	1.070s

Tests did not update. I let the Vault binary provide validation as done here: https://github.com/hashicorp/vault/blob/master/builtin/logical/aws/path_roles.go

I did not change the code for the deprecated attributes (as they have Removed). Website documentation has been copied from the Vault website and reordered.

The sample Terraform has been updated, as only specifying a policy_document with credential_type = assumed_role is illegal.

Thanks!

[tyrannosaurus-becks]

Thanks for working on this. I'm thinking we shouldn't remove most of the ConflictsWith fields, but am looking forward to hearing your thoughts about it.

[tyrannosaurus-becks]

Hi! I'd be fine with pulling role_arns out here. However, I'm not so sure we should pull out the rest. Adding these deprecated parameters to ConflictsWith here is a normal part of the best practices around deprecation located here.

[adongy]

Hi!

That does seem reasonable as we're still not at the next major version bump.

[tyrannosaurus-becks]

Hey, thanks @adongy !