New resource/aws_vpc_endpoint_connection_accepter

[shedimon]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #22288.

New resource justification

With the current state it is impossible to accept VPC Endpoint Connection request in AWS account, that differs from the AWS Endpoint AWS account. This PR adds the resource, that accepts the connection request.

Open questions

1. Should state be tracked and exported as an attribute? Should we force new resource in case it's changed?
2. I've failed to run the test config with the alternate provider, since it failed on missing the security token and session token for the assumed role. I've ran it using the inlined providers with assume_role configs, but removed it and replicated the approach I've discovered in the source code.

Output from acceptance testing:

make testacc TEST=./aws TESTARGS='-run=TestAccVpcEndpointServiceAccepter_crossAccount'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccVpcEndpointServiceAccepter_crossAccount -timeout 180m
=== RUN   TestAccVpcEndpointServiceAccepter_crossAccount
--- PASS: TestAccVpcEndpointServiceAccepter_crossAccount (425.90s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	428.578s

[shedimon]

Hi @bflad @ewbankkit @anGie44 could you please take a look at this PR? There are some questions regarding linting and computed attributes.

• AWS Go SDK pointer conversion function for d.Set() value is extraneous:
  d.Set("state", aws.StringValue(vpceConn.(ec2.VpcEndpointConnection).VpcEndpointState))

• AWSAT005: avoid hardcoded ARN AWS partitions, use aws_partition data source:
  allowed_principals = ["arn:aws:iam::${data.aws_caller_identity.alternate.account_id}:root"]

UPD: Should be fixed by dd9e969. The questions regarding the state attribute in the next comment are still relevant.

[shedimon]

The issue with the connection state seems a bit tricky. You can reject and then accept the connection again. From my perspective if connection was rejected in the UI connection_accepter resource should try and re-create itself - accept the connection from the endpoint to the service again. Or it can be destroyed and removed from the config. What is the right way to make such changes with the Computed attribute?

[zhelding]

Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding.

Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single aws directory to a large number of separate directories in internal/service, each corresponding to a particular AWS service. This separation of code has also allowed for us to simplify the names of underlying functions -- while still avoiding namespace collisions.

We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author.

For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000.

For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide.

[ewbankkit]

LGTM 🚀.

% make testacc PKG=ec2 TESTS=TestAccEC2VPCEndpointConnectionAccepter_                     
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccEC2VPCEndpointConnectionAccepter_' -timeout 180m
=== RUN   TestAccEC2VPCEndpointConnectionAccepter_crossAccount
--- PASS: TestAccEC2VPCEndpointConnectionAccepter_crossAccount (361.52s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	365.176s

[ewbankkit]

@shedimon Thanks for the contribution 🎉 👏.
In general everything was great.
I refactored to fit into the new per-service package structure and renamed the attributes to match other resources:

• state -> vpc_endpoint_state
• endpoint_id -> vpc_endpoint_id
• service_id -> vpc_endpoint_service_id

[shedimon]

Hi @ewbankkit, thanks a lot!

Happy holidays! :)

[github-actions]

This functionality has been released in v3.71.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.