r/aws_backup_vault_lock_configuration: New resource

[GlennChia]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #21235

Output from acceptance testing (Using the most up-to-date testing command with reference to #20000):

$ TF_ACC=1 go test ./internal/service/backup -v -count 1 -parallel 20 -run='TestAccBackupVaultLockConfiguration' -timeout=180m
=== RUN   TestAccBackupVaultLockConfiguration_basic
=== PAUSE TestAccBackupVaultLockConfiguration_basic
=== RUN   TestAccBackupVaultLockConfiguration_disappears
=== PAUSE TestAccBackupVaultLockConfiguration_disappears
=== CONT  TestAccBackupVaultLockConfiguration_basic
=== CONT  TestAccBackupVaultLockConfiguration_disappears
--- PASS: TestAccBackupVaultLockConfiguration_disappears (40.99s)
--- PASS: TestAccBackupVaultLockConfiguration_basic (45.45s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/backup     51.598s

Requested guidance

• This is my first PR for a feature and I referenced the aws_backup_vault_notifications heavily (At the time I reference it, it was after the changes mentioned in Big Changes: AWS Provider Refactor #20000). Would appreciate PR feedback and guidance
• Note: BackupVaultLockConfiguration currently does not have a GetBackupVaultLockConfiguration and this affects the test cases. Reference: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/backup. Hence, instead, to write the test cases, use DescribeBackupVault which can verify BackupVaultName. Note that changeable_for_days is not returned by the API and I use ImportStateVerifyIgnore: []string{"changeable_for_days"}, to account for this
• Adding on to the above point, currently I'm using DescribeBackupVault to set the max_retention_days and min_retention_days in a resourceVaultLockConfigurationRead function. Note that it doesn't have information about changeable_for_days so that one remains empty (Reference: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/backup). Is that the right approach or should I comment out the resourceVaultLockConfigurationRead function?
• Following the https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_vault_notifications documentation, I edited it to fit the lock configuration. I'm not too sure about the import part of the documentation. I understand that the go file uses Importer: &schema.ResourceImporter{ and wanted to know if this will handle the imports somehow behind the scenes?
• For the CI, can I clarify what I can do for the terraform providers schema and providerlint error messages? It seems like it should be fixed outside this PR? As for go generate, it suggested Unexpected difference in directories after code generation. Run 'make gen' command and commit., should I follow this suggestion?

Thanks for your help!

[YakDriver]

You've hit us right in the middle of our biggest change in years. Hopefully it will make like much easier but it is change. Please see #20000 for more guidance.

[GlennChia]

You've hit us right in the middle of our biggest change in years. Hopefully it will make like much easier but it is change. Please see #20000 for more guidance.

Hi @YakDriver thanks for the update! I think I started working on this PR after the many changes made yesterday and referenced similar resources like internal/service/backup/vault_notifications.go and internal/service/backup/vault.go when drafting this PR. These resources are using the guidelines stated in the reference issue and the changes do indeed make life easier. Requesting your help for some of the questions mentioned in the PR description (it's more resource specific questions and a few CI-related questions). Thanks in advance!

[zhelding]

Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding.

Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single aws directory to a large number of separate directories in internal/service, each corresponding to a particular AWS service. This separation of code has also allowed for us to simplify the names of underlying functions -- while still avoiding namespace collisions.

We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author.

For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000.

For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide.

[ewbankkit]

LGTM 🚀.

Commercial

% make testacc TESTARGS='-run=TestAccBackupVaultLockConfiguration_\|TestAccBackupVault_' PKG_NAME=internal/service/backup
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/backup/... -v -count 1 -parallel 20 -run=TestAccBackupVaultLockConfiguration_\|TestAccBackupVault_ -timeout 180m
=== RUN   TestAccBackupVaultLockConfiguration_basic
=== PAUSE TestAccBackupVaultLockConfiguration_basic
=== RUN   TestAccBackupVaultLockConfiguration_disappears
=== PAUSE TestAccBackupVaultLockConfiguration_disappears
=== RUN   TestAccBackupVault_basic
=== PAUSE TestAccBackupVault_basic
=== RUN   TestAccBackupVault_withKMSKey
=== PAUSE TestAccBackupVault_withKMSKey
=== RUN   TestAccBackupVault_withTags
=== PAUSE TestAccBackupVault_withTags
=== RUN   TestAccBackupVault_disappears
=== PAUSE TestAccBackupVault_disappears
=== CONT  TestAccBackupVaultLockConfiguration_basic
=== CONT  TestAccBackupVault_basic
=== CONT  TestAccBackupVaultLockConfiguration_disappears
=== CONT  TestAccBackupVault_withKMSKey
=== CONT  TestAccBackupVault_disappears
=== CONT  TestAccBackupVault_withTags
--- PASS: TestAccBackupVault_disappears (25.79s)
--- PASS: TestAccBackupVaultLockConfiguration_disappears (33.12s)
--- PASS: TestAccBackupVault_basic (33.38s)
--- PASS: TestAccBackupVaultLockConfiguration_basic (36.30s)
--- PASS: TestAccBackupVault_withKMSKey (37.76s)
--- PASS: TestAccBackupVault_withTags (60.20s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/backup	67.282s

GovCloud

% make testacc TESTARGS='-run=TestAccBackupVaultLockConfiguration_\|TestAccBackupVault_' PKG_NAME=internal/service/backup
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/backup/... -v -count 1 -parallel 20 -run=TestAccBackupVaultLockConfiguration_\|TestAccBackupVault_ -timeout 180m
=== RUN   TestAccBackupVaultLockConfiguration_basic
=== PAUSE TestAccBackupVaultLockConfiguration_basic
=== RUN   TestAccBackupVaultLockConfiguration_disappears
=== PAUSE TestAccBackupVaultLockConfiguration_disappears
=== RUN   TestAccBackupVault_basic
=== PAUSE TestAccBackupVault_basic
=== RUN   TestAccBackupVault_withKMSKey
=== PAUSE TestAccBackupVault_withKMSKey
=== RUN   TestAccBackupVault_withTags
=== PAUSE TestAccBackupVault_withTags
=== RUN   TestAccBackupVault_disappears
=== PAUSE TestAccBackupVault_disappears
=== CONT  TestAccBackupVaultLockConfiguration_disappears
=== CONT  TestAccBackupVaultLockConfiguration_basic
=== CONT  TestAccBackupVault_withKMSKey
=== CONT  TestAccBackupVault_withTags
=== CONT  TestAccBackupVault_disappears
=== CONT  TestAccBackupVault_basic
--- PASS: TestAccBackupVault_disappears (29.20s)
--- PASS: TestAccBackupVaultLockConfiguration_disappears (34.85s)
--- PASS: TestAccBackupVault_basic (35.22s)
--- PASS: TestAccBackupVaultLockConfiguration_basic (38.28s)
--- PASS: TestAccBackupVault_withKMSKey (39.67s)
--- PASS: TestAccBackupVault_withTags (65.79s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/backup	79.078s

[ewbankkit]

@GlennChia Thanks for the contribution 🎉 👏.

[AdamTylerLynch]

AWS Provided.

[github-actions]

This functionality has been released in v3.64.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.