resource/aws_iam_access_key: Support resource import

.changelog/17321.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_iam_access_key: Support resource import
+```

aws/resource_aws_iam_access_key.go

@@ -21,6 +21,33 @@ func resourceAwsIamAccessKey() *schema.Resource {
 		Update: resourceAwsIamAccessKeyUpdate,
 		Delete: resourceAwsIamAccessKeyDelete,
 
+		Importer: &schema.ResourceImporter{
+			// ListAccessKeys requires UserName field in certain scenarios:
+			//   ValidationError: Must specify userName when calling with non-User credentials
+			// To prevent import from requiring this extra information, use GetAccessKeyLastUsed.
+			State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				conn := meta.(*AWSClient).iamconn
+
+				input := &iam.GetAccessKeyLastUsedInput{
+					AccessKeyId: aws.String(d.Id()),
+				}
+
+				output, err := conn.GetAccessKeyLastUsed(input)
+
+				if err != nil {
+					return nil, fmt.Errorf("error fetching IAM Access Key (%s) username via GetAccessKeyLastUsed: %w", d.Id(), err)
+				}
+
+				if output == nil || output.UserName == nil {
+					return nil, fmt.Errorf("error fetching IAM Access Key (%s) username via GetAccessKeyLastUsed: empty response", d.Id())
+				}
+
+				d.Set("user", output.UserName)
+
+				return []*schema.ResourceData{d}, nil
+			},
+		},
+
 		Schema: map[string]*schema.Schema{
 			"user": {
 				Type:     schema.TypeString,

aws/resource_aws_iam_access_key_test.go

@@ -33,6 +33,12 @@ func TestAccAWSAccessKey_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet("aws_iam_access_key.a_key", "secret"),
 				),
 			},
+			{
+				ResourceName:            "aws_iam_access_key.a_key",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"encrypted_secret", "key_fingerprint", "pgp_key", "secret", "ses_smtp_password_v4"},
+			},
 		},
 	})
 }
@@ -60,6 +66,12 @@ func TestAccAWSAccessKey_encrypted(t *testing.T) {
 						"aws_iam_access_key.a_key", "key_fingerprint"),
 				),
 			},
+			{
+				ResourceName:            "aws_iam_access_key.a_key",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"encrypted_secret", "key_fingerprint", "pgp_key", "secret", "ses_smtp_password_v4"},
+			},
 		},
 	})
 }
@@ -81,6 +93,12 @@ func TestAccAWSAccessKey_inactive(t *testing.T) {
 					resource.TestCheckResourceAttrSet("aws_iam_access_key.a_key", "secret"),
 				),
 			},
+			{
+				ResourceName:            "aws_iam_access_key.a_key",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"encrypted_secret", "key_fingerprint", "pgp_key", "secret", "ses_smtp_password_v4"},
+			},
 			{
 				Config: testAccAWSAccessKeyConfig_inactive(rName),
 				Check: resource.ComposeTestCheckFunc(

website/docs/r/iam_access_key.html.markdown

@@ -80,17 +80,17 @@ In addition to all arguments above, the following attributes are exported:
 
 * `id` - The access key ID.
 * `user` - The IAM user associated with this access key.
-* `key_fingerprint` - The fingerprint of the PGP key used to encrypt
-  the secret
-* `secret` - The secret access key. Note that this will be written
-to the state file. If you use this, please protect your backend state file
-judiciously. Alternatively, you may supply a `pgp_key` instead, which will
-prevent the secret from being stored in plaintext, at the cost of preventing
-the use of the secret key in automation.
-* `encrypted_secret` - The encrypted secret, base64 encoded, if `pgp_key` was specified.
-~> **NOTE:** The encrypted secret may be decrypted using the command line,
-   for example: `terraform output encrypted_secret | base64 --decode | keybase pgp decrypt`.
-* `ses_smtp_password_v4` - The secret access key converted into an SES SMTP
-  password by applying [AWS's documented Sigv4 conversion
-  algorithm](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html#smtp-credentials-convert).
-  As SigV4 is region specific, valid Provider regions are `ap-south-1`, `ap-southeast-2`, `eu-central-1`, `eu-west-1`, `us-east-1` and `us-west-2`. See current [AWS SES regions](https://docs.aws.amazon.com/general/latest/gr/rande.html#ses_region)
+* `key_fingerprint` - The fingerprint of the PGP key used to encrypt the secret. This attribute is not available for imported resources.
+* `secret` - The secret access key. This attribute is not available for imported resources. Note that this will be written to the state file. If you use this, please protect your backend state file judiciously. Alternatively, you may supply a `pgp_key` instead, which will prevent the secret from being stored in plaintext, at the cost of preventing the use of the secret key in automation.
+* `encrypted_secret` - The encrypted secret, base64 encoded, if `pgp_key` was specified. This attribute is not available for imported resources. The encrypted secret may be decrypted using the command line, for example: `terraform output -raw encrypted_secret | base64 --decode | keybase pgp decrypt`.
+* `ses_smtp_password_v4` - The secret access key converted into an SES SMTP password by applying [AWS's documented Sigv4 conversion algorithm](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html#smtp-credentials-convert). This attribute is not available for imported resources. As SigV4 is region specific, valid Provider regions are `ap-south-1`, `ap-southeast-2`, `eu-central-1`, `eu-west-1`, `us-east-1` and `us-west-2`. See current [AWS SES regions](https://docs.aws.amazon.com/general/latest/gr/rande.html#ses_region).
+
+## Import
+
+IAM Access Keys can be imported using the identifier, e.g.
+
+```
+$ terraform import aws_iam_access_key.example AKIA1234567890
+```
+
+Resource attributes such as `encrypted_secret`, `key_fingerprint`, `pgp_key`, `secret`, and `ses_smtp_password_v4` are not available for imported resources as this information cannot be read from the IAM API.