EKS supports adding KMS envelope encryption to existing clusters

.changelog/19144.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_eks_cluster: Allow updates to `encryption_config`
+```

aws/data_source_aws_eks_addon.go

@@ -6,11 +6,12 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
+	tfeks "github.com/terraform-providers/terraform-provider-aws/aws/internal/service/eks"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/eks/finder"
 )
 
 func dataSourceAwsEksAddon() *schema.Resource {
@@ -22,23 +23,19 @@ func dataSourceAwsEksAddon() *schema.Resource {
 				Required:     true,
 				ValidateFunc: validation.NoZeroValues,
 			},
-			"cluster_name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validateEKSClusterName,
-			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"addon_version": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"service_account_role_arn": {
+			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"cluster_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validateEKSClusterName,
+			},
 			"created_at": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -47,6 +44,10 @@ func dataSourceAwsEksAddon() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"service_account_role_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"tags": tagsSchemaComputed(),
 		},
 	}
@@ -58,31 +59,23 @@ func dataSourceAwsEksAddonRead(ctx context.Context, d *schema.ResourceData, meta
 
 	addonName := d.Get("addon_name").(string)
 	clusterName := d.Get("cluster_name").(string)
+	id := tfeks.AddonCreateResourceID(clusterName, addonName)
 
-	input := &eks.DescribeAddonInput{
-		AddonName:   aws.String(addonName),
-		ClusterName: aws.String(clusterName),
-	}
+	addon, err := finder.AddonByClusterNameAndAddonName(ctx, conn, clusterName, addonName)
 
-	output, err := conn.DescribeAddonWithContext(ctx, input)
 	if err != nil {
-		return diag.FromErr(fmt.Errorf("error reading EKS Addon (%s): %w", addonName, err))
+		return diag.FromErr(fmt.Errorf("error reading EKS Add-On (%s): %w", id, err))
 	}
 
-	addon := output.Addon
-	if addon == nil {
-		return diag.FromErr(fmt.Errorf("EKS Addon (%s) not found", addonName))
-	}
-
-	d.SetId(fmt.Sprintf("%s:%s", clusterName, addonName))
-	d.Set("arn", addon.AddonArn)
+	d.SetId(id)
 	d.Set("addon_version", addon.AddonVersion)
-	d.Set("service_account_role_arn", addon.ServiceAccountRoleArn)
+	d.Set("arn", addon.AddonArn)
 	d.Set("created_at", aws.TimeValue(addon.CreatedAt).Format(time.RFC3339))
 	d.Set("modified_at", aws.TimeValue(addon.ModifiedAt).Format(time.RFC3339))
+	d.Set("service_account_role_arn", addon.ServiceAccountRoleArn)
 
 	if err := d.Set("tags", keyvaluetags.EksKeyValueTags(addon.Tags).IgnoreAws().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return diag.FromErr(fmt.Errorf("error setting tags attribute: %w", err))
+		return diag.FromErr(fmt.Errorf("error setting tags: %w", err))
 	}
 
 	return nil

aws/data_source_aws_eks_cluster.go

@@ -2,12 +2,11 @@ package aws
 
 import (
 	"fmt"
-	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
+	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/eks/finder"
 )
 
 func dataSourceAwsEksCluster() *schema.Resource {
@@ -95,6 +94,10 @@ func dataSourceAwsEksCluster() *schema.Resource {
 				Computed: true,
 			},
 			"tags": tagsSchemaComputed(),
+			"version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"vpc_config": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -112,17 +115,17 @@ func dataSourceAwsEksCluster() *schema.Resource {
 							Type:     schema.TypeBool,
 							Computed: true,
 						},
-						"security_group_ids": {
+						"public_access_cidrs": {
 							Type:     schema.TypeSet,
 							Computed: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
-						"subnet_ids": {
+						"security_group_ids": {
 							Type:     schema.TypeSet,
 							Computed: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
-						"public_access_cidrs": {
+						"subnet_ids": {
 							Type:     schema.TypeSet,
 							Computed: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
@@ -134,10 +137,6 @@ func dataSourceAwsEksCluster() *schema.Resource {
 					},
 				},
 			},
-			"version": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 		},
 	}
 }
@@ -147,22 +146,12 @@ func dataSourceAwsEksClusterRead(d *schema.ResourceData, meta interface{}) error
 	ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
 
 	name := d.Get("name").(string)
+	cluster, err := finder.ClusterByName(conn, name)
 
-	input := &eks.DescribeClusterInput{
-		Name: aws.String(name),
-	}
-
-	log.Printf("[DEBUG] Reading EKS Cluster: %s", input)
-	output, err := conn.DescribeCluster(input)
 	if err != nil {
 		return fmt.Errorf("error reading EKS Cluster (%s): %w", name, err)
 	}
 
-	cluster := output.Cluster
-	if cluster == nil {
-		return fmt.Errorf("EKS Cluster (%s) not found", name)
-	}
-
 	d.SetId(name)
 	d.Set("arn", cluster.Arn)
 
@@ -171,32 +160,34 @@ func dataSourceAwsEksClusterRead(d *schema.ResourceData, meta interface{}) error
 	}
 
 	d.Set("created_at", aws.TimeValue(cluster.CreatedAt).String())
+
 	if err := d.Set("enabled_cluster_log_types", flattenEksEnabledLogTypes(cluster.Logging)); err != nil {
 		return fmt.Errorf("error setting enabled_cluster_log_types: %w", err)
 	}
+
 	d.Set("endpoint", cluster.Endpoint)
 
 	if err := d.Set("identity", flattenEksIdentity(cluster.Identity)); err != nil {
 		return fmt.Errorf("error setting identity: %w", err)
 	}
 
+	if err := d.Set("kubernetes_network_config", flattenEksNetworkConfig(cluster.KubernetesNetworkConfig)); err != nil {
+		return fmt.Errorf("error setting kubernetes_network_config: %w", err)
+	}
+
 	d.Set("name", cluster.Name)
 	d.Set("platform_version", cluster.PlatformVersion)
 	d.Set("role_arn", cluster.RoleArn)
 	d.Set("status", cluster.Status)
 
-	if err := d.Set("tags", keyvaluetags.EksKeyValueTags(cluster.Tags).IgnoreAws().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return fmt.Errorf("error setting tags: %w", err)
-	}
-
 	d.Set("version", cluster.Version)
 
 	if err := d.Set("vpc_config", flattenEksVpcConfigResponse(cluster.ResourcesVpcConfig)); err != nil {
 		return fmt.Errorf("error setting vpc_config: %w", err)
 	}
 
-	if err := d.Set("kubernetes_network_config", flattenEksNetworkConfig(cluster.KubernetesNetworkConfig)); err != nil {
-		return fmt.Errorf("error setting kubernetes_network_config: %w", err)
+	if err := d.Set("tags", keyvaluetags.EksKeyValueTags(cluster.Tags).IgnoreAws().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
+		return fmt.Errorf("error setting tags: %w", err)
 	}
 
 	return nil

aws/data_source_aws_eks_cluster_test.go

@@ -1,7 +1,6 @@
 package aws
 
 import (
-	"fmt"
 	"regexp"
 	"testing"
 
@@ -11,7 +10,7 @@ import (
 )
 
 func TestAccAWSEksClusterDataSource_basic(t *testing.T) {
-	rName := fmt.Sprintf("tf-acc-test-%s", acctest.RandString(5))
+	rName := acctest.RandomWithPrefix("tf-acc-test")
 	dataSourceResourceName := "data.aws_eks_cluster.test"
 	resourceName := "aws_eks_cluster.test"
 
@@ -57,11 +56,9 @@ func TestAccAWSEksClusterDataSource_basic(t *testing.T) {
 }
 
 func testAccAWSEksClusterDataSourceConfig_Basic(rName string) string {
-	return fmt.Sprintf(`
-%[1]s
-
+	return composeConfig(testAccAWSEksClusterConfig_Logging(rName, []string{"api", "audit"}), `
 data "aws_eks_cluster" "test" {
   name = aws_eks_cluster.test.name
 }
-`, testAccAWSEksClusterConfig_Logging(rName, []string{"api", "audit"}))
+`)
 }

aws/internal/service/amplify/waiter/waiter.go

@@ -26,7 +26,7 @@ func DomainAssociationCreated(conn *amplify.Amplify, appID, domainName string) (
 	outputRaw, err := stateConf.WaitForState()
 
 	if v, ok := outputRaw.(*amplify.DomainAssociation); ok {
-		if v != nil && aws.StringValue(v.DomainStatus) == amplify.DomainStatusFailed {
+		if status := aws.StringValue(v.DomainStatus); status == amplify.DomainStatusFailed {
 			tfresource.SetLastError(err, errors.New(aws.StringValue(v.StatusReason)))
 		}
 

aws/internal/service/ec2/waiter/waiter.go

@@ -358,7 +358,7 @@ func RouteTableAssociationCreated(conn *ec2.EC2, id string) (*ec2.RouteTableAsso
 	outputRaw, err := stateConf.WaitForState()
 
 	if output, ok := outputRaw.(*ec2.RouteTableAssociationState); ok {
-		if output != nil && aws.StringValue(output.State) == ec2.RouteTableAssociationStateCodeFailed {
+		if state := aws.StringValue(output.State); state == ec2.RouteTableAssociationStateCodeFailed {
 			tfresource.SetLastError(err, errors.New(aws.StringValue(output.StatusMessage)))
 		}
 
@@ -379,7 +379,7 @@ func RouteTableAssociationDeleted(conn *ec2.EC2, id string) (*ec2.RouteTableAsso
 	outputRaw, err := stateConf.WaitForState()
 
 	if output, ok := outputRaw.(*ec2.RouteTableAssociationState); ok {
-		if output != nil && aws.StringValue(output.State) == ec2.RouteTableAssociationStateCodeFailed {
+		if state := aws.StringValue(output.State); state == ec2.RouteTableAssociationStateCodeFailed {
 			tfresource.SetLastError(err, errors.New(aws.StringValue(output.StatusMessage)))
 		}
 
@@ -400,7 +400,7 @@ func RouteTableAssociationUpdated(conn *ec2.EC2, id string) (*ec2.RouteTableAsso
 	outputRaw, err := stateConf.WaitForState()
 
 	if output, ok := outputRaw.(*ec2.RouteTableAssociationState); ok {
-		if output != nil && aws.StringValue(output.State) == ec2.RouteTableAssociationStateCodeFailed {
+		if state := aws.StringValue(output.State); state == ec2.RouteTableAssociationStateCodeFailed {
 			tfresource.SetLastError(err, errors.New(aws.StringValue(output.StatusMessage)))
 		}
 
@@ -704,8 +704,8 @@ func VpcEndpointAccepted(conn *ec2.EC2, vpcEndpointID string, timeout time.Durat
 	outputRaw, err := stateConf.WaitForState()
 
 	if output, ok := outputRaw.(*ec2.VpcEndpoint); ok {
-		if output != nil && aws.StringValue(output.State) == tfec2.VpcEndpointStateFailed && output.LastError != nil {
-			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(output.LastError.Code), aws.StringValue(output.LastError.Message)))
+		if state, lastError := aws.StringValue(output.State), output.LastError; state == tfec2.VpcEndpointStateFailed && lastError != nil {
+			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(lastError.Code), aws.StringValue(lastError.Message)))
 		}
 
 		return output, err

aws/internal/service/eks/enum.go

@@ -0,0 +1,11 @@
+package eks
+
+const (
+	ResourcesSecrets = "secrets"
+)
+
+func Resources_Values() []string {
+	return []string{
+		ResourcesSecrets,
+	}
+}