r/kms_key - correctly handle PendingDeletion state

.changelog/19967.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_kms_key: Add plan time validation to `description`.
+```

aws/resource_aws_kms_key.go

@@ -6,7 +6,6 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -40,35 +39,24 @@ func resourceAwsKmsKey() *schema.Resource {
 				Computed: true,
 			},
 			"description": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringLenBetween(0, 8192),
 			},
 			"key_usage": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  kms.KeyUsageTypeEncryptDecrypt,
-				ForceNew: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					kms.KeyUsageTypeEncryptDecrypt,
-					kms.KeyUsageTypeSignVerify,
-				}, false),
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      kms.KeyUsageTypeEncryptDecrypt,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(kms.KeyUsageType_Values(), false),
 			},
 			"customer_master_key_spec": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  kms.CustomerMasterKeySpecSymmetricDefault,
-				ForceNew: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					kms.CustomerMasterKeySpecSymmetricDefault,
-					kms.CustomerMasterKeySpecRsa2048,
-					kms.CustomerMasterKeySpecRsa3072,
-					kms.CustomerMasterKeySpecRsa4096,
-					kms.CustomerMasterKeySpecEccNistP256,
-					kms.CustomerMasterKeySpecEccNistP384,
-					kms.CustomerMasterKeySpecEccNistP521,
-					kms.CustomerMasterKeySpecEccSecgP256k1,
-				}, false),
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      kms.CustomerMasterKeySpecSymmetricDefault,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(kms.CustomerMasterKeySpec_Values(), false),
 			},
 			"policy": {
 				Type:             schema.TypeString,
@@ -210,7 +198,7 @@ func resourceAwsKmsKeyRead(d *schema.ResourceData, meta interface{}) error {
 	p := pOut.(*kms.GetKeyPolicyOutput)
 	policy, err := structure.NormalizeJsonString(*p.Policy)
 	if err != nil {
-		return fmt.Errorf("policy contains an invalid JSON: %s", err)
+		return fmt.Errorf("policy contains an invalid JSON: %w", err)
 	}
 	d.Set("policy", policy)
 
@@ -246,7 +234,7 @@ func resourceAwsKmsKeyRead(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	if err != nil {
-		return fmt.Errorf("error listing tags for KMS Key (%s): %s", d.Id(), err)
+		return fmt.Errorf("error listing tags for KMS Key (%s): %w", d.Id(), err)
 	}
 
 	tags = tags.IgnoreAws().IgnoreConfig(ignoreTagsConfig)
@@ -302,7 +290,7 @@ func resourceAwsKmsKeyUpdate(d *schema.ResourceData, meta interface{}) error {
 		o, n := d.GetChange("tags_all")
 
 		if err := keyvaluetags.KmsUpdateTags(conn, d.Id(), o, n); err != nil {
-			return fmt.Errorf("error updating KMS Key (%s) tags: %s", d.Id(), err)
+			return fmt.Errorf("error updating KMS Key (%s) tags: %w", d.Id(), err)
 		}
 	}
 
@@ -327,7 +315,7 @@ func resourceAwsKmsKeyDescriptionUpdate(conn *kms.KMS, d *schema.ResourceData) e
 func resourceAwsKmsKeyPolicyUpdate(conn *kms.KMS, d *schema.ResourceData) error {
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return fmt.Errorf("policy contains an invalid JSON: %s", err)
+		return fmt.Errorf("policy contains an invalid JSON: %w", err)
 	}
 	keyId := d.Get("key_id").(string)
 
@@ -377,8 +365,7 @@ func updateKmsKeyStatus(conn *kms.KMS, id string, shouldBeEnabled bool) error {
 				KeyId: aws.String(id),
 			})
 			if err != nil {
-				awsErr, ok := err.(awserr.Error)
-				if ok && awsErr.Code() == "NotFoundException" {
+				if isAWSErr(err, kms.ErrCodeNotFoundException, "") {
 					return nil, fmt.Sprintf("%t", !shouldBeEnabled), nil
 				}
 				return resp, "FAILED", err
@@ -392,7 +379,7 @@ func updateKmsKeyStatus(conn *kms.KMS, id string, shouldBeEnabled bool) error {
 
 	_, err = wait.WaitForState()
 	if err != nil {
-		return fmt.Errorf("Failed setting KMS key status to %t: %s", shouldBeEnabled, err)
+		return fmt.Errorf("Failed setting KMS key status to %t: %w", shouldBeEnabled, err)
 	}
 
 	return nil
@@ -405,11 +392,10 @@ func updateKmsKeyRotationStatus(conn *kms.KMS, d *schema.ResourceData) error {
 		err := handleKeyRotation(conn, shouldEnableRotation, aws.String(d.Id()))
 
 		if err != nil {
-			awsErr, ok := err.(awserr.Error)
-			if ok && awsErr.Code() == "DisabledException" {
+			if isAWSErr(err, kms.ErrCodeDisabledException, "") {
 				return resource.RetryableError(err)
 			}
-			if ok && awsErr.Code() == "NotFoundException" {
+			if isAWSErr(err, kms.ErrCodeNotFoundException, "") {
 				return resource.RetryableError(err)
 			}
 
@@ -438,7 +424,7 @@ func updateKmsKeyRotationStatus(conn *kms.KMS, d *schema.ResourceData) error {
 			log.Printf("[DEBUG] Checking if KMS key %s rotation status is %t",
 				d.Id(), shouldEnableRotation)
 
-			out, err := retryOnAwsCode("NotFoundException", func() (interface{}, error) {
+			out, err := retryOnAwsCode(kms.ErrCodeNotFoundException, func() (interface{}, error) {
 				return conn.GetKeyRotationStatus(&kms.GetKeyRotationStatusInput{
 					KeyId: aws.String(d.Id()),
 				})

aws/resource_aws_kms_key_test.go

@@ -23,34 +23,37 @@ func init() {
 func testSweepKmsKeys(region string) error {
 	client, err := sharedClientForRegion(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %w", err)
 	}
 	conn := client.(*AWSClient).kmsconn
 
 	err = conn.ListKeysPages(&kms.ListKeysInput{Limit: aws.Int64(int64(1000))}, func(out *kms.ListKeysOutput, lastPage bool) bool {
 		for _, k := range out.Keys {
+			kKeyId := aws.StringValue(k.KeyId)
 			kOut, err := conn.DescribeKey(&kms.DescribeKeyInput{
 				KeyId: k.KeyId,
 			})
 			if err != nil {
-				log.Printf("Error: Failed to describe key %q: %s", *k.KeyId, err)
+				log.Printf("Error: Failed to describe key %q: %s", kKeyId, err)
 				return false
 			}
-			if *kOut.KeyMetadata.KeyManager == kms.KeyManagerTypeAws {
+			if aws.StringValue(kOut.KeyMetadata.KeyManager) == kms.KeyManagerTypeAws {
 				// Skip (default) keys which are managed by AWS
 				continue
 			}
-			if *kOut.KeyMetadata.KeyState == kms.KeyStatePendingDeletion {
+			if aws.StringValue(kOut.KeyMetadata.KeyState) == kms.KeyStatePendingDeletion {
 				// Skip keys which are already scheduled for deletion
 				continue
 			}
 
-			_, err = conn.ScheduleKeyDeletion(&kms.ScheduleKeyDeletionInput{
-				KeyId:               k.KeyId,
-				PendingWindowInDays: aws.Int64(int64(7)),
-			})
+			r := resourceAwsKmsKey()
+			d := r.Data(nil)
+			d.SetId(kKeyId)
+			d.Set("key_id", kKeyId)
+			d.Set("deletion_window_in_days", "7")
+			err = r.Delete(d, client)
 			if err != nil {
-				log.Printf("Error: Failed to schedule key %q for deletion: %s", *k.KeyId, err)
+				log.Printf("Error: Failed to schedule key %q for deletion: %s", kKeyId, err)
 				return false
 			}
 		}
@@ -61,7 +64,7 @@ func testSweepKmsKeys(region string) error {
 			log.Printf("[WARN] Skipping KMS Key sweep for %s: %s", region, err)
 			return nil
 		}
-		return fmt.Errorf("Error describing KMS keys: %s", err)
+		return fmt.Errorf("Error describing KMS keys: %w", err)
 	}
 
 	return nil
@@ -84,6 +87,7 @@ func TestAccAWSKmsKey_basic(t *testing.T) {
 					testAccCheckAWSKmsKeyExists(resourceName, &key),
 					resource.TestCheckResourceAttr(resourceName, "customer_master_key_spec", "SYMMETRIC_DEFAULT"),
 					resource.TestCheckResourceAttr(resourceName, "key_usage", "ENCRYPT_DECRYPT"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
@@ -134,7 +138,7 @@ func TestAccAWSKmsKey_disappears(t *testing.T) {
 				Config: testAccAWSKmsKey(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSKmsKeyExists(resourceName, &key),
-					testAccCheckAWSKmsKeyDisappears(&key),
+					testAccCheckResourceDisappears(testAccProvider, resourceAwsKmsKey(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -417,19 +421,6 @@ func testAccCheckAWSKmsKeyIsEnabled(key *kms.KeyMetadata, isEnabled bool) resour
 	}
 }
 
-func testAccCheckAWSKmsKeyDisappears(key *kms.KeyMetadata) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := testAccProvider.Meta().(*AWSClient).kmsconn
-
-		_, err := conn.ScheduleKeyDeletion(&kms.ScheduleKeyDeletionInput{
-			KeyId:               key.KeyId,
-			PendingWindowInDays: aws.Int64(int64(7)),
-		})
-
-		return err
-	}
-}
-
 func testAccAWSKmsKey(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {

website/docs/r/kms_key.html.markdown

@@ -8,7 +8,7 @@ description: |-
 
 # Resource: aws_kms_key
 
-Provides a KMS customer master key.
+Provides a KMS single-Region customer master key (CMK).
 
 ## Example Usage