s3: Preserve order in JSON/policy arrays

.changelog/21997.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_s3_bucket: Fix order-related diffs in `policy`
+```
+
+```release-note:bug
+resource/aws_s3_bucket_policy: Fix order-related diffs in `policy`
+```

internal/service/s3/bucket.go

@@ -911,11 +911,19 @@ func resourceBucketRead(d *schema.ResourceData, meta interface{}) error {
 					return err
 				}
 			} else {
-				policy, err := structure.NormalizeJsonString(aws.StringValue(v))
+				policyToSet, err := verify.SecondJSONUnlessEquivalent(d.Get("policy").(string), aws.StringValue(v))
+
+				if err != nil {
+					return fmt.Errorf("while setting policy (%s), encountered: %w", aws.StringValue(v), err)
+				}
+
+				policyToSet, err = structure.NormalizeJsonString(policyToSet)
+
 				if err != nil {
-					return fmt.Errorf("policy contains an invalid JSON: %s", err)
+					return fmt.Errorf("policy (%s) contains invalid JSON: %w", d.Get("policy").(string), err)
 				}
-				d.Set("policy", policy)
+
+				d.Set("policy", policyToSet)
 			}
 		}
 	}
@@ -1444,7 +1452,12 @@ func resourceBucketDelete(d *schema.ResourceData, meta interface{}) error {
 
 func resourceBucketPolicyUpdate(conn *s3.S3, d *schema.ResourceData) error {
 	bucket := d.Get("bucket").(string)
-	policy := d.Get("policy").(string)
+
+	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
+
+	if err != nil {
+		return fmt.Errorf("policy (%s) is an invalid JSON: %w", policy, err)
+	}
 
 	if policy != "" {
 		log.Printf("[DEBUG] S3 bucket: %s, put policy: %s", bucket, policy)

internal/service/s3/bucket_policy.go

@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -48,7 +49,12 @@ func resourceBucketPolicyPut(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).S3Conn
 
 	bucket := d.Get("bucket").(string)
-	policy := d.Get("policy").(string)
+
+	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
+
+	if err != nil {
+		return fmt.Errorf("policy (%s) is an invalid JSON: %w", policy, err)
+	}
 
 	log.Printf("[DEBUG] S3 bucket: %s, put policy: %s", bucket, policy)
 
@@ -57,7 +63,7 @@ func resourceBucketPolicyPut(d *schema.ResourceData, meta interface{}) error {
 		Policy: aws.String(policy),
 	}
 
-	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
+	err = resource.Retry(1*time.Minute, func() *resource.RetryError {
 		_, err := conn.PutBucketPolicy(params)
 		if tfawserr.ErrMessageContains(err, "MalformedPolicy", "") {
 			return resource.RetryableError(err)
@@ -89,11 +95,25 @@ func resourceBucketPolicyRead(d *schema.ResourceData, meta interface{}) error {
 
 	v := ""
 	if err == nil && pol.Policy != nil {
-		v = *pol.Policy
+		v = aws.StringValue(pol.Policy)
+	}
+
+	policyToSet, err := verify.SecondJSONUnlessEquivalent(d.Get("policy").(string), v)
+
+	if err != nil {
+		return fmt.Errorf("while setting policy (%s), encountered: %w", policyToSet, err)
 	}
-	if err := d.Set("policy", v); err != nil {
+
+	policyToSet, err = structure.NormalizeJsonString(policyToSet)
+
+	if err != nil {
+		return fmt.Errorf("policy (%s) is an invalid JSON: %w", policyToSet, err)
+	}
+
+	if err := d.Set("policy", policyToSet); err != nil {
 		return err
 	}
+
 	if err := d.Set("bucket", d.Id()); err != nil {
 		return err
 	}