r/shield_protection_group: use protection_group_arn parameter when updating tags

.changelog/24296.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_shield_protection_group: When updating resource tags, use the `protection_group_arn` parameter instead of `arn`.
+```

internal/service/shield/protection_group.go

@@ -163,30 +163,32 @@ func resourceProtectionGroupRead(d *schema.ResourceData, meta interface{}) error
 func resourceProtectionGroupUpdate(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).ShieldConn
 
-	input := &shield.UpdateProtectionGroupInput{
-		Aggregation:       aws.String(d.Get("aggregation").(string)),
-		Pattern:           aws.String(d.Get("pattern").(string)),
-		ProtectionGroupId: aws.String(d.Id()),
-	}
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &shield.UpdateProtectionGroupInput{
+			Aggregation:       aws.String(d.Get("aggregation").(string)),
+			Pattern:           aws.String(d.Get("pattern").(string)),
+			ProtectionGroupId: aws.String(d.Id()),
+		}
 
-	if v, ok := d.GetOk("members"); ok {
-		input.Members = flex.ExpandStringList(v.([]interface{}))
-	}
+		if v, ok := d.GetOk("members"); ok {
+			input.Members = flex.ExpandStringList(v.([]interface{}))
+		}
 
-	if v, ok := d.GetOk("resource_type"); ok {
-		input.ResourceType = aws.String(v.(string))
-	}
+		if v, ok := d.GetOk("resource_type"); ok {
+			input.ResourceType = aws.String(v.(string))
+		}
 
-	log.Printf("[DEBUG] Updating Shield Protection Group: %s", input)
-	_, err := conn.UpdateProtectionGroup(input)
+		log.Printf("[DEBUG] Updating Shield Protection Group: %s", input)
+		_, err := conn.UpdateProtectionGroup(input)
 
-	if err != nil {
-		return fmt.Errorf("error updating Shield Protection Group (%s): %w", d.Id(), err)
+		if err != nil {
+			return fmt.Errorf("error updating Shield Protection Group (%s): %w", d.Id(), err)
+		}
 	}
 
 	if d.HasChange("tags_all") {
 		o, n := d.GetChange("tags_all")
-		if err := UpdateTags(conn, d.Get("arn").(string), o, n); err != nil {
+		if err := UpdateTags(conn, d.Get("protection_group_arn").(string), o, n); err != nil {
 			return fmt.Errorf("error updating tags: %w", err)
 		}
 	}

internal/service/shield/protection_group_test.go

@@ -238,6 +238,54 @@ func TestAccShieldProtectionGroup_resourceType(t *testing.T) {
 	})
 }
 
+func TestAccShieldProtectionGroup_tags(t *testing.T) {
+	resourceName := "aws_shield_protection_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(t)
+			acctest.PreCheckPartitionHasService(shield.EndpointsID, t)
+			testAccPreCheck(t)
+		},
+		ErrorCheck:   acctest.ErrorCheck(t, shield.EndpointsID),
+		Providers:    acctest.Providers,
+		CheckDestroy: testAccCheckProtectionGroupDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccShieldProtectionGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProtectionGroupExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccShieldProtectionGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProtectionGroupExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccShieldProtectionGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProtectionGroupExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckProtectionGroupDestroy(s *terraform.State) error {
 	conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn
 
@@ -334,3 +382,32 @@ resource "aws_shield_protection_group" "test" {
 }
 `, rName))
 }
+
+func testAccShieldProtectionGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_shield_protection_group" "test" {
+  protection_group_id = %[1]q
+  aggregation         = "MAX"
+  pattern             = "ALL"
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccShieldProtectionGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_shield_protection_group" "test" {
+  protection_group_id = %[1]q
+  aggregation         = "MAX"
+  pattern             = "ALL"
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}