#13994: Attempt to allow usage of service principals for KMS grants.

[RonaldTechnative]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #13994

Output from acceptance testing:

ronald@Ronalds-MacBook-Pro terraform-provider-aws % make testacc TESTS=TestAccKMSGrant_service PKG=kms
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20 -run='TestAccKMSGrant_service'  -timeout 180m
=== RUN   TestAccKMSGrant_service
=== PAUSE TestAccKMSGrant_service
=== CONT  TestAccKMSGrant_service
--- PASS: TestAccKMSGrant_service (27.00s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/kms        29.064s
ronald@Ronalds-MacBook-Pro terraform-provider-aws % make testacc TESTS=TestAccKMSGrant_basic PKG=kms  
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/kms/... -v -count 1 -parallel 20 -run='TestAccKMSGrant_basic'  -timeout 180m
=== RUN   TestAccKMSGrant_basic
=== PAUSE TestAccKMSGrant_basic
=== CONT  TestAccKMSGrant_basic
--- PASS: TestAccKMSGrant_basic (43.55s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/kms        45.616s
ronald@Ronalds-MacBook-Pro terraform-provider-aws % go test github.com/hashicorp/terraform-provider-aws/internal/verify
ok      github.com/hashicorp/terraform-provider-aws/internal/verify     0.360s
ronald@Ronalds-MacBook-Pro terraform-provider-aws % go test github.com/hashicorp/terraform-provider-aws/internal/service/kms

ok      github.com/hashicorp/terraform-provider-aws/internal/service/kms        2.053s
...

[github-actions]

Hey @RonaldTechnative 👋 Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's Allowing changes to a pull request branch created from a fork documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)

[github-actions]

Welcome @RonaldTechnative 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[RonaldTechnative]

Hey @RonaldTechnative 👋 Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's Allowing changes to a pull request branch created from a fork documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)

It appears that I'm unable to grant access to allow anyone here to push. I think we can work around by giving people write access to the forked repository which I'm ok with.

This is my first contribution so please let me know if I missed anything.

[im-dim]

Hello all,
When would it be released?
We are on v4.19.0 and can't grant access to encryption keys to services like "backup.us-east-1.amazonaws.com"...

[RonaldTechnative]

Hello all, When would it be released? We are on v4.19.0 and can't grant access to encryption keys to services like "backup.us-east-1.amazonaws.com"...

It appears that Hashicorp has a backlog on these issues and is prioritizing based on thumbs op on the main issue. Can you do that? I'm asking our customers to do the same 😄 .

[mad-it]

@ewbankkit sorry for pinging you directly, but it seems like you are the latest active contributor.
Is there any way this fix can be reviewed/merged? Its a small validation fix.

[mad-it]

@RonaldTechnative there is a small fix that needs to be made in reading the resource on this line: https://github.com/hashicorp/terraform-provider-aws/pull/25360/files#diff-d07eb791766a340751ea762e950c2b06b06d77a6dcb7112209a365745c765e7dR330

The read operation also needs to use the new ValidARNOrServicePrincipal.

[nam054]

Hey @RonaldTechnative 👋 Given the permissions difficulties, I've opened a separate pull request that covers this and a couple of other minor changes. With that in mind, we'll close this one out in favor of that one. Thank you for taking the time to contribute; we really appreciate it!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.