resource/aws_route53_vpc_association_authorization: Fix ConcurrentModification error

.changelog/31588.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route53_vpc_association_authorization: Fix `ConcurrentModification` error
+```

internal/service/route53/vpc_association_authorization.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_route53_vpc_association_authorization")
@@ -48,7 +49,7 @@ func ResourceVPCAssociationAuthorization() *schema.Resource {
 	}
 }
 
-func resourceVPCAssociationAuthorizationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceVPCAssociationAuthorizationCreate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).Route53Conn()
 
@@ -64,19 +65,22 @@ func resourceVPCAssociationAuthorizationCreate(ctx context.Context, d *schema.Re
 		req.VPC.VPCRegion = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating Route53 VPC Association Authorization for hosted zone %s with VPC %s and region %s", *req.HostedZoneId, *req.VPC.VPCId, *req.VPC.VPCRegion)
-	_, err := conn.CreateVPCAssociationAuthorizationWithContext(ctx, req)
+	raw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, d.Timeout(schema.TimeoutCreate), func() (any, error) {
+		return conn.CreateVPCAssociationAuthorizationWithContext(ctx, req)
+	}, route53.ErrCodeConcurrentModification)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating Route53 VPC Association Authorization: %s", err)
 	}
 
+	out := raw.(*route53.CreateVPCAssociationAuthorizationOutput)
+
 	// Store association id
-	d.SetId(fmt.Sprintf("%s:%s", *req.HostedZoneId, *req.VPC.VPCId))
+	d.SetId(fmt.Sprintf("%s:%s", aws.StringValue(out.HostedZoneId), aws.StringValue(out.VPC.VPCId)))
 
 	return append(diags, resourceVPCAssociationAuthorizationRead(ctx, d, meta)...)
 }
 
-func resourceVPCAssociationAuthorizationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceVPCAssociationAuthorizationRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).Route53Conn()
 
@@ -126,7 +130,7 @@ func resourceVPCAssociationAuthorizationRead(ctx context.Context, d *schema.Reso
 	return diags
 }
 
-func resourceVPCAssociationAuthorizationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceVPCAssociationAuthorizationDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).Route53Conn()
 
@@ -143,7 +147,9 @@ func resourceVPCAssociationAuthorizationDelete(ctx context.Context, d *schema.Re
 		},
 	}
 
-	_, err = conn.DeleteVPCAssociationAuthorizationWithContext(ctx, &req)
+	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, d.Timeout(schema.TimeoutCreate), func() (any, error) {
+		return conn.DeleteVPCAssociationAuthorizationWithContext(ctx, &req)
+	}, route53.ErrCodeConcurrentModification)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting Route53 VPC Association Authorization (%s): %s", d.Id(), err)
 	}

internal/service/route53/vpc_association_authorization_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -69,6 +70,35 @@ func TestAccRoute53VPCAssociationAuthorization_disappears(t *testing.T) {
 	})
 }
 
+func TestAccRoute53VPCAssociationAuthorization_concurrent(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	resourceNameAlternate := "aws_route53_vpc_association_authorization.alternate"
+	resourceNameThird := "aws_route53_vpc_association_authorization.third"
+
+	providers := make(map[string]*schema.Provider)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckAlternateAccount(t)
+			acctest.PreCheckThirdAccount(t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, route53.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesNamed(ctx, t, providers, acctest.ProviderName, acctest.ProviderNameAlternate, acctest.ProviderNameThird),
+		CheckDestroy:             testAccCheckVPCAssociationAuthorizationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCAssociationAuthorizationConfig_concurrent(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVPCAssociationAuthorizationExists(ctx, resourceNameAlternate),
+					testAccCheckVPCAssociationAuthorizationExists(ctx, resourceNameThird),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckVPCAssociationAuthorizationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).Route53Conn()
@@ -96,7 +126,7 @@ func testAccCheckVPCAssociationAuthorizationDestroy(ctx context.Context) resourc
 			}
 
 			for _, vpc := range res.VPCs {
-				if vpc_id == *vpc.VPCId {
+				if vpc_id == aws.StringValue(vpc.VPCId) {
 					return fmt.Errorf("VPC association authorization for zone %v with %v still exists", zone_id, vpc_id)
 				}
 			}
@@ -133,7 +163,7 @@ func testAccCheckVPCAssociationAuthorizationExists(ctx context.Context, n string
 		}
 
 		for _, vpc := range res.VPCs {
-			if vpc_id == *vpc.VPCId {
+			if vpc_id == aws.StringValue(vpc.VPCId) {
 				return nil
 			}
 		}
@@ -143,12 +173,60 @@ func testAccCheckVPCAssociationAuthorizationExists(ctx context.Context, n string
 }
 
 func testAccVPCAssociationAuthorizationConfig_basic() string {
-	return acctest.ConfigAlternateAccountProvider() + `
+	return acctest.ConfigCompose(
+		acctest.ConfigAlternateAccountProvider(), `
+resource "aws_route53_vpc_association_authorization" "test" {
+  zone_id = aws_route53_zone.test.id
+  vpc_id  = aws_vpc.alternate.id
+}
+
+resource "aws_vpc" "alternate" {
+  provider             = "awsalternate"
+  cidr_block           = "10.7.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+}
+
+resource "aws_route53_zone" "test" {
+  name = "example.com"
+
+  vpc {
+    vpc_id = aws_vpc.test.id
+  }
+}
+
 resource "aws_vpc" "test" {
   cidr_block           = "10.6.0.0/16"
   enable_dns_hostnames = true
   enable_dns_support   = true
 }
+`)
+}
+
+func testAccVPCAssociationAuthorizationConfig_concurrent(t *testing.T) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigMultipleAccountProvider(t, 3), `
+resource "aws_route53_vpc_association_authorization" "alternate" {
+  zone_id = aws_route53_zone.test.id
+  vpc_id  = aws_vpc.alternate.id
+
+  # Try to encourage concurrency
+  depends_on = [
+    aws_vpc.alternate,
+    aws_vpc.third
+  ]
+}
+
+resource "aws_route53_vpc_association_authorization" "third" {
+  zone_id = aws_route53_zone.test.id
+  vpc_id  = aws_vpc.third.id
+
+  # Try to encourage concurrency
+  depends_on = [
+    aws_vpc.alternate,
+    aws_vpc.third
+  ]
+}
 
 resource "aws_route53_zone" "test" {
   name = "example.com"
@@ -158,16 +236,24 @@ resource "aws_route53_zone" "test" {
   }
 }
 
+resource "aws_vpc" "test" {
+  cidr_block           = cidrsubnet("10.0.0.0/8", 8, 0)
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+}
+
 resource "aws_vpc" "alternate" {
   provider             = "awsalternate"
-  cidr_block           = "10.7.0.0/16"
+  cidr_block           = cidrsubnet("10.0.0.0/8", 8, 1)
   enable_dns_hostnames = true
   enable_dns_support   = true
 }
 
-resource "aws_route53_vpc_association_authorization" "test" {
-  zone_id = aws_route53_zone.test.id
-  vpc_id  = aws_vpc.alternate.id
+resource "aws_vpc" "third" {
+  provider             = "awsthird"
+  cidr_block           = cidrsubnet("10.0.0.0/8", 8, 2)
+  enable_dns_hostnames = true
+  enable_dns_support   = true
 }
-`
+`)
 }