Fix aws_elasticache_replication_group recreation on import

.changelog/39591.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix `security_group_names` causing resource replacement after import
+```

internal/service/elasticache/cluster_test.go

@@ -1245,10 +1245,10 @@ func TestAccElastiCacheCluster_tagWithOtherModification(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_versionAndTag(rName, "5.0.4", acctest.CtKey1, acctest.CtValue1),
+				Config: testAccClusterConfig_versionAndTag(rName, "5.0.5", acctest.CtKey1, acctest.CtValue1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					resource.TestCheckResourceAttr(resourceName, names.AttrEngineVersion, "5.0.4"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrEngineVersion, "5.0.5"),
 					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct1),
 					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsKey1, acctest.CtValue1),
 					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsAllPercent, acctest.Ct1),

internal/service/elasticache/flex.go

@@ -10,6 +10,12 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+func flattenSecurityGroupNames(apiObjects []awstypes.CacheSecurityGroupMembership) []string {
+	return tfslices.ApplyToAll(apiObjects, func(v awstypes.CacheSecurityGroupMembership) string {
+		return aws.ToString(v.CacheSecurityGroupName)
+	})
+}
+
 func flattenSecurityGroupIDs(apiObjects []awstypes.SecurityGroupMembership) []string {
 	return tfslices.ApplyToAll(apiObjects, func(v awstypes.SecurityGroupMembership) string {
 		return aws.ToString(v.SecurityGroupId)

internal/service/elasticache/replication_group.go

@@ -755,6 +755,13 @@ func resourceReplicationGroupRead(ctx context.Context, d *schema.ResourceData, m
 		}
 
 		d.Set("at_rest_encryption_enabled", c.AtRestEncryptionEnabled)
+		// `aws_elasticache_cluster` resource doesn't define `security_group_names`, but `aws_elasticache_replication_group` does.
+		// The value for that comes from []CacheSecurityGroupMembership which is part of CacheCluster object in AWS API.
+		// We need to set it here, as it is not set in setFromCacheCluster, and we cannot add it to that function
+		// without adding `security_group_names` property to `aws_elasticache_cluster` resource.
+		// This fixes the issue when importing `aws_elasticache_replication_group` where Terraform decides to recreate the imported cluster,
+		// because of `security_group_names` is not set and is "(known after apply)"
+		d.Set("security_group_names", flattenSecurityGroupNames(c.CacheSecurityGroups))
 		d.Set("transit_encryption_enabled", c.TransitEncryptionEnabled)
 		d.Set("transit_encryption_mode", c.TransitEncryptionMode)
 

internal/service/elasticache/replication_group_test.go

@@ -18,7 +18,11 @@ import (
 	awstypes "github.com/aws/aws-sdk-go-v2/service/elasticache/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfelasticache "github.com/hashicorp/terraform-provider-aws/internal/service/elasticache"
@@ -700,15 +704,28 @@ func TestAccElastiCacheReplicationGroup_vpc(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccReplicationGroupConfig_inVPC(rName),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionCreate),
+					},
+				},
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("num_cache_clusters"), knownvalue.Int64Exact(1)),
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("preferred_cache_cluster_azs"), knownvalue.ListSizeExact(1)),
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("security_group_ids"), knownvalue.SetSizeExact(1)),
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("security_group_names"), knownvalue.SetSizeExact(0)),
+				},
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &rg),
-					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", acctest.Ct1),
-					resource.TestCheckResourceAttr(resourceName, "preferred_cache_cluster_azs.#", acctest.Ct1),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
+				ResourceName: resourceName,
+				ImportState:  true,
+				ImportStateCheck: acctest.ComposeAggregateImportStateCheckFunc(
+					acctest.ImportCheckResourceAttr("security_group_ids.#", acctest.Ct1),
+					acctest.ImportCheckResourceAttr("security_group_names.#", acctest.Ct0),
+				),
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{names.AttrApplyImmediately, "auth_token_update_strategy", "preferred_cache_cluster_azs"},
 			},
@@ -2245,10 +2262,10 @@ func TestAccElastiCacheReplicationGroup_tagWithOtherModification(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationGroupConfig_versionAndTag(rName, "5.0.4", acctest.CtKey1, acctest.CtValue1),
+				Config: testAccReplicationGroupConfig_versionAndTag(rName, "5.0.5", acctest.CtKey1, acctest.CtValue1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &rg),
-					resource.TestCheckResourceAttr(resourceName, names.AttrEngineVersion, "5.0.4"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrEngineVersion, "5.0.5"),
 					testAccReplicationGroupCheckMemberClusterTags(resourceName, clusterDataSourcePrefix, 2, []kvp{
 						{acctest.CtKey1, acctest.CtValue1},
 					}),