Add ability to update AWS resource tags for SM and PS syncs

docs/resources/secrets_sync_aws_parameter_store.md

@@ -99,6 +99,7 @@ resource "doppler_secrets_sync_aws_parameter_store" "backend_prod" {
 - `kms_key_id` (String) The AWS KMS key used to encrypt the parameter (ID, Alias, or ARN)
 - `secure_string` (Boolean) Whether or not the parameters are stored as a secure string
 - `tags` (Map of String) AWS tags to attach to the parameters
+- `update_resource_tags` (String) Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))
 
 ### Read-Only
 

docs/resources/secrets_sync_aws_secrets_manager.md

@@ -95,6 +95,7 @@ resource "doppler_secrets_sync_aws_secrets_manager" "backend_prod" {
 - `path_behavior` (String) The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.
 - `tags` (Map of String) AWS tags to attach to the secrets
 - `update_metadata` (Boolean) If enabled, Doppler will update the AWS secret metadata (e.g. KMS key) during every sync. If disabled, Doppler will only set secret metadata for new AWS secrets. Note that Doppler never updates tags for existing AWS secrets.
+- `update_resource_tags` (String) Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))
 
 ### Read-Only
 

doppler/resource_sync_types.go

@@ -41,6 +41,24 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 				Optional:    true,
 				ForceNew:    true,
 			},
+
+			"update_resource_tags": {
+				Description:  "Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"never", "upsert", "replace"}, false),
+				DiffSuppressFunc: func(k, oldValue, newValue string, d *schema.ResourceData) bool {
+					if oldValue == "" && newValue == "never" {
+						return true
+					} else if oldValue == "never" && newValue == "" {
+						return true
+					} else {
+						return newValue == oldValue
+					}
+				},
+			},
+
 			"path_behavior": {
 				Description: "The behavior to modify the provided path. Either `add_doppler_suffix` (default) which appends `doppler` to the provided path or `none` which leaves the path unchanged.",
 				Type:        schema.TypeString,
@@ -73,6 +91,9 @@ func resourceSyncAWSSecretsManager() *schema.Resource {
 			if updateMetadata, ok := d.GetOk("update_metadata"); ok {
 				payload["update_metadata"] = updateMetadata
 			}
+			if updateResourceTags, ok := d.GetOk("update_resource_tags"); ok {
+				payload["update_resource_tags"] = updateResourceTags
+			}
 			if pathBehavior, ok := d.GetOk("path_behavior"); ok {
 				payload["use_doppler_suffix"] = pathBehavior == "add_doppler_suffix"
 			} else {
@@ -121,6 +142,22 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 			},
+			"update_resource_tags": {
+				Description:  "Behavior for AWS resource tags on updates (never update, upsert tags (leaving non-Doppler tags alone), replace tags (remove non-Doppler tags))",
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"never", "upsert", "replace"}, false),
+				DiffSuppressFunc: func(k, oldValue, newValue string, d *schema.ResourceData) bool {
+					if oldValue == "" && newValue == "never" {
+						return true
+					} else if oldValue == "never" && newValue == "" {
+						return true
+					} else {
+						return newValue == oldValue
+					}
+				},
+			},
 		},
 		DataBuilder: func(d *schema.ResourceData) IntegrationData {
 			payload := map[string]interface{}{
@@ -132,6 +169,9 @@ func resourceSyncAWSParameterStore() *schema.Resource {
 			if kmsKeyId, ok := d.GetOk("kms_key_id"); ok {
 				payload["kms_key_id"] = kmsKeyId
 			}
+			if updateResourceTags, ok := d.GetOk("update_resource_tags"); ok {
+				payload["update_resource_tags"] = updateResourceTags
+			}
 			return payload
 		},
 	}