resource/aws_cloudfront_key_group - new resource (#17041)

Output from acceptance testing in AWS Commercial:

```
--- PASS: TestAccAWSCloudFrontKeyGroup_disappears (10.83s)
--- PASS: TestAccAWSCloudFrontKeyGroup_basic (12.39s)
--- PASS: TestAccAWSCloudFrontKeyGroup_Comment (19.26s)
--- PASS: TestAccAWSCloudFrontKeyGroup_Items (19.63s)
```

Output from acceptance testing in AWS GovCloud (US):

```
--- SKIP: TestAccAWSCloudFrontKeyGroup_basic (1.33s)
--- SKIP: TestAccAWSCloudFrontKeyGroup_disappears (1.33s)
--- SKIP: TestAccAWSCloudFrontKeyGroup_Comment (1.33s)
--- SKIP: TestAccAWSCloudFrontKeyGroup_Items (1.33s)
```

.changelog/17041.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_cloudfront_key_group
+```

aws/provider.go

@@ -515,6 +515,7 @@ func Provider() *schema.Provider {
 			"aws_cloudformation_stack_set_instance":                   resourceAwsCloudFormationStackSetInstance(),
 			"aws_cloudfront_cache_policy":                             resourceAwsCloudFrontCachePolicy(),
 			"aws_cloudfront_distribution":                             resourceAwsCloudFrontDistribution(),
+			"aws_cloudfront_key_group":                                resourceAwsCloudFrontKeyGroup(),
 			"aws_cloudfront_origin_access_identity":                   resourceAwsCloudFrontOriginAccessIdentity(),
 			"aws_cloudfront_origin_request_policy":                    resourceAwsCloudFrontOriginRequestPolicy(),
 			"aws_cloudfront_public_key":                               resourceAwsCloudFrontPublicKey(),

aws/resource_aws_cloudfront_key_group.go

@@ -0,0 +1,144 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudfront"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func resourceAwsCloudFrontKeyGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsCloudFrontKeyGroupCreate,
+		Read:   resourceAwsCloudFrontKeyGroupRead,
+		Update: resourceAwsCloudFrontKeyGroupUpdate,
+		Delete: resourceAwsCloudFrontKeyGroupDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"comment": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"etag": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"items": {
+				Type:     schema.TypeSet,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+				Required: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceAwsCloudFrontKeyGroupCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudfrontconn
+
+	input := &cloudfront.CreateKeyGroupInput{
+		KeyGroupConfig: expandCloudFrontKeyGroupConfig(d),
+	}
+
+	log.Println("[DEBUG] Create CloudFront Key Group:", input)
+
+	output, err := conn.CreateKeyGroup(input)
+	if err != nil {
+		return fmt.Errorf("error creating CloudFront Key Group: %w", err)
+	}
+
+	if output == nil || output.KeyGroup == nil {
+		return fmt.Errorf("error creating CloudFront Key Group: empty response")
+	}
+
+	d.SetId(aws.StringValue(output.KeyGroup.Id))
+	return resourceAwsCloudFrontKeyGroupRead(d, meta)
+}
+
+func resourceAwsCloudFrontKeyGroupRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudfrontconn
+	input := &cloudfront.GetKeyGroupInput{
+		Id: aws.String(d.Id()),
+	}
+
+	output, err := conn.GetKeyGroup(input)
+	if err != nil {
+		if !d.IsNewResource() && isAWSErr(err, cloudfront.ErrCodeNoSuchResource, "") {
+			log.Printf("[WARN] No key group found: %s, removing from state", d.Id())
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("error reading CloudFront Key Group (%s): %w", d.Id(), err)
+	}
+
+	if output == nil || output.KeyGroup == nil || output.KeyGroup.KeyGroupConfig == nil {
+		return fmt.Errorf("error reading CloudFront Key Group: empty response")
+	}
+
+	keyGroupConfig := output.KeyGroup.KeyGroupConfig
+
+	d.Set("name", keyGroupConfig.Name)
+	d.Set("comment", keyGroupConfig.Comment)
+	d.Set("items", flattenStringSet(keyGroupConfig.Items))
+	d.Set("etag", output.ETag)
+
+	return nil
+}
+
+func resourceAwsCloudFrontKeyGroupUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudfrontconn
+
+	input := &cloudfront.UpdateKeyGroupInput{
+		Id:             aws.String(d.Id()),
+		KeyGroupConfig: expandCloudFrontKeyGroupConfig(d),
+		IfMatch:        aws.String(d.Get("etag").(string)),
+	}
+
+	_, err := conn.UpdateKeyGroup(input)
+	if err != nil {
+		return fmt.Errorf("error updating CloudFront Key Group (%s): %w", d.Id(), err)
+	}
+
+	return resourceAwsCloudFrontKeyGroupRead(d, meta)
+}
+
+func resourceAwsCloudFrontKeyGroupDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).cloudfrontconn
+
+	input := &cloudfront.DeleteKeyGroupInput{
+		Id:      aws.String(d.Id()),
+		IfMatch: aws.String(d.Get("etag").(string)),
+	}
+
+	_, err := conn.DeleteKeyGroup(input)
+	if err != nil {
+		if isAWSErr(err, cloudfront.ErrCodeNoSuchResource, "") {
+			return nil
+		}
+		return fmt.Errorf("error deleting CloudFront Key Group (%s): %w", d.Id(), err)
+	}
+
+	return nil
+}
+
+func expandCloudFrontKeyGroupConfig(d *schema.ResourceData) *cloudfront.KeyGroupConfig {
+	keyGroupConfig := &cloudfront.KeyGroupConfig{
+		Items: expandStringSet(d.Get("items").(*schema.Set)),
+		Name:  aws.String(d.Get("name").(string)),
+	}
+
+	if v, ok := d.GetOk("comment"); ok {
+		keyGroupConfig.Comment = aws.String(v.(string))
+	}
+
+	return keyGroupConfig
+}