allow changes to subscription_role_arn

hashicorp · Feb 25, 2021 · 6989024 · 6989024
1 parent 2842c5d
commit 6989024
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 5 deletions.
diff --git a/aws/resource_aws_sns_topic_subscription.go b/aws/resource_aws_sns_topic_subscription.go
@@ -102,7 +102,6 @@ func resourceAwsSnsTopicSubscription() *schema.Resource {
 			"subscription_role_arn": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
 			},
 		},
 	}
@@ -165,6 +164,21 @@ func resourceAwsSnsTopicSubscriptionUpdate(d *schema.ResourceData, meta interfac
 		}
 	}
 
+	if d.HasChange("subscription_role_arn") {
+		protocol := d.Get("protocol").(string)
+		subscription_role_arn := d.Get("subscription_role_arn").(string)
+		if strings.Contains(protocol, "firehose") && subscription_role_arn == "" {
+			return fmt.Errorf("Protocol firehose must contain subscription_role_arn!")
+		}
+		if !strings.Contains(protocol, "firehose") && subscription_role_arn != "" {
+			return fmt.Errorf("Only protocol firehose supports subscription_role_arn!")
+		}
+
+		if err := snsSubscriptionAttributeUpdate(snsconn, d.Id(), "SubscriptionRoleArn", subscription_role_arn); err != nil {
+			return err
+		}
+	}
+
 	return resourceAwsSnsTopicSubscriptionRead(d, meta)
 }
 

diff --git a/aws/resource_aws_sns_topic_subscription_test.go b/aws/resource_aws_sns_topic_subscription_test.go
@@ -372,7 +372,7 @@ func TestAccAWSSNSTopicSubscription_firehose(t *testing.T) {
 		CheckDestroy: testAccCheckAWSSNSTopicSubscriptionDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSSNSTopicSubscriptionConfig_firehose(ri),
+				Config: testAccAWSSNSTopicSubscriptionConfig_firehose(ri, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSNSTopicSubscriptionExists(resourceName, attributes),
 					testAccMatchResourceAttrRegionalARN(resourceName, "arn", "sns", regexp.MustCompile(fmt.Sprintf("terraform-test-topic-%d:.+", ri))),
@@ -394,6 +394,14 @@ func TestAccAWSSNSTopicSubscription_firehose(t *testing.T) {
 					"endpoint_auto_confirms",
 				},
 			},
+			// Test attribute update
+			{
+				Config: testAccAWSSNSTopicSubscriptionConfig_firehose(ri, 2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSNSTopicSubscriptionExists(resourceName, attributes),
+					resource.TestCheckResourceAttrPair(resourceName, "subscription_role_arn", "aws_iam_role.firehose_role", "arn"),
+				),
+			},
 		},
 	})
 }
@@ -941,7 +949,7 @@ resource "aws_sns_topic_subscription" "test_subscription" {
 `, i, i, i, i, i, i, i, i, i, username, password, username, password)
 }
 
-func testAccAWSSNSTopicSubscriptionConfig_firehose(i int) string {
+func testAccAWSSNSTopicSubscriptionConfig_firehose(i, n int) string {
 	return fmt.Sprintf(`
 resource "aws_sns_topic" "test_topic" {
   name = "terraform-test-topic-%d"
@@ -959,7 +967,7 @@ resource "aws_s3_bucket" "bucket" {
 }
 
 resource "aws_iam_role" "firehose_role" {
-  name = "tf-test-firehose-role-%d"
+  name = "tf-test-firehose-role-%d-%d"
 
   assume_role_policy = <<EOF
 {
@@ -987,5 +995,5 @@ resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
     bucket_arn = aws_s3_bucket.bucket.arn
   }
 }
-`, i, i, i, i)
+`, i, i, n, i, i)
 }