From aed44a1bea44ff43c73ad7d345cf1bdf485a3aff Mon Sep 17 00:00:00 2001
From: EC2 Default User <ec2-user@ip-172-31-89-23.ec2.internal>
Date: Sun, 14 May 2023 10:13:17 +0000
Subject: [PATCH 1/5] Added managed execution config to stacksets

---
 .changelog/25210.txt                          |  3 ++
 internal/service/cloudformation/stack_set.go  | 53 +++++++++++++++++++
 .../service/cloudformation/stack_set_test.go  |  6 +++
 .../r/cloudformation_stack_set.html.markdown  |  2 +
 4 files changed, 64 insertions(+)
 create mode 100644 .changelog/25210.txt

diff --git a/.changelog/25210.txt b/.changelog/25210.txt
new file mode 100644
index 000000000000..55c0476e12a0
--- /dev/null
+++ b/.changelog/25210.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudformation_stack_set: Add `managed_execution` argument
+```
\ No newline at end of file
diff --git a/internal/service/cloudformation/stack_set.go b/internal/service/cloudformation/stack_set.go
index c368f17b5948..83c8d025055d 100644
--- a/internal/service/cloudformation/stack_set.go
+++ b/internal/service/cloudformation/stack_set.go
@@ -97,6 +97,20 @@ func ResourceStackSet() *schema.Resource {
 				Computed:      true,
 				ConflictsWith: []string{"auto_deployment"},
 			},
+			"managed_execution": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"active": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+					},
+				},
+			},
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -221,6 +235,10 @@ func resourceStackSetCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.ExecutionRoleName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("managed_execution"); ok {
+		input.ManagedExecution = expandManagedExecution(v.([]interface{}))
+	}
+
 	if v, ok := d.GetOk("parameters"); ok {
 		input.Parameters = expandParameters(v.(map[string]interface{}))
 	}
@@ -283,6 +301,11 @@ func resourceStackSetRead(ctx context.Context, d *schema.ResourceData, meta inte
 
 	d.Set("description", stackSet.Description)
 	d.Set("execution_role_name", stackSet.ExecutionRoleName)
+
+	if err := d.Set("managed_execution", flattenStackSetManagedExecution(stackSet.ManagedExecution)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting managed_execution: %s", err)
+	}
+
 	d.Set("name", stackSet.StackSetName)
 	d.Set("permission_model", stackSet.PermissionModel)
 
@@ -326,6 +349,10 @@ func resourceStackSetUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		input.ExecutionRoleName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("managed_execution"); ok {
+		input.ManagedExecution = expandManagedExecution(v.([]interface{}))
+	}
+
 	if v, ok := d.GetOk("operation_preferences"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		input.OperationPreferences = expandOperationPreferences(v.([]interface{})[0].(map[string]interface{}))
 	}
@@ -418,6 +445,20 @@ func expandAutoDeployment(l []interface{}) *cloudformation.AutoDeployment {
 	return autoDeployment
 }
 
+func expandManagedExecution(l []interface{}) *cloudformation.ManagedExecution {
+	if len(l) == 0 {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	managedExecution := &cloudformation.ManagedExecution{
+		Active: aws.Bool(m["active"].(bool)),
+	}
+
+	return managedExecution
+}
+
 func flattenStackSetAutoDeploymentResponse(autoDeployment *cloudformation.AutoDeployment) []map[string]interface{} {
 	if autoDeployment == nil {
 		return []map[string]interface{}{}
@@ -430,3 +471,15 @@ func flattenStackSetAutoDeploymentResponse(autoDeployment *cloudformation.AutoDe
 
 	return []map[string]interface{}{m}
 }
+
+func flattenStackSetManagedExecution(managedExecution *cloudformation.ManagedExecution) []map[string]interface{} {
+	if managedExecution == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"active": aws.BoolValue(managedExecution.Active),
+	}
+
+	return []map[string]interface{}{m}
+}
diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index e48ddcdab96e..fbce5c812ceb 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -41,6 +41,8 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "call_as", "SELF"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "execution_role_name", "AWSCloudFormationStackSetExecutionRole"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.0.active", "true"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),
@@ -1129,6 +1131,10 @@ resource "aws_cloudformation_stack_set" "test" {
   administration_role_arn = aws_iam_role.test.arn
   name                    = %[1]q
 
+  managed_execution {
+	active = true
+  }
+
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
diff --git a/website/docs/r/cloudformation_stack_set.html.markdown b/website/docs/r/cloudformation_stack_set.html.markdown
index c88d754bbc79..875155af1e0f 100644
--- a/website/docs/r/cloudformation_stack_set.html.markdown
+++ b/website/docs/r/cloudformation_stack_set.html.markdown
@@ -97,6 +97,8 @@ The following arguments are supported:
 * `operation_preferences` - (Optional) Preferences for how AWS CloudFormation performs a stack set update.
 * `description` - (Optional) Description of the StackSet.
 * `execution_role_name` - (Optional) Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.
+* `managed_execution` - (Optional) Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
+    * `active` - (Optional) When set to true, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. Default is false.
 * `parameters` - (Optional) Key-value map of input parameters for the StackSet template. All template parameters, including those with a `Default`, must be configured or ignored with `lifecycle` configuration block `ignore_changes` argument. All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignore_changes` argument.
 * `permission_model` - (Optional) Describes how the IAM roles required for your StackSet are created. Valid values: `SELF_MANAGED` (default), `SERVICE_MANAGED`.
 * `call_as` - (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.

From 8aa0df95950ee5499c1339359fd7770f055207bf Mon Sep 17 00:00:00 2001
From: EC2 Default User <ec2-user@ip-172-31-89-23.ec2.internal>
Date: Sun, 14 May 2023 10:39:37 +0000
Subject: [PATCH 2/5] fix linting issues

---
 internal/service/cloudformation/stack_set_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index fbce5c812ceb..6a1f4a4c2ca1 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -1132,7 +1132,7 @@ resource "aws_cloudformation_stack_set" "test" {
   name                    = %[1]q
 
   managed_execution {
-	active = true
+    active = true
   }
 
   template_body = <<TEMPLATE

From 0f20dd26f81717c1e99b9f21b540f54bd5e7ecb4 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Fri, 19 May 2023 13:53:22 -0400
Subject: [PATCH 3/5] r/aws_cloudformation_stack_set: Tidy up acceptance tests.

---
 internal/service/cloudformation/stack_set.go  |   3 +-
 .../service/cloudformation/stack_set_test.go  | 633 ++++--------------
 internal/service/cloudformation/wait.go       |   5 -
 3 files changed, 142 insertions(+), 499 deletions(-)

diff --git a/internal/service/cloudformation/stack_set.go b/internal/service/cloudformation/stack_set.go
index 83c8d025055d..85e155e6f986 100644
--- a/internal/service/cloudformation/stack_set.go
+++ b/internal/service/cloudformation/stack_set.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"log"
 	"regexp"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
@@ -35,7 +36,7 @@ func ResourceStackSet() *schema.Resource {
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Update: schema.DefaultTimeout(StackSetUpdatedDefaultTimeout),
+			Update: schema.DefaultTimeout(30 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index 6a1f4a4c2ca1..e81ec8a09d69 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -22,7 +22,7 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var stackSet1 cloudformation.StackSet
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	iamRoleResourceName := "aws_iam_role.test"
+	iamRoleResourceName := "aws_iam_role.test.0"
 	resourceName := "aws_cloudformation_stack_set.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -41,8 +41,7 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "call_as", "SELF"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "execution_role_name", "AWSCloudFormationStackSetExecutionRole"),
-					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "managed_execution.0.active", "true"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),
@@ -94,8 +93,8 @@ func TestAccCloudFormationStackSet_administrationRoleARN(t *testing.T) {
 	ctx := acctest.Context(t)
 	var stackSet1, stackSet2 cloudformation.StackSet
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	iamRoleResourceName1 := "aws_iam_role.test1"
-	iamRoleResourceName2 := "aws_iam_role.test2"
+	iamRole1ResourceName := "aws_iam_role.test.0"
+	iamRole2ResourceName := "aws_iam_role.test.1"
 	resourceName := "aws_cloudformation_stack_set.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -108,7 +107,7 @@ func TestAccCloudFormationStackSet_administrationRoleARN(t *testing.T) {
 				Config: testAccStackSetConfig_administrationRoleARN1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
-					resource.TestCheckResourceAttrPair(resourceName, "administration_role_arn", iamRoleResourceName1, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "administration_role_arn", iamRole1ResourceName, "arn"),
 				),
 			},
 			{
@@ -125,7 +124,7 @@ func TestAccCloudFormationStackSet_administrationRoleARN(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet2),
 					testAccCheckStackSetNotRecreated(&stackSet1, &stackSet2),
-					resource.TestCheckResourceAttrPair(resourceName, "administration_role_arn", iamRoleResourceName2, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "administration_role_arn", iamRole2ResourceName, "arn"),
 				),
 			},
 		},
@@ -212,6 +211,39 @@ func TestAccCloudFormationStackSet_executionRoleName(t *testing.T) {
 	})
 }
 
+func TestAccCloudFormationStackSet_managedExecution(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stackSet1 cloudformation.StackSet
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack_set.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckStackSet(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackSetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackSetConfig_managedExecution(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.0.active", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"call_as",
+					"template_url",
+				},
+			},
+		},
+	})
+}
+
 func TestAccCloudFormationStackSet_name(t *testing.T) {
 	ctx := acctest.Context(t)
 	var stackSet1, stackSet2 cloudformation.StackSet
@@ -581,11 +613,11 @@ func TestAccCloudFormationStackSet_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckStackSetDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccStackSetConfig_tags1(rName, "value1"),
+				Config: testAccStackSetConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -598,21 +630,21 @@ func TestAccCloudFormationStackSet_tags(t *testing.T) {
 				},
 			},
 			{
-				Config: testAccStackSetConfig_tags2(rName, "value1updated", "value2"),
+				Config: testAccStackSetConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet2),
 					testAccCheckStackSetNotRecreated(&stackSet1, &stackSet2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccStackSetConfig_tags1(rName, "value1updated"),
+				Config: testAccStackSetConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
@@ -910,32 +942,11 @@ Outputs:
 `, rName)
 }
 
-func testAccStackSetConfig_administrationRoleARN1(rName string) string {
+func testAccStackSetConfig_baseAdministrationRoleARNs(rName string, count int) string {
 	return fmt.Sprintf(`
-resource "aws_iam_role" "test1" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = "%[1]s1"
-}
+resource "aws_iam_role" "test" {
+  count = %[2]d
 
-resource "aws_iam_role" "test2" {
   assume_role_policy = <<EOF
 {
   "Version": "2012-10-17",
@@ -955,106 +966,41 @@ resource "aws_iam_role" "test2" {
 }
 EOF
 
-  name = "%[1]s2"
+  name = "%[1]s-${count.index}"
+}
+`, rName, count)
 }
 
+func testAccStackSetConfig_administrationRoleARN1(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 2), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test1.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName))
+`, rName, testAccStackSetTemplateBodyVPC(rName)))
 }
 
 func testAccStackSetConfig_administrationRoleARN2(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test1" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = "%[1]s1"
-}
-
-resource "aws_iam_role" "test2" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = "%[1]s2"
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 2), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test2.arn
+  administration_role_arn = aws_iam_role.test[1].arn
   name                    = %[1]q
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName))
+`, rName, testAccStackSetTemplateBodyVPC(rName)))
 }
 
 func testAccStackSetConfig_description(rName, description string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   description             = %[3]q
   name                    = %[1]q
 
@@ -1062,36 +1008,13 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName), description)
+`, rName, testAccStackSetTemplateBodyVPC(rName), description))
 }
 
 func testAccStackSetConfig_executionRoleName(rName, executionRoleName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   execution_role_name     = %[3]q
   name                    = %[1]q
 
@@ -1099,36 +1022,13 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName), executionRoleName)
-}
-
-func testAccStackSetConfig_name(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
+`, rName, testAccStackSetTemplateBodyVPC(rName), executionRoleName))
 }
 
+func testAccStackSetConfig_managedExecution(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   managed_execution {
@@ -1139,36 +1039,26 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName))
+`, rName, testAccStackSetTemplateBodyVPC(rName)))
 }
 
-func testAccStackSetConfig_parameters1(rName, value1 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
+func testAccStackSetConfig_name(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
+resource "aws_cloudformation_stack_set" "test" {
+  administration_role_arn = aws_iam_role.test[0].arn
+  name                    = %[1]q
 
-  name = %[1]q
+  template_body = <<TEMPLATE
+%[2]s
+TEMPLATE
+}
+`, rName, testAccStackSetTemplateBodyVPC(rName)))
 }
 
+func testAccStackSetConfig_parameters1(rName, value1 string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   parameters = {
@@ -1179,36 +1069,13 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyParameters1(rName), value1)
+`, rName, testAccStackSetTemplateBodyParameters1(rName), value1))
 }
 
 func testAccStackSetConfig_parameters2(rName, value1, value2 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   parameters = {
@@ -1220,72 +1087,26 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyParameters2(rName), value1, value2)
+`, rName, testAccStackSetTemplateBodyParameters2(rName), value1, value2))
 }
 
 func testAccStackSetConfig_parametersDefault0(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyParametersDefault1(rName))
+`, rName, testAccStackSetTemplateBodyParametersDefault1(rName)))
 }
 
 func testAccStackSetConfig_parametersDefault1(rName, value1 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   parameters = {
@@ -1296,36 +1117,13 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyParametersDefault1(rName), value1)
+`, rName, testAccStackSetTemplateBodyParametersDefault1(rName), value1))
 }
 
 func testAccStackSetConfig_parametersNoEcho1(rName, value1 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   parameters = {
@@ -1336,151 +1134,59 @@ resource "aws_cloudformation_stack_set" "test" {
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyParametersNoEcho1(rName), value1)
-}
-
-func testAccStackSetConfig_tags1(rName, value1 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
+`, rName, testAccStackSetTemplateBodyParametersNoEcho1(rName), value1))
 }
 
+func testAccStackSetConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   tags = {
-    Key1 = %[3]q
+    %[3]q = %[4]q
   }
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName), value1)
-}
-
-func testAccStackSetConfig_tags2(rName, value1, value2 string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
+`, rName, testAccStackSetTemplateBodyVPC(rName), tagKey1, tagValue1))
 }
 
+func testAccStackSetConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   tags = {
-    Key1 = %[3]q
-    Key2 = %[4]q
+    %[3]q = %[4]q
+    %[5]q = %[6]q
   }
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName), value1, value2)
+`, rName, testAccStackSetTemplateBodyVPC(rName), tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
 func testAccStackSetConfig_templateBody(rName, templateBody string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   template_body = <<TEMPLATE
 %[2]s
 TEMPLATE
 }
-`, rName, templateBody)
-}
-
-func testAccStackSetConfig_templateURL1(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
+`, rName, templateBody))
 }
 
+func testAccStackSetConfig_baseTemplateURL(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
@@ -1488,8 +1194,23 @@ resource "aws_s3_bucket" "test" {
 resource "aws_s3_bucket_acl" "test" {
   bucket = aws_s3_bucket.test.id
   acl    = "public-read"
+
+  depends_on = [aws_s3_bucket_public_access_block.test]
+}
+
+resource "aws_s3_bucket_public_access_block" "test" {
+  bucket = aws_s3_bucket.test.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+`, rName))
 }
 
+func testAccStackSetConfig_templateURL1(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetConfig_baseTemplateURL(rName), fmt.Sprintf(`
 resource "aws_s3_object" "test" {
   acl    = "public-read"
   bucket = aws_s3_bucket.test.bucket
@@ -1499,50 +1220,20 @@ resource "aws_s3_object" "test" {
 CONTENT
 
   key = "%[1]s-template1.yml"
+
+  depends_on = [aws_s3_bucket_acl.test]
 }
 
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
   template_url            = "https://${aws_s3_bucket.test.bucket_regional_domain_name}/${aws_s3_object.test.key}"
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName+"1"))
+`, rName, testAccStackSetTemplateBodyVPC(rName+"1")))
 }
 
 func testAccStackSetConfig_templateURL2(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "public-read"
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseTemplateURL(rName), fmt.Sprintf(`
 resource "aws_s3_object" "test" {
   acl    = "public-read"
   bucket = aws_s3_bucket.test.bucket
@@ -1552,6 +1243,8 @@ resource "aws_s3_object" "test" {
 CONTENT
 
   key = "%[1]s-template2.yml"
+
+  depends_on = [aws_s3_bucket_acl.test]
 }
 
 resource "aws_cloudformation_stack_set" "test" {
@@ -1559,7 +1252,7 @@ resource "aws_cloudformation_stack_set" "test" {
   name                    = %[1]q
   template_url            = "https://${aws_s3_bucket.test.bucket_regional_domain_name}/${aws_s3_object.test.key}"
 }
-`, rName, testAccStackSetTemplateBodyVPC(rName+"2"))
+`, rName, testAccStackSetTemplateBodyVPC(rName+"2")))
 }
 
 func testAccStackSetConfig_permissionModel(rName string) string {
@@ -1581,32 +1274,9 @@ TEMPLATE
 }
 
 func testAccStackSetConfig_operationPreferences(rName string, failureToleranceCount, maxConcurrentCount int) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   operation_preferences {
@@ -1618,36 +1288,13 @@ resource "aws_cloudformation_stack_set" "test" {
 %[4]s
 TEMPLATE
 }
-`, rName, failureToleranceCount, maxConcurrentCount, testAccStackSetTemplateBodyVPC(rName))
+`, rName, failureToleranceCount, maxConcurrentCount, testAccStackSetTemplateBodyVPC(rName)))
 }
 
 func testAccStackSetConfig_operationPreferencesUpdated(rName string, failureTolerancePercentage, maxConcurrentPercentage int) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Service": [
-          "cloudformation.amazonaws.com"
-        ]
-      },
-      "Action": [
-        "sts:AssumeRole"
-      ]
-    }
-  ]
-}
-EOF
-
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccStackSetConfig_baseAdministrationRoleARNs(rName, 1), fmt.Sprintf(`
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
 
   operation_preferences {
@@ -1659,5 +1306,5 @@ resource "aws_cloudformation_stack_set" "test" {
 %[4]s
 TEMPLATE
 }
-`, rName, failureTolerancePercentage, maxConcurrentPercentage, testAccStackSetTemplateBodyVPC(rName))
+`, rName, failureTolerancePercentage, maxConcurrentPercentage, testAccStackSetTemplateBodyVPC(rName)))
 }
diff --git a/internal/service/cloudformation/wait.go b/internal/service/cloudformation/wait.go
index 073bf2e41b85..597e73190a80 100644
--- a/internal/service/cloudformation/wait.go
+++ b/internal/service/cloudformation/wait.go
@@ -51,11 +51,6 @@ const (
 	stackSetOperationDelay = 5 * time.Second
 )
 
-const (
-	// Default maximum amount of time to wait for a StackSet to be Updated
-	StackSetUpdatedDefaultTimeout = 30 * time.Minute
-)
-
 func WaitStackSetOperationSucceeded(ctx context.Context, conn *cloudformation.CloudFormation, stackSetName, operationID, callAs string, timeout time.Duration) (*cloudformation.StackSetOperation, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{cloudformation.StackSetOperationStatusRunning, cloudformation.StackSetOperationStatusQueued},

From e85db491946fd7478de955eb6974977791e35434 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Fri, 19 May 2023 14:01:52 -0400
Subject: [PATCH 4/5] r/aws_cloudformation_stack_set: Handle missing
 'managed_execution' block.

---
 internal/service/cloudformation/stack_set.go      | 1 +
 internal/service/cloudformation/stack_set_test.go | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/service/cloudformation/stack_set.go b/internal/service/cloudformation/stack_set.go
index 85e155e6f986..d67f3d591b71 100644
--- a/internal/service/cloudformation/stack_set.go
+++ b/internal/service/cloudformation/stack_set.go
@@ -111,6 +111,7 @@ func ResourceStackSet() *schema.Resource {
 						},
 					},
 				},
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 			},
 			"name": {
 				Type:     schema.TypeString,
diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index e81ec8a09d69..5f012cb7165d 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -41,7 +41,8 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "call_as", "SELF"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "execution_role_name", "AWSCloudFormationStackSetExecutionRole"),
-					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "managed_execution.0.active", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),

From dbfaff5ed3781eb8f01a2a3c0e2e9279c0329f18 Mon Sep 17 00:00:00 2001
From: Kit Ewbank <Kit_Ewbank@hotmail.com>
Date: Fri, 19 May 2023 14:27:34 -0400
Subject: [PATCH 5/5] r/aws_cloudformation_stack_set: Acceptance test
 corrections.

---
 .../service/cloudformation/stack_set_test.go  | 34 +++++++++++--------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index 5f012cb7165d..ebe65ff57bd9 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -648,13 +648,6 @@ func TestAccCloudFormationStackSet_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
-			{
-				Config: testAccStackSetConfig_name(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-				),
-			},
 		},
 	})
 }
@@ -1192,13 +1185,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "public-read"
-
-  depends_on = [aws_s3_bucket_public_access_block.test]
-}
-
 resource "aws_s3_bucket_public_access_block" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -1207,6 +1193,24 @@ resource "aws_s3_bucket_public_access_block" "test" {
   ignore_public_acls      = false
   restrict_public_buckets = false
 }
+
+resource "aws_s3_bucket_ownership_controls" "test" {
+  bucket = aws_s3_bucket.test.id
+
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
+resource "aws_s3_bucket_acl" "test" {
+  bucket = aws_s3_bucket.test.id
+  acl    = "public-read"
+
+  depends_on = [
+    aws_s3_bucket_public_access_block.test,
+    aws_s3_bucket_ownership_controls.test,
+  ]
+}
 `, rName))
 }
 
@@ -1249,7 +1253,7 @@ CONTENT
 }
 
 resource "aws_cloudformation_stack_set" "test" {
-  administration_role_arn = aws_iam_role.test.arn
+  administration_role_arn = aws_iam_role.test[0].arn
   name                    = %[1]q
   template_url            = "https://${aws_s3_bucket.test.bucket_regional_domain_name}/${aws_s3_object.test.key}"
 }