From dcf467fca5465f86de474b1bffd6e56427cf5631 Mon Sep 17 00:00:00 2001
From: jameogle <jg631@uowmail.edu.au>
Date: Sat, 24 Jul 2021 18:27:47 +1000
Subject: [PATCH 01/15] Add user_group_ids field to elasticache replication
 group

---
 .../service/elasticache/replication_group.go  | 35 +++++++++++++++++++
 .../elasticache/replication_group_test.go     | 15 ++++++++
 ...lasticache_replication_group.html.markdown |  1 +
 3 files changed, 51 insertions(+)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 1f5fff51d0e..cadcf3077f0 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -280,6 +280,15 @@ func ResourceReplicationGroup() *schema.Resource {
 				ForceNew: true,
 				Computed: true,
 			},
+			"user_group_ids": {
+				Type:       schema.TypeSet,
+				ConfigMode: 0,
+				Optional:   true,
+				Default:    nil,
+				Elem:       &schema.Schema{Type: schema.TypeString},
+				MaxItems:   1, //at the moment the aws sdk only supports 1 user group id to be associated with a cluster
+				Set:        schema.HashString,
+			},
 			"kms_key_id": {
 				Type:     schema.TypeString,
 				ForceNew: true,
@@ -435,6 +444,11 @@ func resourceReplicationGroupCreate(d *schema.ResourceData, meta interface{}) er
 	if cacheClusters, ok := d.GetOk("number_cache_clusters"); ok {
 		params.NumCacheClusters = aws.Int64(int64(cacheClusters.(int)))
 	}
+
+	if userGroupIds := d.Get("user_group_ids").(*schema.Set); userGroupIds.Len() > 0 {
+		params.UserGroupIds = expandStringSet(userGroupIds)
+	}
+
 	resp, err := conn.CreateReplicationGroup(params)
 	if err != nil {
 		return fmt.Errorf("error creating ElastiCache Replication Group (%s): %w", d.Get("replication_group_id").(string), err)
@@ -580,6 +594,8 @@ func resourceReplicationGroupRead(d *schema.ResourceData, meta interface{}) erro
 			d.Set("reader_endpoint_address", rgp.NodeGroups[0].ReaderEndpoint.Address)
 		}
 
+		d.Set("user_group_ids", rgp.UserGroupIds)
+
 		d.Set("auto_minor_version_upgrade", c.AutoMinorVersionUpgrade)
 		d.Set("at_rest_encryption_enabled", c.AtRestEncryptionEnabled)
 		d.Set("transit_encryption_enabled", c.TransitEncryptionEnabled)
@@ -688,6 +704,25 @@ func resourceReplicationGroupUpdate(d *schema.ResourceData, meta interface{}) er
 		requestUpdate = true
 	}
 
+	if d.HasChange("user_group_ids") {
+		old, new := d.GetChange("user_group_ids")
+		newSet := new.(*schema.Set)
+		oldSet := old.(*schema.Set)
+		add := newSet.Difference(oldSet)
+		remove := oldSet.Difference(newSet)
+
+		if add.Len() > 0 {
+			params.UserGroupIdsToAdd = expandStringSet(add)
+			requestUpdate = true
+		}
+
+		if remove.Len() > 0 {
+			params.UserGroupIdsToRemove = expandStringSet(remove)
+			requestUpdate = true
+		}
+
+	}
+
 	if requestUpdate {
 		_, err := conn.ModifyReplicationGroup(params)
 		if err != nil {
diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index 134e6a09999..cc2c6849566 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -2091,6 +2091,20 @@ resource "aws_security_group" "test" {
   }
 }
 
+resource "aws_elasticache_user" "test" {
+  user_id       = %[1]q
+  user_name     = "default"
+  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
+  engine        = "REDIS"
+  passwords     = ["password123456789"]
+}
+
+resource "aws_elasticache_user_group" "test" {
+  user_group_id = %[1]q
+  engine        = "REDIS"
+  user_ids      = [aws_elasticache_user.test.user_id]
+}
+
 resource "aws_elasticache_replication_group" "test" {
   replication_group_id          = %[1]q
   replication_group_description = "test description"
@@ -2101,6 +2115,7 @@ resource "aws_elasticache_replication_group" "test" {
   security_group_ids            = [aws_security_group.test.id]
   availability_zones            = [data.aws_availability_zones.available.names[0]]
   auto_minor_version_upgrade    = false
+	user_group_ids                = [aws_elasticache_user_group.test.id]
 }
 `, rName)
 }
diff --git a/website/docs/r/elasticache_replication_group.html.markdown b/website/docs/r/elasticache_replication_group.html.markdown
index 76af764131b..66db716ba93 100644
--- a/website/docs/r/elasticache_replication_group.html.markdown
+++ b/website/docs/r/elasticache_replication_group.html.markdown
@@ -175,6 +175,7 @@ The following arguments are optional:
 * `subnet_group_name` - (Optional) The name of the cache subnet group to be used for the replication group.
 * `tags` - (Optional) A map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_encryption_enabled` - (Optional) Whether to enable encryption in transit.
+* `user_group_ids` - (Optional) A list of User Group Ids to associate to the replication group.
 
 ### cluster_mode
 

From 0a4648a56c7152193ec010399f6473c473c8ffa5 Mon Sep 17 00:00:00 2001
From: jameogle <jg631@uowmail.edu.au>
Date: Tue, 3 Aug 2021 08:54:20 +1000
Subject: [PATCH 02/15] Add conflictswith field to ensure user can't try to use
 both types of auth

---
 .../service/elasticache/replication_group.go  | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index cadcf3077f0..8810019a8a3 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -52,10 +52,12 @@ func ResourceReplicationGroup() *schema.Resource {
 				Computed: true,
 			},
 			"auth_token": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Sensitive:    true,
-				ValidateFunc: validReplicationGroupAuthToken,
+				Type:          schema.TypeString,
+				Optional:      true,
+				Sensitive:     true,
+				ForceNew:      true,
+				ValidateFunc:  validReplicationGroupAuthToken,
+				ConflictsWith: []string{"user_group_ids"},
 			},
 			"auto_minor_version_upgrade": {
 				Type:     schema.TypeBool,
@@ -281,13 +283,13 @@ func ResourceReplicationGroup() *schema.Resource {
 				Computed: true,
 			},
 			"user_group_ids": {
-				Type:       schema.TypeSet,
-				ConfigMode: 0,
-				Optional:   true,
-				Default:    nil,
-				Elem:       &schema.Schema{Type: schema.TypeString},
-				MaxItems:   1, //at the moment the aws sdk only supports 1 user group id to be associated with a cluster
-				Set:        schema.HashString,
+				Type:          schema.TypeSet,
+				Optional:      true,
+				Default:       nil,
+				Elem:          &schema.Schema{Type: schema.TypeString},
+				MaxItems:      1, //at the moment the aws sdk only supports 1 user group id to be associated with a cluster
+				Set:           schema.HashString,
+				ConflictsWith: []string{"auth_token"},
 			},
 			"kms_key_id": {
 				Type:     schema.TypeString,

From 372930bfee21e79c68ceef61954cf57c9c1bfc74 Mon Sep 17 00:00:00 2001
From: jamesglennan <jg631@uowmail.edu.au>
Date: Thu, 28 Oct 2021 00:40:37 +1100
Subject: [PATCH 03/15] Add changes to refactored elasticache code

---
 internal/service/elasticache/replication_group.go      | 6 +++---
 internal/service/elasticache/replication_group_test.go | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 8810019a8a3..59efd73b5c2 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -448,7 +448,7 @@ func resourceReplicationGroupCreate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	if userGroupIds := d.Get("user_group_ids").(*schema.Set); userGroupIds.Len() > 0 {
-		params.UserGroupIds = expandStringSet(userGroupIds)
+		params.UserGroupIds = flex.ExpandStringSet(userGroupIds)
 	}
 
 	resp, err := conn.CreateReplicationGroup(params)
@@ -714,12 +714,12 @@ func resourceReplicationGroupUpdate(d *schema.ResourceData, meta interface{}) er
 		remove := oldSet.Difference(newSet)
 
 		if add.Len() > 0 {
-			params.UserGroupIdsToAdd = expandStringSet(add)
+			params.UserGroupIdsToAdd = flex.ExpandStringSet(add)
 			requestUpdate = true
 		}
 
 		if remove.Len() > 0 {
-			params.UserGroupIdsToRemove = expandStringSet(remove)
+			params.UserGroupIdsToRemove = flex.ExpandStringSet(remove)
 			requestUpdate = true
 		}
 
diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index cc2c6849566..b26c7334298 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -2115,7 +2115,7 @@ resource "aws_elasticache_replication_group" "test" {
   security_group_ids            = [aws_security_group.test.id]
   availability_zones            = [data.aws_availability_zones.available.names[0]]
   auto_minor_version_upgrade    = false
-	user_group_ids                = [aws_elasticache_user_group.test.id]
+  user_group_ids                = [aws_elasticache_user_group.test.id]
 }
 `, rName)
 }

From e9e39352afa522a03af3c95db7a5679987ed3d80 Mon Sep 17 00:00:00 2001
From: James Glennan <jg631@uowmail.edu.au>
Date: Mon, 1 Nov 2021 14:45:10 +1100
Subject: [PATCH 04/15] Fixup tests for usergroup association

---
 .../elasticache/replication_group_test.go     | 125 +++++++++++++++---
 1 file changed, 110 insertions(+), 15 deletions(-)

diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index b26c7334298..493e5a9f00d 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -252,6 +252,45 @@ func TestAccElastiCacheReplicationGroup_updateMaintenanceWindow(t *testing.T) {
 	})
 }
 
+func TestAccElastiCacheReplicationGroup_updateUserGroups(t *testing.T) {
+	var rg elasticache.ReplicationGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	userGroup := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resourceName := "aws_elasticache_replication_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(t) },
+		ErrorCheck:   acctest.ErrorCheck(t, elasticache.EndpointsID),
+		Providers:    acctest.Providers,
+		CheckDestroy: testAccCheckReplicationDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationGroupUserGroup(rName, userGroup, 0),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationGroupExists(resourceName, &rg),
+					testAccCheckReplicationGroupUserGroup(resourceName, fmt.Sprintf("%s-%d", userGroup, 0)),
+					resource.TestCheckTypeSetElemAttr(resourceName, "user_group_ids.*", fmt.Sprintf("%s-%d", userGroup, 0)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately"},
+			},
+			{
+				Config: testAccReplicationGroupUserGroup(rName, userGroup, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationGroupExists(resourceName, &rg),
+					testAccCheckReplicationGroupUserGroup(resourceName, fmt.Sprintf("%s-%d", userGroup, 1)),
+					resource.TestCheckTypeSetElemAttr(resourceName, "user_group_ids.*", fmt.Sprintf("%s-%d", userGroup, 1)),
+				),
+			},
+		},
+	})
+}
+
 func TestAccElastiCacheReplicationGroup_updateNodeSize(t *testing.T) {
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1821,6 +1860,31 @@ func testAccCheckReplicationGroupMemberClusters(n string, v *map[string]*elastic
 	}
 }
 
+func testAccCheckReplicationGroupUserGroup(resourceName, userGroupID string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ElastiCacheConn
+		rg, err := tfelasticache.FindReplicationGroupByID(conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+		if len(rg.UserGroupIds) < 1 {
+			return fmt.Errorf("ElastiCache Replication Group (%s) was not assigned any usergroups", resourceName)
+		}
+
+		if *rg.UserGroupIds[0] != userGroupID {
+			return fmt.Errorf("ElastiCache Replication Group (%s) was not assigned usergroup (%s), usergroup was (%s) instead", resourceName, userGroupID, *rg.UserGroupIds[0])
+		}
+		return nil
+
+	}
+}
+
 func testAccCheckReplicationGroupRecreated(i, j *map[string]*elasticache.CacheCluster) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		for key, iv := range *i {
@@ -2043,6 +2107,52 @@ resource "aws_elasticache_replication_group" "test" {
 `, rName)
 }
 
+func testAccReplicationGroupUserGroup(rName, userGroup string, flag int) string {
+	return fmt.Sprintf(`
+resource "aws_elasticache_user" "test0" {
+  user_id       = "%[2]s-0"
+  user_name     = "default"
+  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
+  engine        = "REDIS"
+  passwords     = ["password123456789"]
+}
+resource "aws_elasticache_user_group" "test0" {
+  user_group_id = "%[2]s-0"
+  engine        = "REDIS"
+  user_ids      = [aws_elasticache_user.test0.user_id]
+}
+
+resource "aws_elasticache_user" "test1" {
+  user_id       = "%[2]s-1"
+  user_name     = "default"
+  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
+  engine        = "REDIS"
+  passwords     = ["password123456789"]
+}
+resource "aws_elasticache_user_group" "test1" {
+  user_group_id = "%[2]s-1"
+  engine        = "REDIS"
+  user_ids      = [aws_elasticache_user.test1.user_id]
+}
+
+resource "aws_elasticache_replication_group" "test" {
+  replication_group_id          = %[1]q
+  replication_group_description = "test description"
+  node_type                     = "cache.t3.small"
+  port                          = 6379
+  apply_immediately             = true
+  auto_minor_version_upgrade    = false
+  maintenance_window            = "tue:06:30-tue:07:30"
+  snapshot_window               = "01:00-02:00"
+	transit_encryption_enabled    = true
+	user_group_ids                = [aws_elasticache_user_group.test%[3]d.id]
+}
+
+}
+`, rName, userGroup, flag)
+
+}
+
 func testAccReplicationGroupInVPCConfig(rName string) string {
 	return fmt.Sprintf(`
 data "aws_availability_zones" "available" {
@@ -2091,20 +2201,6 @@ resource "aws_security_group" "test" {
   }
 }
 
-resource "aws_elasticache_user" "test" {
-  user_id       = %[1]q
-  user_name     = "default"
-  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
-  engine        = "REDIS"
-  passwords     = ["password123456789"]
-}
-
-resource "aws_elasticache_user_group" "test" {
-  user_group_id = %[1]q
-  engine        = "REDIS"
-  user_ids      = [aws_elasticache_user.test.user_id]
-}
-
 resource "aws_elasticache_replication_group" "test" {
   replication_group_id          = %[1]q
   replication_group_description = "test description"
@@ -2115,7 +2211,6 @@ resource "aws_elasticache_replication_group" "test" {
   security_group_ids            = [aws_security_group.test.id]
   availability_zones            = [data.aws_availability_zones.available.names[0]]
   auto_minor_version_upgrade    = false
-  user_group_ids                = [aws_elasticache_user_group.test.id]
 }
 `, rName)
 }

From 7e3c74296a7d87fc8317468b836acf20648b824a Mon Sep 17 00:00:00 2001
From: James Glennan <jg631@uowmail.edu.au>
Date: Thu, 2 Dec 2021 07:55:46 +1100
Subject: [PATCH 05/15] Add changelog

---
 .changelog/20406.txt                              | 3 +++
 internal/service/elasticache/replication_group.go | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 .changelog/20406.txt

diff --git a/.changelog/20406.txt b/.changelog/20406.txt
new file mode 100644
index 00000000000..2648f82f723
--- /dev/null
+++ b/.changelog/20406.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Associate aws_elasticache_user_group with aws_elasticache_replication_group
+```
\ No newline at end of file
diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 59efd73b5c2..e91ce3616c3 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -55,7 +55,6 @@ func ResourceReplicationGroup() *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Sensitive:     true,
-				ForceNew:      true,
 				ValidateFunc:  validReplicationGroupAuthToken,
 				ConflictsWith: []string{"user_group_ids"},
 			},

From 172de338a2f7bea273820c60e3cc057f54b257a2 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:09:52 -0500
Subject: [PATCH 06/15] Clean up test whitespace

---
 internal/service/elasticache/replication_group_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index 493e5a9f00d..bcb00aa1361 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -2116,6 +2116,7 @@ resource "aws_elasticache_user" "test0" {
   engine        = "REDIS"
   passwords     = ["password123456789"]
 }
+
 resource "aws_elasticache_user_group" "test0" {
   user_group_id = "%[2]s-0"
   engine        = "REDIS"
@@ -2129,6 +2130,7 @@ resource "aws_elasticache_user" "test1" {
   engine        = "REDIS"
   passwords     = ["password123456789"]
 }
+
 resource "aws_elasticache_user_group" "test1" {
   user_group_id = "%[2]s-1"
   engine        = "REDIS"
@@ -2144,10 +2146,8 @@ resource "aws_elasticache_replication_group" "test" {
   auto_minor_version_upgrade    = false
   maintenance_window            = "tue:06:30-tue:07:30"
   snapshot_window               = "01:00-02:00"
-	transit_encryption_enabled    = true
-	user_group_ids                = [aws_elasticache_user_group.test%[3]d.id]
-}
-
+  transit_encryption_enabled    = true
+  user_group_ids                = [aws_elasticache_user_group.test%[3]d.id]
 }
 `, rName, userGroup, flag)
 

From 5cbc8f58ce9f0f3aac8d99cf2b16a85be453d072 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:10:15 -0500
Subject: [PATCH 07/15] Reorder set statements

---
 internal/service/elasticache/replication_group.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index e91ce3616c3..88a35499c8a 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -597,8 +597,8 @@ func resourceReplicationGroupRead(d *schema.ResourceData, meta interface{}) erro
 
 		d.Set("user_group_ids", rgp.UserGroupIds)
 
-		d.Set("auto_minor_version_upgrade", c.AutoMinorVersionUpgrade)
 		d.Set("at_rest_encryption_enabled", c.AtRestEncryptionEnabled)
+		d.Set("auto_minor_version_upgrade", c.AutoMinorVersionUpgrade)
 		d.Set("transit_encryption_enabled", c.TransitEncryptionEnabled)
 
 		if c.AuthTokenEnabled != nil && !aws.BoolValue(c.AuthTokenEnabled) {

From bd52755d32a1169d604c4798e78cfb05adbfd47c Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:16:05 -0500
Subject: [PATCH 08/15] Clean up docs

---
 ...lasticache_replication_group.html.markdown | 52 +++++++++----------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/website/docs/r/elasticache_replication_group.html.markdown b/website/docs/r/elasticache_replication_group.html.markdown
index 66db716ba93..fd132eb4b15 100644
--- a/website/docs/r/elasticache_replication_group.html.markdown
+++ b/website/docs/r/elasticache_replication_group.html.markdown
@@ -141,41 +141,41 @@ resource "aws_elasticache_replication_group" "primary" {
 
 The following arguments are required:
 
-* `replication_group_description` – (Required) A user-created description for the replication group.
-* `replication_group_id` – (Required) The replication group identifier. This parameter is stored as a lowercase string.
+* `replication_group_description` – (Required) User-created description for the replication group.
+* `replication_group_id` – (Required) Replication group identifier. This parameter is stored as a lowercase string.
 
 The following arguments are optional:
 
 * `apply_immediately` - (Optional) Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is `false`.
 * `at_rest_encryption_enabled` - (Optional) Whether to enable encryption at rest.
-* `auth_token` - (Optional) The password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`.
+* `auth_token` - (Optional) Password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`.
 * `auto_minor_version_upgrade` - (Optional) Specifies whether a minor engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window. This parameter is currently not supported by the AWS API. Defaults to `true`.
 * `automatic_failover_enabled` - (Optional) Specifies whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails. If enabled, `number_cache_clusters` must be greater than 1. Must be enabled for Redis (cluster mode enabled) replication groups. Defaults to `false`.
-* `availability_zones` - (Optional) A list of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important.
+* `availability_zones` - (Optional) List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important.
 * `cluster_mode` - (Optional) Create a native Redis cluster. `automatic_failover_enabled` must be set to true. Cluster Mode documented below. Only 1 `cluster_mode` block is allowed. Note that configuring this block does not enable cluster mode, i.e., data sharding, this requires using a parameter group that has the parameter `cluster-enabled` set to true.
 * `data_tiering_enabled` - (Optional) Enables data tiering. Data tiering is only supported for replication groups using the r6gd node type. This parameter must be set to `true` when using r6gd nodes.
-* `engine` - (Optional) The name of the cache engine to be used for the clusters in this replication group. The only valid value is `redis`.
-* `engine_version` - (Optional) The version number of the cache engine to be used for the cache clusters in this replication group. If the version is 6 or higher, only the major version can be set, e.g., `6.x`, otherwise, specify the full version desired, e.g., `5.0.6`. The actual engine version used is returned in the attribute `engine_version_actual`, [defined below](#engine_version_actual).
+* `engine` - (Optional) Name of the cache engine to be used for the clusters in this replication group. The only valid value is `redis`.
+* `engine_version` - (Optional) Version number of the cache engine to be used for the cache clusters in this replication group. If the version is 6 or higher, only the major version can be set, e.g., `6.x`, otherwise, specify the full version desired, e.g., `5.0.6`. The actual engine version used is returned in the attribute `engine_version_actual`, [defined below](#engine_version_actual).
 * `final_snapshot_identifier` - (Optional) The name of your final node group (shard) snapshot. ElastiCache creates the snapshot from the primary node in the cluster. If omitted, no final snapshot will be made.
 * `global_replication_group_id` - (Optional) The ID of the global replication group to which this replication group should belong. If this parameter is specified, the replication group is added to the specified global replication group as a secondary replication group; otherwise, the replication group is not part of any global replication group. If `global_replication_group_id` is set, the `num_node_groups` parameter of the `cluster_mode` block cannot be set.
 * `kms_key_id` - (Optional) The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if `at_rest_encryption_enabled = true`.
 * `maintenance_window` – (Optional) Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`
 * `multi_az_enabled` - (Optional) Specifies whether to enable Multi-AZ Support for the replication group. If `true`, `automatic_failover_enabled` must also be enabled. Defaults to `false`.
-* `node_type` - (Optional) The instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `global_replication_group_id` is set. Cannot be set if `global_replication_group_id` is set.
+* `node_type` - (Optional) Instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `global_replication_group_id` is set. Cannot be set if `global_replication_group_id` is set.
 * `notification_topic_arn` – (Optional) An Amazon Resource Name (ARN) of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`
-* `number_cache_clusters` - (Optional) The number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. One of `number_cache_clusters` or `cluster_mode` is required.
-* `parameter_group_name` - (Optional) The name of the parameter group to associate with this replication group. If this argument is omitted, the default cache parameter group for the specified engine is used. To enable "cluster mode", i.e., data sharding, use a parameter group that has the parameter `cluster-enabled` set to true.
-* `port` – (Optional) The port number on which each of the cache nodes will accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
+* `number_cache_clusters` - (Optional) Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. One of `number_cache_clusters` or `cluster_mode` is required.
+* `parameter_group_name` - (Optional) Name of the parameter group to associate with this replication group. If this argument is omitted, the default cache parameter group for the specified engine is used. To enable "cluster mode", i.e., data sharding, use a parameter group that has the parameter `cluster-enabled` set to true.
+* `port` – (Optional) Port number on which each of the cache nodes will accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
 * `security_group_ids` - (Optional) One or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud
-* `security_group_names` - (Optional) A list of cache security group names to associate with this replication group.
-* `snapshot_arns` – (Optional) A list of Amazon Resource Names (ARNs) that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
-* `snapshot_name` - (Optional) The name of a snapshot from which to restore data into the new node group. Changing the `snapshot_name` forces a new resource.
-* `snapshot_retention_limit` - (Optional, Redis only) The number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
-* `snapshot_window` - (Optional, Redis only) The daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period. Example: `05:00-09:00`
-* `subnet_group_name` - (Optional) The name of the cache subnet group to be used for the replication group.
-* `tags` - (Optional) A map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `security_group_names` - (Optional) List of cache security group names to associate with this replication group.
+* `snapshot_arns` – (Optional) List of ARNs that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
+* `snapshot_name` - (Optional) Name of a snapshot from which to restore data into the new node group. Changing the `snapshot_name` forces a new resource.
+* `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
+* `snapshot_window` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period. Example: `05:00-09:00`
+* `subnet_group_name` - (Optional) Name of the cache subnet group to be used for the replication group.
+* `tags` - (Optional) Map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_encryption_enabled` - (Optional) Whether to enable encryption in transit.
-* `user_group_ids` - (Optional) A list of User Group Ids to associate to the replication group.
+* `user_group_ids` - (Optional) List of User Group Ids to associate to the replication group.
 
 ### cluster_mode
 
@@ -186,15 +186,15 @@ The following arguments are optional:
 
 In addition to all arguments above, the following attributes are exported:
 
-* `arn` - The Amazon Resource Name (ARN) of the created ElastiCache Replication Group.
-* `engine_version_actual` - The running version of the cache engine.
+* `arn` - ARN of the created ElastiCache Replication Group.
+* `engine_version_actual` - Running version of the cache engine.
 * `cluster_enabled` - Indicates if cluster mode is enabled.
-* `configuration_endpoint_address` - The address of the replication group configuration endpoint when cluster mode is enabled.
-* `id` - The ID of the ElastiCache Replication Group.
-* `member_clusters` - The identifiers of all the nodes that are part of this replication group.
-* `primary_endpoint_address` - (Redis only) The address of the endpoint for the primary node in the replication group, if the cluster mode is disabled.
-* `reader_endpoint_address` - (Redis only) The address of the endpoint for the reader node in the replication group, if the cluster mode is disabled.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+* `configuration_endpoint_address` - Address of the replication group configuration endpoint when cluster mode is enabled.
+* `id` - ID of the ElastiCache Replication Group.
+* `member_clusters` - Identifiers of all the nodes that are part of this replication group.
+* `primary_endpoint_address` - (Redis only) Address of the endpoint for the primary node in the replication group, if the cluster mode is disabled.
+* `reader_endpoint_address` - (Redis only) Address of the endpoint for the reader node in the replication group, if the cluster mode is disabled.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
 
 ## Timeouts
 

From 10a2a11182f33dd6b2f7e97c27f607fd1cec7caa Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:18:26 -0500
Subject: [PATCH 09/15] Clean up docs

---
 website/docs/r/elasticache_replication_group.html.markdown | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/docs/r/elasticache_replication_group.html.markdown b/website/docs/r/elasticache_replication_group.html.markdown
index fd132eb4b15..922bed9687f 100644
--- a/website/docs/r/elasticache_replication_group.html.markdown
+++ b/website/docs/r/elasticache_replication_group.html.markdown
@@ -162,7 +162,7 @@ The following arguments are optional:
 * `maintenance_window` – (Optional) Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`
 * `multi_az_enabled` - (Optional) Specifies whether to enable Multi-AZ Support for the replication group. If `true`, `automatic_failover_enabled` must also be enabled. Defaults to `false`.
 * `node_type` - (Optional) Instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `global_replication_group_id` is set. Cannot be set if `global_replication_group_id` is set.
-* `notification_topic_arn` – (Optional) An Amazon Resource Name (ARN) of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`
+* `notification_topic_arn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`
 * `number_cache_clusters` - (Optional) Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. One of `number_cache_clusters` or `cluster_mode` is required.
 * `parameter_group_name` - (Optional) Name of the parameter group to associate with this replication group. If this argument is omitted, the default cache parameter group for the specified engine is used. To enable "cluster mode", i.e., data sharding, use a parameter group that has the parameter `cluster-enabled` set to true.
 * `port` – (Optional) Port number on which each of the cache nodes will accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.

From 9ccec1d906c29b1a45edc40aa8122c3246c4f162 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:29:35 -0500
Subject: [PATCH 10/15] Add long-running test guards

---
 .../elasticache/replication_group_test.go     | 162 +++++++++++++++++-
 1 file changed, 161 insertions(+), 1 deletion(-)

diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index bcb00aa1361..f59d5d04745 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -21,6 +21,10 @@ import (
 )
 
 func TestAccElastiCacheReplicationGroup_basic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -63,6 +67,10 @@ func TestAccElastiCacheReplicationGroup_basic(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_uppercase(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -156,6 +164,10 @@ func TestAccElastiCacheReplicationGroup_EngineVersion_update(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_disappears(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -179,6 +191,10 @@ func TestAccElastiCacheReplicationGroup_disappears(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_updateDescription(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -218,6 +234,10 @@ func TestAccElastiCacheReplicationGroup_updateDescription(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_updateMaintenanceWindow(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -253,6 +273,10 @@ func TestAccElastiCacheReplicationGroup_updateMaintenanceWindow(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_updateUserGroups(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	userGroup := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -292,6 +316,10 @@ func TestAccElastiCacheReplicationGroup_updateUserGroups(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_updateNodeSize(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -330,6 +358,10 @@ func TestAccElastiCacheReplicationGroup_updateNodeSize(t *testing.T) {
 
 //This is a test to prove that we panic we get in https://github.com/hashicorp/terraform/issues/9097
 func TestAccElastiCacheReplicationGroup_updateParameterGroup(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	parameterGroupResourceName1 := "aws_elasticache_parameter_group.test.0"
 	parameterGroupResourceName2 := "aws_elasticache_parameter_group.test.1"
@@ -367,6 +399,10 @@ func TestAccElastiCacheReplicationGroup_updateParameterGroup(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_updateAuthToken(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	resourceName := "aws_elasticache_replication_group.test"
 
@@ -401,6 +437,10 @@ func TestAccElastiCacheReplicationGroup_updateAuthToken(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_vpc(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	resourceName := "aws_elasticache_replication_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -430,6 +470,10 @@ func TestAccElastiCacheReplicationGroup_vpc(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_multiAzNotInVPC(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -478,6 +522,10 @@ func TestAccElastiCacheReplicationGroup_multiAzNotInVPC(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_multiAzInVPC(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -535,6 +583,10 @@ func TestAccElastiCacheReplicationGroup_ValidationMultiAz_noAutomaticFailover(t
 }
 
 func TestAccElastiCacheReplicationGroup_redisClusterInVPC2(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -571,6 +623,10 @@ func TestAccElastiCacheReplicationGroup_redisClusterInVPC2(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterMode_basic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -609,6 +665,10 @@ func TestAccElastiCacheReplicationGroup_ClusterMode_basic(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterMode_nonClusteredParameterGroup(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -645,6 +705,10 @@ func TestAccElastiCacheReplicationGroup_ClusterMode_nonClusteredParameterGroup(t
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroups_scaleUp(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -692,6 +756,10 @@ func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroups_scaleUp(t
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroups_scaleDown(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -733,6 +801,10 @@ func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroups_scaleDown
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterMode_updateReplicasPerNodeGroup(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -787,6 +859,10 @@ func TestAccElastiCacheReplicationGroup_ClusterMode_updateReplicasPerNodeGroup(t
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroupsAndReplicasPerNodeGroup_scaleUp(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -828,6 +904,10 @@ func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroupsAndReplica
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroupsAndReplicasPerNodeGroup_scaleDown(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -869,6 +949,10 @@ func TestAccElastiCacheReplicationGroup_ClusterModeUpdateNumNodeGroupsAndReplica
 }
 
 func TestAccElastiCacheReplicationGroup_ClusterMode_singleNode(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -923,6 +1007,10 @@ func TestAccElastiCacheReplicationGroup_clusteringAndCacheNodesCausesError(t *te
 }
 
 func TestAccElastiCacheReplicationGroup_enableSnapshotting(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -958,6 +1046,10 @@ func TestAccElastiCacheReplicationGroup_enableSnapshotting(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_enableAuthTokenTransitEncryption(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	resourceName := "aws_elasticache_replication_group.test"
 
@@ -986,6 +1078,10 @@ func TestAccElastiCacheReplicationGroup_enableAuthTokenTransitEncryption(t *test
 }
 
 func TestAccElastiCacheReplicationGroup_enableAtRestEncryption(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	resourceName := "aws_elasticache_replication_group.test"
 
@@ -1013,6 +1109,10 @@ func TestAccElastiCacheReplicationGroup_enableAtRestEncryption(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_useCMKKMSKeyID(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.PreCheck(t) },
@@ -1032,6 +1132,10 @@ func TestAccElastiCacheReplicationGroup_useCMKKMSKeyID(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClusters_basic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1093,6 +1197,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClusters_basic(t *testing.T)
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersFailover_autoFailoverDisabled(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1146,6 +1254,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersFailover_autoFailover
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersFailover_autoFailoverEnabled(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1204,6 +1316,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersFailover_autoFailover
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClusters_multiAZEnabled(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1262,6 +1378,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClusters_multiAZEnabled(t *te
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappears_noChange(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1308,6 +1428,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappea
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappears_addMemberCluster(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1354,6 +1478,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappea
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappearsRemoveMemberCluster_atTargetSize(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1400,6 +1528,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappea
 }
 
 func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappearsRemoveMemberCluster_scaleDown(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var replicationGroup elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1446,6 +1578,10 @@ func TestAccElastiCacheReplicationGroup_NumberCacheClustersMemberClusterDisappea
 }
 
 func TestAccElastiCacheReplicationGroup_tags(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1496,6 +1632,10 @@ func TestAccElastiCacheReplicationGroup_tags(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_finalSnapshot(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
@@ -1539,6 +1679,10 @@ func TestAccElastiCacheReplicationGroup_Validation_noNodeType(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_Validation_globalReplicationGroupIdAndNodeType(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var providers []*schema.Provider
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -1560,6 +1704,10 @@ func TestAccElastiCacheReplicationGroup_Validation_globalReplicationGroupIdAndNo
 }
 
 func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_basic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var providers []*schema.Provider
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1657,6 +1805,10 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_full(t *testing
 }
 
 func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupIDClusterMode_basic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var providers []*schema.Provider
 	var rg1, rg2 elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1713,7 +1865,11 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupIDClusterMode_basi
 
 // Test for out-of-band deletion
 // Naming to allow grouping all TestAccAWSElasticacheReplicationGroup_GlobalReplicationGroupId_* tests
-func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_disappears(t *testing.T) { // nosemgrep: acceptance-test-naming-parent-disappears
+func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_disappears(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+ // nosemgrep: acceptance-test-naming-parent-disappears
 	var providers []*schema.Provider
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1741,6 +1897,10 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_disappears(t *t
 }
 
 func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupIDClusterModeValidation_numNodeGroupsOnSecondary(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var providers []*schema.Provider
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 

From 5032348efaec08b60bb09a03803eb5d86ded4500 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:45:10 -0500
Subject: [PATCH 11/15] Add another guard

---
 internal/service/elasticache/replication_group_test.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index f59d5d04745..e9a6650959c 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -99,6 +99,10 @@ func TestAccElastiCacheReplicationGroup_uppercase(t *testing.T) {
 }
 
 func TestAccElastiCacheReplicationGroup_EngineVersion_update(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
 	var v1, v2, v3, v4, v5 elasticache.ReplicationGroup
 	var c1, c2, c3, c4, c5 map[string]*elasticache.CacheCluster
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1869,7 +1873,7 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_disappears(t *t
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
 	}
- // nosemgrep: acceptance-test-naming-parent-disappears
+	// nosemgrep: acceptance-test-naming-parent-disappears
 	var providers []*schema.Provider
 	var rg elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)

From 258e9e6fa3582c6466f2b6f4091425412b996b6d Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 12:46:48 -0500
Subject: [PATCH 12/15] Update changelog

---
 .changelog/20406.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changelog/20406.txt b/.changelog/20406.txt
index 2648f82f723..8f55e07d2fc 100644
--- a/.changelog/20406.txt
+++ b/.changelog/20406.txt
@@ -1,3 +1,3 @@
 ```release-note:enhancement
-resource/aws_elasticache_replication_group: Associate aws_elasticache_user_group with aws_elasticache_replication_group
+resource/aws_elasticache_replication_group: Add `user_group_ids` to associate `aws_elasticache_user_group` with `aws_elasticache_replication_group`
 ```
\ No newline at end of file

From 33699e36ba4595e56a1395b8bbf5c460fabcb840 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 13:01:29 -0500
Subject: [PATCH 13/15] Terrafmmmt

---
 .../elasticache/replication_group_test.go     | 28 ++++++-------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index e9a6650959c..f061acbe409 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -2273,32 +2273,22 @@ resource "aws_elasticache_replication_group" "test" {
 
 func testAccReplicationGroupUserGroup(rName, userGroup string, flag int) string {
 	return fmt.Sprintf(`
-resource "aws_elasticache_user" "test0" {
-  user_id       = "%[2]s-0"
-  user_name     = "default"
-  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
-  engine        = "REDIS"
-  passwords     = ["password123456789"]
-}
-
-resource "aws_elasticache_user_group" "test0" {
-  user_group_id = "%[2]s-0"
-  engine        = "REDIS"
-  user_ids      = [aws_elasticache_user.test0.user_id]
-}
+resource "aws_elasticache_user" "test" {
+  count = 2
 
-resource "aws_elasticache_user" "test1" {
-  user_id       = "%[2]s-1"
+  user_id       = "%[2]s-${count.index}"
   user_name     = "default"
   access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
   engine        = "REDIS"
   passwords     = ["password123456789"]
 }
 
-resource "aws_elasticache_user_group" "test1" {
-  user_group_id = "%[2]s-1"
+resource "aws_elasticache_user_group" "test" {
+  count = 2
+
+  user_group_id = "%[2]s-${count.index}"
   engine        = "REDIS"
-  user_ids      = [aws_elasticache_user.test1.user_id]
+  user_ids      = [aws_elasticache_user.test[count.index].user_id]
 }
 
 resource "aws_elasticache_replication_group" "test" {
@@ -2311,7 +2301,7 @@ resource "aws_elasticache_replication_group" "test" {
   maintenance_window            = "tue:06:30-tue:07:30"
   snapshot_window               = "01:00-02:00"
   transit_encryption_enabled    = true
-  user_group_ids                = [aws_elasticache_user_group.test%[3]d.id]
+  user_group_ids                = [aws_elasticache_user_group.test[%[3]d].id]
 }
 `, rName, userGroup, flag)
 

From 317e5f53b775b5be30341ab78185927332f237c8 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 13:26:00 -0500
Subject: [PATCH 14/15] Remove Terraform-side limit on groups

---
 internal/service/elasticache/replication_group.go          | 1 -
 website/docs/r/elasticache_replication_group.html.markdown | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 88a35499c8a..45d7605e60d 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -286,7 +286,6 @@ func ResourceReplicationGroup() *schema.Resource {
 				Optional:      true,
 				Default:       nil,
 				Elem:          &schema.Schema{Type: schema.TypeString},
-				MaxItems:      1, //at the moment the aws sdk only supports 1 user group id to be associated with a cluster
 				Set:           schema.HashString,
 				ConflictsWith: []string{"auth_token"},
 			},
diff --git a/website/docs/r/elasticache_replication_group.html.markdown b/website/docs/r/elasticache_replication_group.html.markdown
index 922bed9687f..8d6209ec0b0 100644
--- a/website/docs/r/elasticache_replication_group.html.markdown
+++ b/website/docs/r/elasticache_replication_group.html.markdown
@@ -170,12 +170,12 @@ The following arguments are optional:
 * `security_group_names` - (Optional) List of cache security group names to associate with this replication group.
 * `snapshot_arns` – (Optional) List of ARNs that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
 * `snapshot_name` - (Optional) Name of a snapshot from which to restore data into the new node group. Changing the `snapshot_name` forces a new resource.
-* `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
+* `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of `snapshot_retention_limit` is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
 * `snapshot_window` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period. Example: `05:00-09:00`
 * `subnet_group_name` - (Optional) Name of the cache subnet group to be used for the replication group.
 * `tags` - (Optional) Map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_encryption_enabled` - (Optional) Whether to enable encryption in transit.
-* `user_group_ids` - (Optional) List of User Group Ids to associate to the replication group.
+* `user_group_ids` - (Optional) User Group ID to associate with the replication group. Only a maximum of one (1) user group ID is valid. **NOTE:** This argument _is_ a set because the AWS specification allows for multiple IDs. However, in practice, AWS only allows a maximum size of one.
 
 ### cluster_mode
 

From d2fd52178a190a3267d217f98954a2777edb9467 Mon Sep 17 00:00:00 2001
From: Dirk Avery <dirk.avery@gmail.com>
Date: Wed, 26 Jan 2022 14:17:23 -0500
Subject: [PATCH 15/15] Lindt

---
 internal/service/elasticache/replication_group.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 45d7605e60d..cb04c18c0ec 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -284,7 +284,6 @@ func ResourceReplicationGroup() *schema.Resource {
 			"user_group_ids": {
 				Type:          schema.TypeSet,
 				Optional:      true,
-				Default:       nil,
 				Elem:          &schema.Schema{Type: schema.TypeString},
 				Set:           schema.HashString,
 				ConflictsWith: []string{"auth_token"},