Merge pull request #18341 from hashicorp/b-security-org-admin-account…

…-resource-retry

resource/securityhub_organization_admin_account: retry on ResourceConflictException during creation

.changelog/18341.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_securityhub_organization_admin_account: Retry on `ResourceConflictException` error during creation
+```

aws/config.go

@@ -771,6 +771,16 @@ func (c *Config) Client() (interface{}, error) {
 		}
 	})
 
+	// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/17996
+	client.securityhubconn.Handlers.Retry.PushBack(func(r *request.Request) {
+		switch r.Operation.Name {
+		case "EnableOrganizationAdminAccount":
+			if tfawserr.ErrCodeEquals(r.Error, securityhub.ErrCodeResourceConflictException) {
+				r.Retryable = aws.Bool(true)
+			}
+		}
+	})
+
 	client.storagegatewayconn.Handlers.Retry.PushBack(func(r *request.Request) {
 		// InvalidGatewayRequestException: The specified gateway proxy network connection is busy.
 		if isAWSErr(r.Error, storagegateway.ErrCodeInvalidGatewayRequestException, "The specified gateway proxy network connection is busy") {

aws/resource_aws_securityhub_organization_admin_account_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/service/securityhub/finder"
 )
@@ -63,6 +64,35 @@ func testAccAwsSecurityHubOrganizationAdminAccount_disappears(t *testing.T) {
 	})
 }
 
+func testAccAwsSecurityHubOrganizationAdminAccount_MultiRegion(t *testing.T) {
+	var providers []*schema.Provider
+
+	resourceName := "aws_securityhub_organization_admin_account.test"
+	altResourceName := "aws_securityhub_organization_admin_account.alternate"
+	thirdResourceName := "aws_securityhub_organization_admin_account.third"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+			testAccOrganizationsAccountPreCheck(t)
+			testAccMultipleRegionPreCheck(t, 3)
+		},
+		ErrorCheck:        testAccErrorCheck(t, securityhub.EndpointsID),
+		ProviderFactories: testAccProviderFactoriesMultipleRegion(&providers, 3),
+		CheckDestroy:      testAccCheckAwsSecurityHubOrganizationAdminAccountDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityHubOrganizationAdminAccountConfigMultiRegion(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAwsSecurityHubOrganizationAdminAccountExists(resourceName),
+					testAccCheckAwsSecurityHubOrganizationAdminAccountExists(altResourceName),
+					testAccCheckAwsSecurityHubOrganizationAdminAccountExists(thirdResourceName),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAwsSecurityHubOrganizationAdminAccountDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).securityhubconn
 
@@ -136,3 +166,42 @@ resource "aws_securityhub_organization_admin_account" "test" {
 }
 `
 }
+
+func testAccSecurityHubOrganizationAdminAccountConfigMultiRegion() string {
+	return composeConfig(
+		testAccMultipleRegionProviderConfig(3),
+		`
+data "aws_caller_identity" "current" {}
+
+data "aws_partition" "current" {}
+
+resource "aws_organizations_organization" "test" {
+  aws_service_access_principals = ["securityhub.${data.aws_partition.current.dns_suffix}"]
+  feature_set                   = "ALL"
+}
+
+resource "aws_securityhub_account" "test" {}
+
+resource "aws_securityhub_organization_admin_account" "test" {
+  depends_on = [aws_organizations_organization.test]
+
+  admin_account_id = data.aws_caller_identity.current.account_id
+}
+
+resource "aws_securityhub_organization_admin_account" "alternate" {
+  provider = awsalternate
+
+  depends_on = [aws_organizations_organization.test]
+
+  admin_account_id = data.aws_caller_identity.current.account_id
+}
+
+resource "aws_securityhub_organization_admin_account" "third" {
+  provider = awsthird
+
+  depends_on = [aws_organizations_organization.test]
+
+  admin_account_id = data.aws_caller_identity.current.account_id
+}
+`)
+}

aws/resource_aws_securityhub_test.go

@@ -23,8 +23,9 @@ func TestAccAWSSecurityHub_serial(t *testing.T) {
 			"basic": testAccAWSSecurityHubInviteAccepter_basic,
 		},
 		"OrganizationAdminAccount": {
-			"basic":      testAccAwsSecurityHubOrganizationAdminAccount_basic,
-			"disappears": testAccAwsSecurityHubOrganizationAdminAccount_disappears,
+			"basic":       testAccAwsSecurityHubOrganizationAdminAccount_basic,
+			"disappears":  testAccAwsSecurityHubOrganizationAdminAccount_disappears,
+			"MultiRegion": testAccAwsSecurityHubOrganizationAdminAccount_MultiRegion,
 		},
 		"ProductSubscription": {
 			"basic": testAccAWSSecurityHubProductSubscription_basic,