diff --git a/aws/cloudfront_distribution_configuration_structure.go b/aws/cloudfront_distribution_configuration_structure.go
index ab0ec7df154..5f8ec07e12e 100644
--- a/aws/cloudfront_distribution_configuration_structure.go
+++ b/aws/cloudfront_distribution_configuration_structure.go
@@ -1103,7 +1103,7 @@ func flattenCloudfrontActiveTrustedSigners(ats *cloudfront.ActiveTrustedSigners)
 
 	m := map[string]interface{}{
 		"enabled": aws.BoolValue(ats.Enabled),
-		"signers": flattenCloudfrontSigners(ats.Items),
+		"items":   flattenCloudfrontSigners(ats.Items),
 	}
 
 	return []interface{}{m}
diff --git a/aws/internal/flatmap/README.md b/aws/internal/flatmap/README.md
deleted file mode 100644
index 45c85d8c8d0..00000000000
--- a/aws/internal/flatmap/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# flatmap
-
-This package contains legacy code from `github.com/hashicorp/terraform/flatmap@v0.12.9`. The types and functions within this package should not be used in any future implementations.
diff --git a/aws/internal/flatmap/flatten.go b/aws/internal/flatmap/flatten.go
deleted file mode 100644
index 9ff6e426526..00000000000
--- a/aws/internal/flatmap/flatten.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package flatmap
-
-import (
-	"fmt"
-	"reflect"
-)
-
-// Flatten takes a structure and turns into a flat map[string]string.
-//
-// Within the "thing" parameter, only primitive values are allowed. Structs are
-// not supported. Therefore, it can only be slices, maps, primitives, and
-// any combination of those together.
-//
-// See the tests for examples of what inputs are turned into.
-func Flatten(thing map[string]interface{}) Map {
-	result := make(map[string]string)
-
-	for k, raw := range thing {
-		flatten(result, k, reflect.ValueOf(raw))
-	}
-
-	return Map(result)
-}
-
-func flatten(result map[string]string, prefix string, v reflect.Value) {
-	if v.Kind() == reflect.Interface {
-		v = v.Elem()
-	}
-
-	switch v.Kind() {
-	case reflect.Bool:
-		if v.Bool() {
-			result[prefix] = "true"
-		} else {
-			result[prefix] = "false"
-		}
-	case reflect.Int:
-		result[prefix] = fmt.Sprintf("%d", v.Int())
-	case reflect.Map:
-		flattenMap(result, prefix, v)
-	case reflect.Slice:
-		flattenSlice(result, prefix, v)
-	case reflect.String:
-		result[prefix] = v.String()
-	default:
-		panic(fmt.Sprintf("Unknown: %s", v))
-	}
-}
-
-func flattenMap(result map[string]string, prefix string, v reflect.Value) {
-	for _, k := range v.MapKeys() {
-		if k.Kind() == reflect.Interface {
-			k = k.Elem()
-		}
-
-		if k.Kind() != reflect.String {
-			panic(fmt.Sprintf("%s: map key is not string: %s", prefix, k))
-		}
-
-		flatten(result, fmt.Sprintf("%s.%s", prefix, k.String()), v.MapIndex(k))
-	}
-}
-
-func flattenSlice(result map[string]string, prefix string, v reflect.Value) {
-	prefix = prefix + "."
-
-	result[prefix+"#"] = fmt.Sprintf("%d", v.Len())
-	for i := 0; i < v.Len(); i++ {
-		flatten(result, fmt.Sprintf("%s%d", prefix, i), v.Index(i))
-	}
-}
diff --git a/aws/internal/flatmap/flatten_test.go b/aws/internal/flatmap/flatten_test.go
deleted file mode 100644
index 9abd22dee9b..00000000000
--- a/aws/internal/flatmap/flatten_test.go
+++ /dev/null
@@ -1,88 +0,0 @@
-package flatmap
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestFlatten(t *testing.T) {
-	cases := []struct {
-		Input  map[string]interface{}
-		Output map[string]string
-	}{
-		{
-			Input: map[string]interface{}{
-				"foo": "bar",
-				"bar": "baz",
-			},
-			Output: map[string]string{
-				"foo": "bar",
-				"bar": "baz",
-			},
-		},
-
-		{
-			Input: map[string]interface{}{
-				"foo": []string{
-					"one",
-					"two",
-				},
-			},
-			Output: map[string]string{
-				"foo.#": "2",
-				"foo.0": "one",
-				"foo.1": "two",
-			},
-		},
-
-		{
-			Input: map[string]interface{}{
-				"foo": []map[interface{}]interface{}{
-					{
-						"name":    "bar",
-						"port":    3000,
-						"enabled": true,
-					},
-				},
-			},
-			Output: map[string]string{
-				"foo.#":         "1",
-				"foo.0.name":    "bar",
-				"foo.0.port":    "3000",
-				"foo.0.enabled": "true",
-			},
-		},
-
-		{
-			Input: map[string]interface{}{
-				"foo": []map[interface{}]interface{}{
-					{
-						"name": "bar",
-						"ports": []string{
-							"1",
-							"2",
-						},
-					},
-				},
-			},
-			Output: map[string]string{
-				"foo.#":         "1",
-				"foo.0.name":    "bar",
-				"foo.0.ports.#": "2",
-				"foo.0.ports.0": "1",
-				"foo.0.ports.1": "2",
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		actual := Flatten(tc.Input)
-		if !reflect.DeepEqual(actual, Map(tc.Output)) {
-			t.Fatalf(
-				"Input:\n\n%#v\n\nOutput:\n\n%#v\n\nExpected:\n\n%#v\n",
-				tc.Input,
-				actual,
-				tc.Output)
-		}
-	}
-}
diff --git a/aws/internal/flatmap/map.go b/aws/internal/flatmap/map.go
deleted file mode 100644
index 435e04a39db..00000000000
--- a/aws/internal/flatmap/map.go
+++ /dev/null
@@ -1,82 +0,0 @@
-package flatmap
-
-import (
-	"strings"
-)
-
-// Map is a wrapper around map[string]string that provides some helpers
-// above it that assume the map is in the format that flatmap expects
-// (the result of Flatten).
-//
-// All modifying functions such as Delete are done in-place unless
-// otherwise noted.
-type Map map[string]string
-
-// Contains returns true if the map contains the given key.
-func (m Map) Contains(key string) bool {
-	for _, k := range m.Keys() {
-		if k == key {
-			return true
-		}
-	}
-
-	return false
-}
-
-// Delete deletes a key out of the map with the given prefix.
-func (m Map) Delete(prefix string) {
-	for k := range m {
-		match := k == prefix
-		if !match {
-			if !strings.HasPrefix(k, prefix) {
-				continue
-			}
-
-			if k[len(prefix):len(prefix)+1] != "." {
-				continue
-			}
-		}
-
-		delete(m, k)
-	}
-}
-
-// Keys returns all of the top-level keys in this map
-func (m Map) Keys() []string {
-	ks := make(map[string]struct{})
-	for k := range m {
-		idx := strings.Index(k, ".")
-		if idx == -1 {
-			idx = len(k)
-		}
-
-		ks[k[:idx]] = struct{}{}
-	}
-
-	result := make([]string, 0, len(ks))
-	for k := range ks {
-		result = append(result, k)
-	}
-
-	return result
-}
-
-// Merge merges the contents of the other Map into this one.
-//
-// This merge is smarter than a simple map iteration because it
-// will fully replace arrays and other complex structures that
-// are present in this map with the other map's. For example, if
-// this map has a 3 element "foo" list, and m2 has a 2 element "foo"
-// list, then the result will be that m has a 2 element "foo"
-// list.
-func (m Map) Merge(m2 Map) {
-	for _, prefix := range m2.Keys() {
-		m.Delete(prefix)
-
-		for k, v := range m2 {
-			if strings.HasPrefix(k, prefix) {
-				m[k] = v
-			}
-		}
-	}
-}
diff --git a/aws/internal/flatmap/map_test.go b/aws/internal/flatmap/map_test.go
deleted file mode 100644
index ea767d54fd5..00000000000
--- a/aws/internal/flatmap/map_test.go
+++ /dev/null
@@ -1,120 +0,0 @@
-package flatmap
-
-import (
-	"reflect"
-	"sort"
-	"testing"
-)
-
-func TestMapContains(t *testing.T) {
-	cases := []struct {
-		Input  map[string]string
-		Key    string
-		Result bool
-	}{
-		{
-			Input: map[string]string{
-				"foo": "bar",
-				"bar": "nope",
-			},
-			Key:    "foo",
-			Result: true,
-		},
-
-		{
-			Input: map[string]string{
-				"foo": "bar",
-				"bar": "nope",
-			},
-			Key:    "baz",
-			Result: false,
-		},
-	}
-
-	for i, tc := range cases {
-		actual := Map(tc.Input).Contains(tc.Key)
-		if actual != tc.Result {
-			t.Fatalf("case %d bad: %#v", i, tc.Input)
-		}
-	}
-}
-
-func TestMapDelete(t *testing.T) {
-	m := Flatten(map[string]interface{}{
-		"foo": "bar",
-		"routes": []map[string]string{
-			{
-				"foo": "bar",
-			},
-		},
-	})
-
-	m.Delete("routes")
-
-	expected := Map(map[string]string{"foo": "bar"})
-	if !reflect.DeepEqual(m, expected) {
-		t.Fatalf("bad: %#v", m)
-	}
-}
-
-func TestMapKeys(t *testing.T) {
-	cases := []struct {
-		Input  map[string]string
-		Output []string
-	}{
-		{
-			Input: map[string]string{
-				"foo":       "bar",
-				"bar.#":     "bar",
-				"bar.0.foo": "bar",
-				"bar.0.baz": "bar",
-			},
-			Output: []string{
-				"bar",
-				"foo",
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		actual := Map(tc.Input).Keys()
-
-		// Sort so we have a consistent view of the output
-		sort.Strings(actual)
-
-		if !reflect.DeepEqual(actual, tc.Output) {
-			t.Fatalf("input: %#v\n\nbad: %#v", tc.Input, actual)
-		}
-	}
-}
-
-func TestMapMerge(t *testing.T) {
-	cases := []struct {
-		One    map[string]string
-		Two    map[string]string
-		Result map[string]string
-	}{
-		{
-			One: map[string]string{
-				"foo": "bar",
-				"bar": "nope",
-			},
-			Two: map[string]string{
-				"bar": "baz",
-				"baz": "buz",
-			},
-			Result: map[string]string{
-				"foo": "bar",
-				"bar": "baz",
-				"baz": "buz",
-			},
-		},
-	}
-
-	for i, tc := range cases {
-		Map(tc.One).Merge(Map(tc.Two))
-		if !reflect.DeepEqual(tc.One, tc.Result) {
-			t.Fatalf("case %d bad: %#v", i, tc.One)
-		}
-	}
-}
diff --git a/aws/resource_aws_cloudfront_distribution.go b/aws/resource_aws_cloudfront_distribution.go
index c16b79213ea..fe908a77943 100644
--- a/aws/resource_aws_cloudfront_distribution.go
+++ b/aws/resource_aws_cloudfront_distribution.go
@@ -580,7 +580,10 @@ func resourceAwsCloudFrontDistribution() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"active_trusted_signers": {
+			// Terraform AWS Provider 3.0 name change:
+			// enables TF Plugin SDK to ignore pre-existing attribute state
+			// associated with previous naming i.e. active_trusted_signers
+			"trusted_signers": {
 				Type:     schema.TypeList,
 				Computed: true,
 				Elem: &schema.Resource{
@@ -589,7 +592,7 @@ func resourceAwsCloudFrontDistribution() *schema.Resource {
 							Type:     schema.TypeBool,
 							Computed: true,
 						},
-						"signers": {
+						"items": {
 							Type:     schema.TypeList,
 							Computed: true,
 							Elem: &schema.Resource{
@@ -729,8 +732,8 @@ func resourceAwsCloudFrontDistributionRead(d *schema.ResourceData, meta interfac
 	}
 
 	// Update other attributes outside of DistributionConfig
-	if err := d.Set("active_trusted_signers", flattenCloudfrontActiveTrustedSigners(resp.Distribution.ActiveTrustedSigners)); err != nil {
-		return fmt.Errorf("error setting active_trusted_signers: %w", err)
+	if err := d.Set("trusted_signers", flattenCloudfrontActiveTrustedSigners(resp.Distribution.ActiveTrustedSigners)); err != nil {
+		return fmt.Errorf("error setting trusted_signers: %w", err)
 	}
 	d.Set("status", resp.Distribution.Status)
 	d.Set("domain_name", resp.Distribution.DomainName)
diff --git a/aws/resource_aws_cloudfront_distribution_test.go b/aws/resource_aws_cloudfront_distribution_test.go
index 854916ad76f..7f3fecb3f11 100644
--- a/aws/resource_aws_cloudfront_distribution_test.go
+++ b/aws/resource_aws_cloudfront_distribution_test.go
@@ -581,9 +581,9 @@ func TestAccAWSCloudFrontDistribution_DefaultCacheBehavior_TrustedSigners(t *tes
 				Config: testAccAWSCloudFrontDistributionConfigDefaultCacheBehaviorTrustedSignersSelf(retainOnDelete),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCloudFrontDistributionExists(resourceName, &distribution),
-					resource.TestCheckResourceAttr(resourceName, "active_trusted_signers.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "active_trusted_signers.0.signers.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "active_trusted_signers.0.signers.0.aws_account_number", "self"),
+					resource.TestCheckResourceAttr(resourceName, "trusted_signers.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "trusted_signers.0.items.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "trusted_signers.0.items.0.aws_account_number", "self"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.0.trusted_signers.#", "1"),
 				),
diff --git a/website/docs/r/cloudfront_distribution.html.markdown b/website/docs/r/cloudfront_distribution.html.markdown
index 36585015320..fa473c9c742 100644
--- a/website/docs/r/cloudfront_distribution.html.markdown
+++ b/website/docs/r/cloudfront_distribution.html.markdown
@@ -529,9 +529,9 @@ In addition to all arguments above, the following attributes are exported:
     distribution's information is fully propagated throughout the Amazon
     CloudFront system.
 
-* `active_trusted_signers` - Nested attributes of active trusted signers, if the distribution is set up to serve private content with signed URLs
+* `trusted_signers` - Nested attributes of active trusted signers, if the distribution is set up to serve private content with signed URLs
     * `enabled` - `true` if any of the AWS accounts listed as trusted signers have active CloudFront key pairs
-    * `signers` - Nested attributes of each trusted signer
+    * `items` - Nested attributes of each trusted signer
         * `aws_account_number` - AWS account ID or `self`
         * `key_pair_ids` - Set of active CloudFront key pairs associated with the signer account