Allow schema additions in cognito user pools

[bill-rich]

Currently, cognito_user_pool does not allow schema additions. This allows schema items to be added but not removed or modified. Ideally this would be done using CustomizeDiff, but nested set attributes result in a false diff in ResourceDiffs. The workaround implemented in the PR is to allow changes to schema, but return an error during Update if a schema item is modified or removed.

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #3891

Output from acceptance testing:

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSCognitoUserPool_ -timeout 180m
=== RUN   TestAccAWSCognitoUserPool_basic
=== PAUSE TestAccAWSCognitoUserPool_basic
=== RUN   TestAccAWSCognitoUserPool_recovery
=== PAUSE TestAccAWSCognitoUserPool_recovery
=== RUN   TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration
=== PAUSE TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration
=== RUN   TestAccAWSCognitoUserPool_withAdminCreateUserConfigurationAndPasswordPolicy
=== PAUSE TestAccAWSCognitoUserPool_withAdminCreateUserConfigurationAndPasswordPolicy
=== RUN   TestAccAWSCognitoUserPool_withAdvancedSecurityMode
=== PAUSE TestAccAWSCognitoUserPool_withAdvancedSecurityMode
=== RUN   TestAccAWSCognitoUserPool_withDeviceConfiguration
=== PAUSE TestAccAWSCognitoUserPool_withDeviceConfiguration
=== RUN   TestAccAWSCognitoUserPool_withEmailVerificationMessage
=== PAUSE TestAccAWSCognitoUserPool_withEmailVerificationMessage
=== RUN   TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfiguration
=== PAUSE TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfiguration
=== RUN   TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationAndSoftwareTokenMfaConfiguration
=== PAUSE TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationAndSoftwareTokenMfaConfiguration
=== RUN   TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationToSoftwareTokenMfaConfiguration
=== PAUSE TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationToSoftwareTokenMfaConfiguration
=== RUN   TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfiguration
=== PAUSE TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfiguration
=== RUN   TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfigurationToSmsConfiguration
=== PAUSE TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfigurationToSmsConfiguration
=== RUN   TestAccAWSCognitoUserPool_SmsAuthenticationMessage
=== PAUSE TestAccAWSCognitoUserPool_SmsAuthenticationMessage
=== RUN   TestAccAWSCognitoUserPool_SmsConfiguration
=== PAUSE TestAccAWSCognitoUserPool_SmsConfiguration
=== RUN   TestAccAWSCognitoUserPool_SmsConfiguration_ExternalId
=== PAUSE TestAccAWSCognitoUserPool_SmsConfiguration_ExternalId
=== RUN   TestAccAWSCognitoUserPool_SmsConfiguration_SnsCallerArn
=== PAUSE TestAccAWSCognitoUserPool_SmsConfiguration_SnsCallerArn
=== RUN   TestAccAWSCognitoUserPool_SmsVerificationMessage
=== PAUSE TestAccAWSCognitoUserPool_SmsVerificationMessage
=== RUN   TestAccAWSCognitoUserPool_withEmailConfiguration
=== PAUSE TestAccAWSCognitoUserPool_withEmailConfiguration
=== RUN   TestAccAWSCognitoUserPool_withEmailConfigurationSource
    resource_aws_cognito_user_pool_test.go:775: 'TEST_AWS_SES_VERIFIED_EMAIL_ARN' not set, skipping test.
--- SKIP: TestAccAWSCognitoUserPool_withEmailConfigurationSource (0.00s)
=== RUN   TestAccAWSCognitoUserPool_withTags
=== PAUSE TestAccAWSCognitoUserPool_withTags
=== RUN   TestAccAWSCognitoUserPool_withAliasAttributes
=== PAUSE TestAccAWSCognitoUserPool_withAliasAttributes
=== RUN   TestAccAWSCognitoUserPool_withPasswordPolicy
=== PAUSE TestAccAWSCognitoUserPool_withPasswordPolicy
=== RUN   TestAccAWSCognitoUserPool_withUsernameConfiguration
=== PAUSE TestAccAWSCognitoUserPool_withUsernameConfiguration
=== RUN   TestAccAWSCognitoUserPool_withLambdaConfig
=== PAUSE TestAccAWSCognitoUserPool_withLambdaConfig
=== RUN   TestAccAWSCognitoUserPool_schemaAttributes
=== PAUSE TestAccAWSCognitoUserPool_schemaAttributes
=== RUN   TestAccAWSCognitoUserPool_schemaAttributesRemoved
=== PAUSE TestAccAWSCognitoUserPool_schemaAttributesRemoved
=== RUN   TestAccAWSCognitoUserPool_schemaAttributesModified
=== PAUSE TestAccAWSCognitoUserPool_schemaAttributesModified
=== RUN   TestAccAWSCognitoUserPool_withVerificationMessageTemplate
=== PAUSE TestAccAWSCognitoUserPool_withVerificationMessageTemplate
=== RUN   TestAccAWSCognitoUserPool_update
=== PAUSE TestAccAWSCognitoUserPool_update
=== RUN   TestAccAWSCognitoUserPool_disappears
=== PAUSE TestAccAWSCognitoUserPool_disappears
=== CONT  TestAccAWSCognitoUserPool_basic
=== CONT  TestAccAWSCognitoUserPool_schemaAttributesRemoved
=== CONT  TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfiguration
=== CONT  TestAccAWSCognitoUserPool_SmsAuthenticationMessage
=== CONT  TestAccAWSCognitoUserPool_schemaAttributes
=== CONT  TestAccAWSCognitoUserPool_withLambdaConfig
=== CONT  TestAccAWSCognitoUserPool_withUsernameConfiguration
=== CONT  TestAccAWSCognitoUserPool_withPasswordPolicy
=== CONT  TestAccAWSCognitoUserPool_withAliasAttributes
=== CONT  TestAccAWSCognitoUserPool_withTags
=== CONT  TestAccAWSCognitoUserPool_withEmailConfiguration
=== CONT  TestAccAWSCognitoUserPool_SmsVerificationMessage
=== CONT  TestAccAWSCognitoUserPool_SmsConfiguration_SnsCallerArn
=== CONT  TestAccAWSCognitoUserPool_SmsConfiguration_ExternalId
=== CONT  TestAccAWSCognitoUserPool_SmsConfiguration
=== CONT  TestAccAWSCognitoUserPool_withEmailVerificationMessage
=== CONT  TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfigurationToSmsConfiguration
=== CONT  TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfiguration
=== CONT  TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationToSoftwareTokenMfaConfiguration
=== CONT  TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationAndSoftwareTokenMfaConfiguration
--- PASS: TestAccAWSCognitoUserPool_basic (49.59s)
=== CONT  TestAccAWSCognitoUserPool_disappears
--- PASS: TestAccAWSCognitoUserPool_withEmailConfiguration (54.00s)
=== CONT  TestAccAWSCognitoUserPool_update
--- PASS: TestAccAWSCognitoUserPool_schemaAttributesRemoved (57.79s)
=== CONT  TestAccAWSCognitoUserPool_withVerificationMessageTemplate
--- PASS: TestAccAWSCognitoUserPool_disappears (24.94s)
=== CONT  TestAccAWSCognitoUserPool_schemaAttributesModified
--- PASS: TestAccAWSCognitoUserPool_withAliasAttributes (77.38s)
=== CONT  TestAccAWSCognitoUserPool_withAdminCreateUserConfigurationAndPasswordPolicy
--- PASS: TestAccAWSCognitoUserPool_schemaAttributes (78.78s)
=== CONT  TestAccAWSCognitoUserPool_withDeviceConfiguration
--- PASS: TestAccAWSCognitoUserPool_withPasswordPolicy (80.94s)
=== CONT  TestAccAWSCognitoUserPool_withAdvancedSecurityMode
--- PASS: TestAccAWSCognitoUserPool_SmsVerificationMessage (81.37s)
=== CONT  TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration
--- PASS: TestAccAWSCognitoUserPool_SmsAuthenticationMessage (81.40s)
=== CONT  TestAccAWSCognitoUserPool_recovery
--- PASS: TestAccAWSCognitoUserPool_withEmailVerificationMessage (88.26s)
--- PASS: TestAccAWSCognitoUserPool_withUsernameConfiguration (88.34s)
--- PASS: TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationToSoftwareTokenMfaConfiguration (102.66s)
--- PASS: TestAccAWSCognitoUserPool_withAdminCreateUserConfigurationAndPasswordPolicy (26.63s)
--- PASS: TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfigurationToSmsConfiguration (109.13s)
--- PASS: TestAccAWSCognitoUserPool_withVerificationMessageTemplate (52.70s)
--- PASS: TestAccAWSCognitoUserPool_MfaConfiguration_SoftwareTokenMfaConfiguration (111.75s)
--- PASS: TestAccAWSCognitoUserPool_SmsConfiguration (120.39s)
--- PASS: TestAccAWSCognitoUserPool_withDeviceConfiguration (41.83s)
--- PASS: TestAccAWSCognitoUserPool_withLambdaConfig (122.09s)
--- PASS: TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration (41.05s)
--- PASS: TestAccAWSCognitoUserPool_withTags (123.28s)
--- PASS: TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfigurationAndSoftwareTokenMfaConfiguration (123.41s)
--- PASS: TestAccAWSCognitoUserPool_schemaAttributesModified (51.59s)
--- PASS: TestAccAWSCognitoUserPool_withAdvancedSecurityMode (45.58s)
--- PASS: TestAccAWSCognitoUserPool_SmsConfiguration_ExternalId (130.82s)
--- PASS: TestAccAWSCognitoUserPool_recovery (50.33s)
--- PASS: TestAccAWSCognitoUserPool_SmsConfiguration_SnsCallerArn (131.78s)
--- PASS: TestAccAWSCognitoUserPool_MfaConfiguration_SmsConfiguration (145.97s)
--- PASS: TestAccAWSCognitoUserPool_update (94.03s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	148.090s

[anGie44]

Looks great @bill-rich ! just a couple error format notes and documentation rec.

Running acceptance tests right now and they're looking good as well 👍

[ghost]

This has been released in version 3.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!