handling access denied when reading vault policy when vault has been deleted

[dooreelko]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #0000

It's a new issue we stumbled on but not reported.
In essence, if the backup vault is deleted outside of terraform, the update operation fails with AccessDenied error instead of ResourceNotFoundException. The cause for that is that authors of GetBackupVaultAccessPolicy API decided (allegedly) to follow some no-exposure security rule that advocates not exposing resource absence to avoid discovery of valid resource names using some kind of brute force iteration.

Output from acceptance testing:

TODO
@DrFaust92 any ideas how we can test this? The reproduction steps are:

• create vault and a policy so that terraform has a state with resource ids
• remove the vault without modifying the terraform state
• perform resourceAwsBackupVaultPolicyRead

$ make testacc TESTARGS='-run=TestAccAwsBackupVaultPolicy_'

...

At this stage, the PR is not ready for merging, it's a discussion on how the issue can be tested.

[ewbankkit]

@dooreelko Thanks for the contribution 🎉 👏.
I have incorporated the changes into #19854 (you will get attribution when that PR is merged).
I added an additional acceptance test TestAccAwsBackupVaultPolicy_disappears_vault that is very similar to TestAccAwsBackupVaultPolicy_disappears but instead deletes the Backup Vault.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.