r/s3_bucket_object_lock_configuration: clarify usage in docs and mark token as sensitive

[anGie44]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #23363

TODO:

• get confirmation from AWS Support case on how token is used with the AWS Go SDK
• confirm if you need to update your aws_s3_bucket configuration with object_lock_enabled to suppress diffs
  ^^ not actually necessary after apply/refresh:

$ cat main.tf

resource "aws_s3_bucket" "example" {
  bucket = "my-example-log-bucket-4444"
}

resource "aws_s3_bucket_versioning" "example" {
  bucket = aws_s3_bucket.example.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_object_lock_configuration" "example"{
  bucket = aws_s3_bucket.example.id

  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 5
    }
  }

  token = (Sensitive)
}

$ terraform apply

Terraform will perform the following actions:

  # aws_s3_bucket_object_lock_configuration.example will be created
  + resource "aws_s3_bucket_object_lock_configuration" "example" {
      + bucket              = "my-example-log-bucket-4444"
      + id                  = (known after apply)
      + object_lock_enabled = "Enabled"
      + token               = "xxxxxxxxxx"

      + rule {
          + default_retention {
              + days = 5
              + mode = "COMPLIANCE"
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.
aws_s3_bucket_object_lock_configuration.example: Creating...
aws_s3_bucket_object_lock_configuration.example: Creation complete after 1s [id=my-example-log-bucket-4444]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

$ terraform plan
aws_s3_bucket.example: Refreshing state... [id=my-example-log-bucket-4444]
aws_s3_bucket_versioning.example: Refreshing state... [id=my-example-log-bucket-4444]
aws_s3_bucket_object_lock_configuration.example: Refreshing state... [id=my-example-log-bucket-4444]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # aws_s3_bucket.example has changed
  ~ resource "aws_s3_bucket" "example" {
        id                                   = "my-example-log-bucket-4444"
        tags                                 = {}
        # (17 unchanged attributes hidden)

      + object_lock_configuration {
          + object_lock_enabled = "Enabled"
          + rule                = [
              + {
                  + default_retention = [
                      + {
                          + days  = 5
                          + mode  = "COMPLIANCE"
                          + years = 0
                        },
                    ]
                },
            ]
        }
    }


Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes,
the following plan may include actions to undo or respond to these changes.

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

No changes. Your infrastructure matches the configuration.

Output from acceptance testing:

N/A

[YakDriver]

Very clear! 🎉

[github-actions]

This functionality has been released in v4.3.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.