fix: aws_cognito_identity_provider update ProviderDetails ActiveEncryptionCertificate on update

[jdoetsch-built]

Description

A recent AWS feature release for Cognito added read-only ActiveEncryptionCertificate property to Cognito Identity Provider describe ProviderDetails map. UpdateIdentityProvider API call responds with the following error if ActiveEncryptionCertificate is included in the ProviderDetails map in the request. For example:

Error: Error updating Cognito Identity Provider: InvalidParameterException: ActiveEncryptionCertificate is not a valid key for SAML identity provider details.

If the Terraform plan for aws_cognito_identity_provider includes changes on the provider_details argument then we'll run into the above error during apply.

Relations

Closes #35588

References

AWS announcement for the feature that introduced the API change

Output from Acceptance Testing

$ AWS_DEFAULT_REGION=us-west-1 make testacc TESTS=TestAccCognitoIDPIdentityProvider PKG=cognitoidp

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/cognitoidp/... -v -count 1 -parallel 20 -run='TestAccCognitoIDPIdentityProvider'  -timeout 360m
=== RUN   TestAccCognitoIDPIdentityProvider_basic
=== PAUSE TestAccCognitoIDPIdentityProvider_basic
=== RUN   TestAccCognitoIDPIdentityProvider_idpIdentifiers
=== PAUSE TestAccCognitoIDPIdentityProvider_idpIdentifiers
=== RUN   TestAccCognitoIDPIdentityProvider_disappears
=== PAUSE TestAccCognitoIDPIdentityProvider_disappears
=== RUN   TestAccCognitoIDPIdentityProvider_Disappears_userPool
=== PAUSE TestAccCognitoIDPIdentityProvider_Disappears_userPool
=== CONT  TestAccCognitoIDPIdentityProvider_basic
=== CONT  TestAccCognitoIDPIdentityProvider_disappears
=== CONT  TestAccCognitoIDPIdentityProvider_idpIdentifiers
=== CONT  TestAccCognitoIDPIdentityProvider_Disappears_userPool
--- PASS: TestAccCognitoIDPIdentityProvider_disappears (22.24s)
--- PASS: TestAccCognitoIDPIdentityProvider_Disappears_userPool (22.85s)
--- PASS: TestAccCognitoIDPIdentityProvider_basic (36.34s)
--- PASS: TestAccCognitoIDPIdentityProvider_idpIdentifiers (36.98s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp 43.565s```

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Hey @jdoetsch-built 👋 Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's Allowing changes to a pull request branch created from a fork documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)

[github-actions]

Welcome @jdoetsch-built 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[ewbankkit]

@jdoetsch-built Thanks for the contribution 🎉 👏.
This work has been rolled into #35236.

[ewbankkit]

LGTM 🚀.

Without fix

% make testacc TESTARGS='-run=TestAccCognitoIDPIdentityProvider_saml' PKG=cognitoidp
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/cognitoidp/... -v -count 1 -parallel 20  -run=TestAccCognitoIDPIdentityProvider_saml -timeout 360m
=== RUN   TestAccCognitoIDPIdentityProvider_saml
=== PAUSE TestAccCognitoIDPIdentityProvider_saml
=== CONT  TestAccCognitoIDPIdentityProvider_saml
    identity_provider_test.go:127: Step 3/3 error: Error running apply: exit status 1
        
        Error: updating Cognito Identity Provider (us-west-2_ze0q6j44K:tf-acc-test-5350296439128389312): InvalidParameterException: ActiveEncryptionCertificate is not a valid key for SAML identity provider details.
        
          with aws_cognito_identity_provider.test,
          on terraform_plugin_test.tf line 17, in resource "aws_cognito_identity_provider" "test":
          17: resource "aws_cognito_identity_provider" "test" {
        
--- FAIL: TestAccCognitoIDPIdentityProvider_saml (25.75s)
FAIL
FAIL	github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp	32.547s
FAIL
make: *** [testacc] Error 1

With fix

% make testacc TESTARGS='-run=TestAccCognitoIDPIdentityProvider_saml' PKG=cognitoidp
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/cognitoidp/... -v -count 1 -parallel 20  -run=TestAccCognitoIDPIdentityProvider_saml -timeout 360m
=== RUN   TestAccCognitoIDPIdentityProvider_saml
=== PAUSE TestAccCognitoIDPIdentityProvider_saml
=== CONT  TestAccCognitoIDPIdentityProvider_saml
--- PASS: TestAccCognitoIDPIdentityProvider_saml (32.47s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp	39.770s

[github-actions]

This functionality has been released in v5.41.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.