New Resource: aws_cloudfrontkeyvaluestore_key

[brittandeyoung]

Description

This pull requests adds the ability to create and manage Cloudfront Key Value Store Keys with terraform utilizing the aws_cloudfrontkeyvaluestore_key resource.

Relations

Closes #35793

References

Output from Acceptance Testing

% make testacc TESTARGS='-run=TestAccCloudFrontKeyValueStoreKey' PKG=cloudfrontkeyvaluestore
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.21.8 test ./internal/service/cloudfrontkeyvaluestore/... -v -count 1 -parallel 20  -run=TestAccCloudFrontKeyValueStoreKey -timeout 360m
=== RUN   TestAccCloudFrontKeyValueStoreKey_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_value
=== PAUSE TestAccCloudFrontKeyValueStoreKey_value
=== RUN   TestAccCloudFrontKeyValueStoreKey_disappears
=== PAUSE TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_value
=== CONT  TestAccCloudFrontKeyValueStoreKey_disappears
--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (28.79s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_disappears (37.95s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (46.48s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cloudfrontkeyvaluestore    52.515s
...

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccCloudFrontKeyValueStoreKey_' PKG=cloudfrontkeyvaluestore
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.21.8 test ./internal/service/cloudfrontkeyvaluestore/... -v -count 1 -parallel 20  -run=TestAccCloudFrontKeyValueStoreKey_ -timeout 360m
=== RUN   TestAccCloudFrontKeyValueStoreKey_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_value
=== PAUSE TestAccCloudFrontKeyValueStoreKey_value
=== RUN   TestAccCloudFrontKeyValueStoreKey_disappears
=== PAUSE TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_value
--- PASS: TestAccCloudFrontKeyValueStoreKey_disappears (48.63s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (55.16s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (64.36s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudfrontkeyvaluestore	75.352s

[ewbankkit]

@brittandeyoung Thanks for the contribution 🎉 👏.

[github-actions]

This functionality has been released in v5.43.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[lawliet89]

@brittandeyoung Thanks for adding this resource.

I think this resource needs to have some form of mutex or locking to prevent multiple key writes from happening at the same time.

Consider the following plan where multiple keys are being created

During the apply, the following errors will appear

I suspect this precondition is due to a race condition of multiple keys are being created in parallel and their etag being invalidated after the first one is created.

[brittandeyoung]

@lawliet89 From writing the resource, it appears to update the etag of the key_value_store each time it puts an item. I think your observation is correct that it is possible multiple updates at once could cause a race condition where there are multiple updates taking place at once. I will do some digging into the best way to solve this. I wonder if having the key_value_store_arn as an attribute would allow chaining the resources using either explicitly defined dependencies, or implicit dependencies by passing the arn into the next resource like so (This is sudo code that would not work currently).

resource "aws_cloudfront_key_value_store" "example" {
  name    = "ExampleKeyValueStore"
  comment = "This is an example key value store"
}

resource "aws_cloudfrontkeyvaluestore_key" "example1" {
  key_value_store_arn = aws_cloudfront_key_value_store.example.arn
  key                 = "Test Key"
  value               = "Test Value"
}

resource "aws_cloudfrontkeyvaluestore_key" "example2" {
  key_value_store_arn = aws_cloudfrontkeyvaluestore_key.example1.key_value_store_arn
  key                 = "Test Key"
  value               = "Test Value"
}

Do you think me adding this would solve for your use case?

[lawliet89]

@brittandeyoung This wouldn't work well when for_each is used to create keys.

I was thinking of doing something similar to aws_security_group_rule

terraform-provider-aws/internal/service/ec2/vpc_security_group_rule.go

Lines 161 to 162 in f88ea31

	conns.GlobalMutexKV.Lock(securityGroupID)
	defer conns.GlobalMutexKV.Unlock(securityGroupID)

The resource locks a mutex before it does anything, and defers an unlock when the function returns. The mutex key can be the ID/ARN of the KeyValueStore itself.

[brittandeyoung]

@lawliet89 I see, I was pointed to a similar method by the provider team. I will get a PR ready to resolve.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.