r/codeartifact_domain - make encryption_key optional

.changelog/17262.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_codeartifact_domain: Make `encryption_key` optional
+```

aws/resource_aws_codeartifact_domain.go

@@ -35,7 +35,8 @@ func resourceAwsCodeArtifactDomain() *schema.Resource {
 			},
 			"encryption_key": {
 				Type:         schema.TypeString,
-				Required:     true,
+				Optional:     true,
+				Computed:     true,
 				ForceNew:     true,
 				ValidateFunc: validateArn,
 			},
@@ -65,9 +66,12 @@ func resourceAwsCodeArtifactDomainCreate(d *schema.ResourceData, meta interface{
 	log.Print("[DEBUG] Creating CodeArtifact Domain")
 
 	params := &codeartifact.CreateDomainInput{
-		Domain:        aws.String(d.Get("domain").(string)),
-		EncryptionKey: aws.String(d.Get("encryption_key").(string)),
-		Tags:          keyvaluetags.New(d.Get("tags").(map[string]interface{})).IgnoreAws().CodeartifactTags(),
+		Domain: aws.String(d.Get("domain").(string)),
+		Tags:   keyvaluetags.New(d.Get("tags").(map[string]interface{})).IgnoreAws().CodeartifactTags(),
+	}
+
+	if v, ok := d.GetOk("encryption_key"); ok {
+		params.EncryptionKey = aws.String(v.(string))
 	}
 
 	domain, err := conn.CreateDomain(params)

aws/resource_aws_codeartifact_domain_test.go

@@ -3,6 +3,7 @@ package aws
 import (
 	"fmt"
 	"log"
+	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -98,6 +99,37 @@ func TestAccAWSCodeArtifactDomain_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSCodeArtifactDomain_defaultencryptionkey(t *testing.T) {
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_codeartifact_domain.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccPartitionHasServicePreCheck("codeartifact", t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSCodeArtifactDomainDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSCodeArtifactDomainDefaultEncryptionKeyConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSCodeArtifactDomainExists(resourceName),
+					testAccCheckResourceAttrRegionalARN(resourceName, "arn", "codeartifact", fmt.Sprintf("domain/%s", rName)),
+					testAccMatchResourceAttrRegionalARN(resourceName, "encryption_key", "kms", regexp.MustCompile(`key/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "domain", rName),
+					resource.TestCheckResourceAttr(resourceName, "asset_size_bytes", "0"),
+					resource.TestCheckResourceAttr(resourceName, "repository_count", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "created_time"),
+					testAccCheckResourceAttrAccountID(resourceName, "owner"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccAWSCodeArtifactDomain_tags(t *testing.T) {
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_codeartifact_domain.test"
@@ -150,7 +182,7 @@ func TestAccAWSCodeArtifactDomain_disappears(t *testing.T) {
 		CheckDestroy: testAccCheckAWSCodeArtifactDomainDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSCodeArtifactDomainBasicConfig(rName),
+				Config: testAccAWSCodeArtifactDomainDefaultEncryptionKeyConfig(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSCodeArtifactDomainExists(resourceName),
 					testAccCheckResourceDisappears(testAccProvider, resourceAwsCodeArtifactDomain(), resourceName),
@@ -238,14 +270,8 @@ resource "aws_codeartifact_domain" "test" {
 
 func testAccAWSCodeArtifactDomainConfigTags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
-resource "aws_kms_key" "test" {
-  description             = %[1]q
-  deletion_window_in_days = 7
-}
-
 resource "aws_codeartifact_domain" "test" {
-  domain         = %[1]q
-  encryption_key = aws_kms_key.test.arn
+  domain = %[1]q
 
   tags = {
     %[2]q = %[3]q
@@ -256,14 +282,8 @@ resource "aws_codeartifact_domain" "test" {
 
 func testAccAWSCodeArtifactDomainConfigTags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
-resource "aws_kms_key" "test" {
-  description             = %[1]q
-  deletion_window_in_days = 7
-}
-
 resource "aws_codeartifact_domain" "test" {
-  domain         = %[1]q
-  encryption_key = aws_kms_key.test.arn
+  domain = %[1]q
 
   tags = {
     %[2]q = %[3]q
@@ -272,3 +292,11 @@ resource "aws_codeartifact_domain" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccAWSCodeArtifactDomainDefaultEncryptionKeyConfig(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codeartifact_domain" "test" {
+  domain = %[1]q
+}
+`, rName)
+}

website/docs/r/codeartifact_domain.html.markdown

@@ -13,13 +13,8 @@ Provides a CodeArtifact Domain Resource.
 ## Example Usage
 
 ```hcl
-resource "aws_kms_key" "example" {
-  description = "domain key"
-}
-
 resource "aws_codeartifact_domain" "example" {
-  domain         = "example"
-  encryption_key = aws_kms_key.example.arn
+  domain = "example"
 }
 ```
 
@@ -28,7 +23,7 @@ resource "aws_codeartifact_domain" "example" {
 The following arguments are supported:
 
 * `domain` - (Required) The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
-* `encryption_key` - (Required) The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN).
+* `encryption_key` - (Optional) The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
 * `tags` - (Optional) Key-value map of resource tags.
 
 ## Attributes Reference