sagemaker/model_package_group_policy: Fix equivalent policy diffs

.changelog/22259.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sagemaker_model_package_group_policy: Fix erroneous diffs in `resource_policy` when no changes made or policies are equivalent
+```

internal/service/sagemaker/model_package_group_policy.go

@@ -8,6 +8,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -35,6 +36,10 @@ func ResourceModelPackageGroupPolicy() *schema.Resource {
 				Required:         true,
 				ValidateFunc:     validation.StringIsJSON,
 				DiffSuppressFunc: verify.SuppressEquivalentPolicyDiffs,
+				StateFunc: func(v interface{}) string {
+					json, _ := structure.NormalizeJsonString(v)
+					return json
+				},
 			},
 		},
 	}
@@ -43,13 +48,19 @@ func ResourceModelPackageGroupPolicy() *schema.Resource {
 func resourceModelPackageGroupPolicyPut(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*conns.AWSClient).SageMakerConn
 
+	policy, err := structure.NormalizeJsonString(d.Get("resource_policy").(string))
+
+	if err != nil {
+		return fmt.Errorf("policy (%s) is invalid JSON: %w", d.Get("resource_policy").(string), err)
+	}
+
 	name := d.Get("model_package_group_name").(string)
 	input := &sagemaker.PutModelPackageGroupPolicyInput{
 		ModelPackageGroupName: aws.String(name),
-		ResourcePolicy:        aws.String(d.Get("resource_policy").(string)),
+		ResourcePolicy:        aws.String(policy),
 	}
 
-	_, err := conn.PutModelPackageGroupPolicy(input)
+	_, err = conn.PutModelPackageGroupPolicy(input)
 	if err != nil {
 		return fmt.Errorf("error creating SageMaker Model Package Group Policy %s: %w", name, err)
 	}
@@ -74,7 +85,14 @@ func resourceModelPackageGroupPolicyRead(d *schema.ResourceData, meta interface{
 	}
 
 	d.Set("model_package_group_name", d.Id())
-	d.Set("resource_policy", mpg.ResourcePolicy)
+
+	policyToSet, err := verify.PolicyToSet(d.Get("resource_policy").(string), aws.StringValue(mpg.ResourcePolicy))
+
+	if err != nil {
+		return err
+	}
+
+	d.Set("resource_policy", policyToSet)
 
 	return nil
 }

internal/service/sagemaker/model_package_group_policy_test.go

@@ -136,14 +136,15 @@ func testAccCheckModelPackageGroupPolicyExists(n string, mpg *sagemaker.GetModel
 func testAccModelPackageGroupPolicyBasicConfig(rName string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
 
 data "aws_iam_policy_document" "test" {
   statement {
     sid       = "AddPermModelPackageGroup"
     actions   = ["sagemaker:DescribeModelPackage", "sagemaker:ListModelPackages"]
     resources = [aws_sagemaker_model_package_group.test.arn]
     principals {
-      identifiers = [data.aws_caller_identity.current.account_id]
+      identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
       type        = "AWS"
     }
   }