r/aws_sqs_queue: Send any configured value of sqs_managed_sse_enabled on Create

.changelog/27335.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sqs_queue: Respect configured `sqs_managed_sse_enabled` value on resource Create. In particular a configured `false` value is sent to the AWS API, which overrides the [new service default value of `true`](https://aws.amazon.com/about-aws/whats-new/2022/10/amazon-sqs-announces-server-side-encryption-ssq-managed-sse-sqs-default/) 
+```

internal/attrmap/attrmap.go

@@ -13,13 +13,14 @@ import (
 // AttributeMap represents a map of Terraform resource attribute name to AWS API attribute name.
 // Useful for SQS Queue or SNS Topic attribute handling.
 type attributeInfo struct {
-	apiAttributeName string
-	tfType           schema.ValueType
-	tfComputed       bool
-	tfOptional       bool
-	isIAMPolicy      bool
-	missingSetToNil  bool
-	skipUpdate       bool
+	alwaysSendConfiguredValueOnCreate bool
+	apiAttributeName                  string
+	tfType                            schema.ValueType
+	tfComputed                        bool
+	tfOptional                        bool
+	isIAMPolicy                       bool
+	missingSetToNil                   bool
+	skipUpdate                        bool
 }
 
 type AttributeMap map[string]attributeInfo
@@ -106,11 +107,12 @@ func (m AttributeMap) ResourceDataToAPIAttributesCreate(d *schema.ResourceData)
 		}
 
 		var apiAttributeValue string
+		configuredValue := d.GetRawConfig().GetAttr(tfAttributeName)
 		tfOptionalComputed := attributeInfo.tfComputed && attributeInfo.tfOptional
 
 		switch v, t := d.Get(tfAttributeName), attributeInfo.tfType; t {
 		case schema.TypeBool:
-			if v := v.(bool); v {
+			if v := v.(bool); v || (attributeInfo.alwaysSendConfiguredValueOnCreate && !configuredValue.IsNull()) {
 				apiAttributeValue = strconv.FormatBool(v)
 			}
 		case schema.TypeInt:
@@ -201,6 +203,18 @@ func (m AttributeMap) APIAttributeNames() []string {
 	return apiAttributeNames
 }
 
+// WithAlwaysSendConfiguredBooleanValueOnCreate marks the specified Terraform Boolean attribute as always having any configured value sent on resource create.
+// By default a Boolean value is only sent to the API on resource create if its configured value is true.
+// This method is intended to be chained with other similar helper methods in a builder pattern.
+func (m AttributeMap) WithAlwaysSendConfiguredBooleanValueOnCreate(tfAttributeName string) AttributeMap {
+	if attributeInfo, ok := m[tfAttributeName]; ok && attributeInfo.tfType == schema.TypeBool {
+		attributeInfo.alwaysSendConfiguredValueOnCreate = true
+		m[tfAttributeName] = attributeInfo
+	}
+
+	return m
+}
+
 // WithIAMPolicyAttribute marks the specified Terraform attribute as holding an AWS IAM policy.
 // AWS IAM policies get special handling.
 // This method is intended to be chained with other similar helper methods in a builder pattern.

internal/service/sqs/queue.go

@@ -167,7 +167,7 @@ var (
 		"redrive_policy":                    sqs.QueueAttributeNameRedrivePolicy,
 		"sqs_managed_sse_enabled":           sqs.QueueAttributeNameSqsManagedSseEnabled,
 		"visibility_timeout_seconds":        sqs.QueueAttributeNameVisibilityTimeout,
-	}, queueSchema).WithIAMPolicyAttribute("policy").WithMissingSetToNil("*")
+	}, queueSchema).WithIAMPolicyAttribute("policy").WithMissingSetToNil("*").WithAlwaysSendConfiguredBooleanValueOnCreate("sqs_managed_sse_enabled")
 )
 
 func ResourceQueue() *schema.Resource {

internal/service/sqs/queue_test.go

@@ -653,6 +653,7 @@ func TestAccSQSQueue_encryption(t *testing.T) {
 					testAccCheckQueueExists(resourceName, &queueAttributes),
 					resource.TestCheckResourceAttr(resourceName, "kms_data_key_reuse_period_seconds", "300"),
 					resource.TestCheckResourceAttr(resourceName, "kms_master_key_id", "alias/aws/sqs"),
+					resource.TestCheckResourceAttr(resourceName, "sqs_managed_sse_enabled", "false"),
 				),
 			},
 			{
@@ -666,6 +667,50 @@ func TestAccSQSQueue_encryption(t *testing.T) {
 					testAccCheckQueueExists(resourceName, &queueAttributes),
 					resource.TestCheckResourceAttr(resourceName, "kms_data_key_reuse_period_seconds", "3600"),
 					resource.TestCheckResourceAttr(resourceName, "kms_master_key_id", "alias/aws/sqs"),
+					resource.TestCheckResourceAttr(resourceName, "sqs_managed_sse_enabled", "false"),
+				),
+			},
+			{
+				Config: testAccQueueConfig_managedEncryption(rName, "true"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckQueueExists(resourceName, &queueAttributes),
+					resource.TestCheckResourceAttr(resourceName, "kms_data_key_reuse_period_seconds", strconv.Itoa(tfsqs.DefaultQueueKMSDataKeyReusePeriodSeconds)),
+					resource.TestCheckResourceAttr(resourceName, "kms_master_key_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "sqs_managed_sse_enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccSQSQueue_managedEncryption(t *testing.T) {
+	var queueAttributes map[string]string
+	resourceName := "aws_sqs_queue.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sqs.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckQueueDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccQueueConfig_managedEncryption(rName, "null"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckQueueExists(resourceName, &queueAttributes),
+					resource.TestCheckResourceAttr(resourceName, "sqs_managed_sse_enabled", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccQueueConfig_managedEncryption(rName, "false"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckQueueExists(resourceName, &queueAttributes),
+					resource.TestCheckResourceAttr(resourceName, "sqs_managed_sse_enabled", "false"),
 				),
 			},
 			{