r/aws_secretsmanager_secret_rotation: Fix failing schedule expression updates

.changelog/31915.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_secretsmanager_secret_rotation: Fix `InvalidParameterException: You cannot specify both rotation frequency and schedule expression together` errors on resource Update
+```

internal/service/secretsmanager/secret_rotation.go

@@ -182,7 +182,6 @@ func resourceSecretRotationDelete(ctx context.Context, d *schema.ResourceData, m
  var diags diag.Diagnostics
  conn := meta.(*conns.AWSClient).SecretsManagerConn(ctx)
 
- log.Printf("[DEBUG] Deleting Secrets Manager Rotation: %s", d.Id())
  _, err := conn.CancelRotateSecretWithContext(ctx, &secretsmanager.CancelRotateSecretInput{
  SecretId: aws.String(d.Get("secret_id").(string)),
  })
@@ -224,7 +223,8 @@ func flattenRotationRules(rules *secretsmanager.RotationRulesType) []interface{}
 
  m := map[string]interface{}{}
 
- if v := rules.AutomaticallyAfterDays; v != nil {
+ if v := rules.AutomaticallyAfterDays; v != nil && rules.ScheduleExpression == nil {
+ // Only populate automatically_after_days if schedule_expression is not set, otherwise we won't be able to update the resource
  m["automatically_after_days"] = int(aws.Int64Value(v))
  }
 

internal/service/secretsmanager/secret_rotation_test.go

@@ -109,6 +109,52 @@ func TestAccSecretsManagerSecretRotation_scheduleExpression(t *testing.T) {
  })
 }
 
+func TestAccSecretsManagerSecretRotation_scheduleExpressionHours(t *testing.T) {
+ ctx := acctest.Context(t)
+ var secret secretsmanager.DescribeSecretOutput
+ rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+ resourceName := "aws_secretsmanager_secret_rotation.test"
+ lambdaFunctionResourceName := "aws_lambda_function.test1"
+ scheduleExpression := "rate(6 hours)"
+ scheduleExpression02 := "rate(10 hours)"
+ resource.ParallelTest(t, resource.TestCase{
+ PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+ ErrorCheck: acctest.ErrorCheck(t, secretsmanager.EndpointsID),
+ ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+ CheckDestroy: testAccCheckSecretRotationDestroy(ctx),
+ Steps: []resource.TestStep{
+ // Test creating secret rotation resource
+ {
+ Config: testAccSecretRotationConfig_scheduleExpression(rName, scheduleExpression),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckSecretRotationExists(ctx, resourceName, &secret),
+ resource.TestCheckResourceAttr(resourceName, "rotation_enabled", "true"),
+ resource.TestCheckResourceAttrPair(resourceName, "rotation_lambda_arn", lambdaFunctionResourceName, "arn"),
+ resource.TestCheckResourceAttr(resourceName, "rotation_rules.#", "1"),
+ resource.TestCheckResourceAttr(resourceName, "rotation_rules.0.schedule_expression", scheduleExpression),
+ testSecretValueIsCurrent(ctx, rName),
+ ),
+ },
+ {
+ Config: testAccSecretRotationConfig_scheduleExpression(rName, scheduleExpression02),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckSecretRotationExists(ctx, resourceName, &secret),
+ resource.TestCheckResourceAttr(resourceName, "rotation_enabled", "true"),
+ resource.TestCheckResourceAttrPair(resourceName, "rotation_lambda_arn", lambdaFunctionResourceName, "arn"),
+ resource.TestCheckResourceAttr(resourceName, "rotation_rules.#", "1"),
+ resource.TestCheckResourceAttr(resourceName, "rotation_rules.0.schedule_expression", scheduleExpression02),
+ ),
+ },
+ // Test importing secret rotation
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ },
+ },
+ })
+}
+
 func TestAccSecretsManagerSecretRotation_duration(t *testing.T) {
  ctx := acctest.Context(t)
  var secret secretsmanager.DescribeSecretOutput
@@ -358,3 +404,36 @@ resource "aws_secretsmanager_secret_rotation" "test" {
 }
 `, rName, automaticallyAfterDays, duration))
 }
+
+func testSecretValueIsCurrent(ctx context.Context, rName string) resource.TestCheckFunc {
+ return func(s *terraform.State) error {
+ conn := acctest.Provider.Meta().(*conns.AWSClient).SecretsManagerConn(ctx)
+ // Write secret value to clear in-rotation state, otherwise updating the secret rotation
+ // will fail with "A previous rotation isn't complete. That rotation will be reattempted."
+ put_secret_input := &secretsmanager.PutSecretValueInput{
+ SecretId: aws.String(rName),
+ SecretString: aws.String("secret-value"),
+ }
+ _, err := conn.PutSecretValueWithContext(ctx, put_secret_input)
+ if err != nil {
+ return err
+ }
+ input := &secretsmanager.DescribeSecretInput{
+ SecretId: aws.String(rName),
+ }
+ output, err := conn.DescribeSecretWithContext(ctx, input)
+ if err != nil {
+ return err
+ } else {
+ // Ensure that the current version of the secret is in the AWSCURRENT stage
+ for _, stage := range output.VersionIdsToStages {
+ if *stage[0] == "AWSCURRENT" {
+ return nil
+ } else {
+ return fmt.Errorf("Secret version is not in AWSCURRENT stage: %s", *stage[0])
+ }
+ }
+ return nil
+ }
+ }
+}