fix #35491

.changelog/35501.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_user_group: Allow import of user groups with names containing `/`
+```

internal/service/cognitoidp/consts.go

@@ -11,7 +11,6 @@ const (
  ResNameIdentityProvider = "Identity Provider"
  ResNameResourceServer = "Resource Server"
  ResNameRiskConfiguration = "Risk Configuration"
- ResNameUserGroup = "User Group"
  ResNameUserPoolClient = "User Pool Client"
  ResNameUserPoolDomain = "User Pool Domain"
  ResNameUserPool = "User Pool"

internal/service/cognitoidp/exports_test.go

@@ -5,6 +5,9 @@ package cognitoidp
 
 // Exports for use in tests only.
 var (
+ ResourceUserGroup = resourceUserGroup
  ResourceUserPoolClient = newResourceUserPoolClient
  ResourceManagedUserPoolClient = newResourceManagedUserPoolClient
+
+ FindGroupByTwoPartKey = findGroupByTwoPartKey
 )

internal/service/cognitoidp/user_group.go

@@ -12,19 +12,19 @@ import (
 
  "github.com/aws/aws-sdk-go/aws"
  "github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
+ "github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
  "github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+ "github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
  "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
  "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
  "github.com/hashicorp/terraform-provider-aws/internal/conns"
- "github.com/hashicorp/terraform-provider-aws/internal/create"
  "github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
  "github.com/hashicorp/terraform-provider-aws/internal/tfresource"
  "github.com/hashicorp/terraform-provider-aws/internal/verify"
- "github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_cognito_user_group")
-func ResourceUserGroup() *schema.Resource {
+// @SDKResource("aws_cognito_user_group", name="User Group")
+func resourceUserGroup() *schema.Resource {
  return &schema.Resource{
  CreateWithoutTimeout: resourceUserGroupCreate,
  ReadWithoutTimeout: resourceUserGroupRead,
@@ -71,31 +71,31 @@ func resourceUserGroupCreate(ctx context.Context, d *schema.ResourceData, meta i
  var diags diag.Diagnostics
  conn := meta.(*conns.AWSClient).CognitoIDPConn(ctx)
 
- params := &cognitoidentityprovider.CreateGroupInput{
- GroupName: aws.String(d.Get("name").(string)),
+ name := d.Get("name").(string)
+ input := &cognitoidentityprovider.CreateGroupInput{
+ GroupName: aws.String(name),
  UserPoolId: aws.String(d.Get("user_pool_id").(string)),
  }
 
  if v, ok := d.GetOk("description"); ok {
- params.Description = aws.String(v.(string))
+ input.Description = aws.String(v.(string))
  }
 
  if v, ok := d.GetOk("precedence"); ok {
- params.Precedence = aws.Int64(int64(v.(int)))
+ input.Precedence = aws.Int64(int64(v.(int)))
  }
 
  if v, ok := d.GetOk("role_arn"); ok {
- params.RoleArn = aws.String(v.(string))
+ input.RoleArn = aws.String(v.(string))
  }
 
- log.Print("[DEBUG] Creating Cognito User Group")
+ output, err := conn.CreateGroupWithContext(ctx, input)
 
- resp, err := conn.CreateGroupWithContext(ctx, params)
  if err != nil {
- return sdkdiag.AppendErrorf(diags, "creating Cognito User Group: %s", err)
+ return sdkdiag.AppendErrorf(diags, "creating Cognito User Group (%s): %s", name, err)
  }
 
- d.SetId(fmt.Sprintf("%s/%s", *resp.Group.UserPoolId, *resp.Group.GroupName))
+ d.SetId(userGroupCreateResourceID(aws.StringValue(output.Group.UserPoolId), aws.StringValue(output.Group.GroupName)))
 
  return append(diags, resourceUserGroupRead(ctx, d, meta)...)
 }
@@ -104,27 +104,26 @@ func resourceUserGroupRead(ctx context.Context, d *schema.ResourceData, meta int
  var diags diag.Diagnostics
  conn := meta.(*conns.AWSClient).CognitoIDPConn(ctx)
 
- params := &cognitoidentityprovider.GetGroupInput{
-  GroupName: aws.String(d.Get("name").(string)),
- UserPoolId: aws.String(d.Get("user_pool_id").(string)),
+ userPoolID, groupName, err := userGroupParseResourceID(d.Id())
+ if err != nil {
+ return sdkdiag.AppendFromErr(diags, err)
  }
 
- log.Print("[DEBUG] Reading Cognito User Group")
+ group, err := findGroupByTwoPartKey(ctx, conn, userPoolID, groupName)
 
- resp, err := conn.GetGroupWithContext(ctx, params)
  if !d.IsNewResource() && tfresource.NotFound(err) {
- create.LogNotFoundRemoveState(names.CognitoIDP, create.ErrActionReading, ResNameUserGroup, d.Get("name").(string))
+ log.Printf("[WARN] Cognito User Group %s not found, removing from state", d.Id())
  d.SetId("")
  return diags
  }
 
  if err != nil {
- return create.AppendDiagError(diags, names.CognitoIDP, create.ErrActionReading, ResNameUserGroup, d.Get("name").(string), err)
+ return sdkdiag.AppendErrorf(diags, "reading Cognito User Group (%s): %s", d.Id(), err)
  }
 
- d.Set("description", resp.Group.Description)
- d.Set("precedence", resp.Group.Precedence)
- d.Set("role_arn", resp.Group.RoleArn)
+ d.Set("description", group.Description)
+ d.Set("precedence", group.Precedence)
+ d.Set("role_arn", group.RoleArn)
 
  return diags
 }
@@ -133,28 +132,32 @@ func resourceUserGroupUpdate(ctx context.Context, d *schema.ResourceData, meta i
  var diags diag.Diagnostics
  conn := meta.(*conns.AWSClient).CognitoIDPConn(ctx)
 
- params := &cognitoidentityprovider.UpdateGroupInput{
- GroupName: aws.String(d.Get("name").(string)),
- UserPoolId: aws.String(d.Get("user_pool_id").(string)),
+ userPoolID, groupName, err := userGroupParseResourceID(d.Id())
+ if err != nil {
+ return sdkdiag.AppendFromErr(diags, err)
+ }
+
+ input := &cognitoidentityprovider.UpdateGroupInput{
+ GroupName: aws.String(groupName),
+ UserPoolId: aws.String(userPoolID),
  }
 
  if d.HasChange("description") {
- params.Description = aws.String(d.Get("description").(string))
+ input.Description = aws.String(d.Get("description").(string))
  }
 
  if d.HasChange("precedence") {
- params.Precedence = aws.Int64(int64(d.Get("precedence").(int)))
+ input.Precedence = aws.Int64(int64(d.Get("precedence").(int)))
  }
 
  if d.HasChange("role_arn") {
- params.RoleArn = aws.String(d.Get("role_arn").(string))
+ input.RoleArn = aws.String(d.Get("role_arn").(string))
  }
 
- log.Print("[DEBUG] Updating Cognito User Group")
+ _, err = conn.UpdateGroupWithContext(ctx, input)
 
- _, err := conn.UpdateGroupWithContext(ctx, params)
  if err != nil {
- return sdkdiag.AppendErrorf(diags, "updating Cognito User Group: %s", err)
+ return sdkdiag.AppendErrorf(diags, "updating Cognito User Group (%s): %s", d.Id(), err)
  }
 
  return append(diags, resourceUserGroupRead(ctx, d, meta)...)
@@ -164,29 +167,81 @@ func resourceUserGroupDelete(ctx context.Context, d *schema.ResourceData, meta i
  var diags diag.Diagnostics
  conn := meta.(*conns.AWSClient).CognitoIDPConn(ctx)
 
- params := &cognitoidentityprovider.DeleteGroupInput{
-  GroupName: aws.String(d.Get("name").(string)),
- UserPoolId: aws.String(d.Get("user_pool_id").(string)),
+ userPoolID, groupName, err := userGroupParseResourceID(d.Id())
+ if err != nil {
+ return sdkdiag.AppendFromErr(diags, err)
  }
 
- log.Print("[DEBUG] Deleting Cognito User Group")
+ log.Printf("[DEBUG] Deleting Cognito User Group: %s", d.Id())
+ _, err = conn.DeleteGroupWithContext(ctx, &cognitoidentityprovider.DeleteGroupInput{
+ GroupName: aws.String(groupName),
+ UserPoolId: aws.String(userPoolID),
+ })
+
+ if tfawserr.ErrCodeEquals(err, cognitoidentityprovider.ErrCodeResourceNotFoundException) {
+ return diags
+ }
 
- _, err := conn.DeleteGroupWithContext(ctx, params)
  if err != nil {
- return sdkdiag.AppendErrorf(diags, "deleting Cognito User Group: %s", err)
+ return sdkdiag.AppendErrorf(diags, "deleting Cognito User Group (%s): %s", d.Id(), err)
  }
 
  return diags
 }
 
 func resourceUserGroupImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
- idSplit := strings.Split(d.Id(), "/")
- if len(idSplit) != 2 {
+ parts := strings.SplitN(d.Id(), "/", 2)
+ if len(parts) != 2 {
  return nil, errors.New("Error importing Cognito User Group. Must specify user_pool_id/group_name")
  }
- userPoolId := idSplit[0]
- name := idSplit[1]
- d.Set("user_pool_id", userPoolId)
- d.Set("name", name)
+
+ d.Set("user_pool_id", parts[0])
+ d.Set("name", parts[1])
+
  return []*schema.ResourceData{d}, nil
 }
+
+const userGroupResourceIDSeparator = "/"
+
+func userGroupCreateResourceID(userPoolID, groupName string) string {
+ parts := []string{userPoolID, groupName}
+ id := strings.Join(parts, userGroupResourceIDSeparator)
+
+ return id
+}
+
+func userGroupParseResourceID(id string) (string, string, error) {
+ parts := strings.SplitN(id, userGroupResourceIDSeparator, 2)
+
+ if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
+ return parts[0], parts[1], nil
+ }
+
+ return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected USERPOOLID%[2]sGROUPNAME", id, userGroupResourceIDSeparator)
+}
+
+func findGroupByTwoPartKey(ctx context.Context, conn *cognitoidentityprovider.CognitoIdentityProvider, userPoolID, groupName string) (*cognitoidentityprovider.GroupType, error) {
+ input := &cognitoidentityprovider.GetGroupInput{
+ GroupName: aws.String(groupName),
+ UserPoolId: aws.String(userPoolID),
+ }
+
+ output, err := conn.GetGroupWithContext(ctx, input)
+
+ if tfawserr.ErrCodeEquals(err, cognitoidentityprovider.ErrCodeResourceNotFoundException) {
+ return nil, &retry.NotFoundError{
+ LastError: err,
+ LastRequest: input,
+ }
+ }
+
+ if err != nil {
+ return nil, err
+ }
+
+ if output == nil || output.Group == nil {
+ return nil, tfresource.NewEmptyResultError(input)
+ }
+
+ return output.Group, nil
+}