r/aws_iam_user_login_profile: prevent password_reset_required persistent diff

.changelog/36926.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_iam_user_login_profile: Fix forced re-creation when `password_reset_required` is `true` and initial password reset is completed
+```

internal/service/iam/user_login_profile.go

@@ -176,7 +176,7 @@ func resourceUserLoginProfileCreate(ctx context.Context, d *schema.ResourceData,
  d.Set("password", initialPassword)
  }
 
- return diags
+ return append(diags, resourceUserLoginProfileRead(ctx, d, meta)...)
 }
 
 func resourceUserLoginProfileRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -223,11 +223,7 @@ func resourceUserLoginProfileRead(ctx context.Context, d *schema.ResourceData, m
  return sdkdiag.AppendErrorf(diags, "reading IAM User Login Profile (%s): empty response", d.Id())
  }
 
- loginProfile := output.LoginProfile
-
- d.Set("user", loginProfile.UserName)
- d.Set("password_reset_required", loginProfile.PasswordResetRequired)
-
+ d.Set("user", output.LoginProfile.UserName)
  return diags
 }
 

internal/service/iam/user_login_profile_test.go

@@ -293,6 +293,47 @@ func TestAccIAMUserLoginProfile_disappears(t *testing.T) {
  })
 }
 
+func TestAccIAMUserLoginProfile_passwordResetRequired(t *testing.T) {
+ ctx := acctest.Context(t)
+ var conf iam.GetLoginProfileOutput
+
+ resourceName := "aws_iam_user_login_profile.test"
+ rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+ resource.ParallelTest(t, resource.TestCase{
+ PreCheck: func() { acctest.PreCheck(ctx, t) },
+ ErrorCheck: acctest.ErrorCheck(t, names.IAMServiceID),
+ ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+ CheckDestroy: testAccCheckUserLoginProfileDestroy(ctx),
+ Steps: []resource.TestStep{
+ {
+ Config: testAccUserLoginProfileConfig_passwordResetRequired(rName, testPubKey1),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckUserLoginProfileExists(ctx, resourceName, &conf),
+ testDecryptPasswordAndTest(ctx, resourceName, "aws_iam_access_key.test", testPrivKey1),
+ resource.TestCheckResourceAttrSet(resourceName, "encrypted_password"),
+ resource.TestCheckResourceAttrSet(resourceName, "key_fingerprint"),
+ resource.TestCheckResourceAttr(resourceName, "password_length", "20"),
+ resource.TestCheckResourceAttr(resourceName, "password_reset_required", "true"),
+ resource.TestCheckResourceAttr(resourceName, "pgp_key", testPubKey1+"\n"),
+ ),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateVerifyIgnore: []string{
+ "encrypted_password",
+ "key_fingerprint",
+ "password_length",
+ "password_reset_required",
+ "pgp_key",
+ },
+ },
+ },
+ })
+}
+
 func testAccCheckUserLoginProfileDestroy(ctx context.Context) resource.TestCheckFunc {
  return func(s *terraform.State) error {
  conn := acctest.Provider.Meta().(*conns.AWSClient).IAMClient(ctx)
@@ -458,6 +499,21 @@ EOF
 `, passwordLength, pgpKey))
 }
 
+func testAccUserLoginProfileConfig_passwordResetRequired(rName, pgpKey string) string {
+ return acctest.ConfigCompose(
+ testAccUserLoginProfileConfig_base(rName),
+ fmt.Sprintf(`
+resource "aws_iam_user_login_profile" "test" {
+ user = aws_iam_user.test.name
+ password_reset_required = true
+
+ pgp_key = <<EOF
+%s
+EOF
+}
+`, pgpKey))
+}
+
 func testAccUserLoginProfileConfig_required(rName, pgpKey string) string {
  return acctest.ConfigCompose(testAccUserLoginProfileConfig_base(rName), fmt.Sprintf(`
 resource "aws_iam_user_login_profile" "test" {