Check err != nil after !d.IsNewResource() && tfresource.NotFound()

.changelog/38512.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_timestreamwrite_table: Fix `runtime error: invalid memory address or nil pointer dereference` panic when reading a non-existent table
+```

.ci/semgrep/errors/error-checks.yml

@@ -57,3 +57,34 @@ rules:
       - pattern-not-inside: |
           tfresource.RetryWhen(...)
     severity: ERROR
+
+  - id: isnewresource-notfound-without-err-checks
+    languages: [go]
+    message: When checking for !d.IsNewResource() && tfresource.NotFound() errors, typically other error conditions should be checked.
+    patterns:
+      - pattern: |
+          if !d.IsNewResource() && tfresource.NotFound($ERR) { ... }
+      - pattern-not-inside: |
+          if !d.IsNewResource() && tfresource.NotFound($ERR) { ... }
+          if $ERR != nil { ... }
+      # e.g. internal/service/dms/s3_endpoint.go
+      - pattern-not-inside: |
+          if !d.IsNewResource() && tfresource.NotFound($ERR) { ... }
+          if $ERR == nil && ... {
+            ...
+            err = ...
+            ...
+          }
+          if $ERR != nil { ... }
+      # e.g. internal/service/quicksight/analysis.go
+      - pattern-not-inside: |
+          if !d.IsNewResource() && tfresource.NotFound($ERR) { ... }
+          if !d.IsNewResource() && ... { ... }
+          if $ERR != nil { ... }
+      # e.g. internal/service/sagemaker/app.go
+      - pattern-not-inside: |
+          if err != nil {
+            if !d.IsNewResource() && tfresource.NotFound($ERR) { ... }
+            return ...
+          }
+    severity: ERROR

internal/service/chime/voice_connector_logging.go

@@ -92,6 +92,10 @@ func resourceVoiceConnectorLoggingRead(ctx context.Context, d *schema.ResourceDa
 		return diags
 	}
 
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Chime Voice Connector logging configuration (%s): %s", d.Id(), err)
+	}
+
 	d.Set("enable_media_metric_logs", resp.EnableMediaMetricLogs)
 	d.Set("enable_sip_logs", resp.EnableSIPLogs)
 	d.Set("voice_connector_id", d.Id())

internal/service/chimesdkvoice/sip_media_application.go

@@ -106,6 +106,10 @@ func resourceSipMediaApplicationRead(ctx context.Context, d *schema.ResourceData
 		return diags
 	}
 
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Chime Sip Media Application (%s): %s", d.Id(), err)
+	}
+
 	d.Set(names.AttrARN, resp.SipMediaApplicationArn)
 	d.Set("aws_region", resp.AwsRegion)
 	d.Set(names.AttrName, resp.Name)

internal/service/chimesdkvoice/sip_rule.go

@@ -122,6 +122,10 @@ func resourceSipRuleRead(ctx context.Context, d *schema.ResourceData, meta inter
 		return diags
 	}
 
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading ChimeSKVoice Sip Rule (%s): %s", d.Id(), err)
+	}
+
 	d.Set(names.AttrName, resp.Name)
 	d.Set("disabled", resp.Disabled)
 	d.Set("trigger_type", resp.TriggerType)

internal/service/timestreamwrite/table.go

@@ -233,6 +233,10 @@ func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		return diags
 	}
 
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Timestream Table (%s): %s", d.Id(), err)
+	}
+
 	d.Set(names.AttrARN, table.Arn)
 	d.Set(names.AttrDatabaseName, table.DatabaseName)
 	if err := d.Set("magnetic_store_write_properties", flattenMagneticStoreWriteProperties(table.MagneticStoreWriteProperties)); err != nil {