diff --git a/.changelog/39648.txt b/.changelog/39648.txt new file mode 100644 index 00000000000..c6080b4c458 --- /dev/null +++ b/.changelog/39648.txt @@ -0,0 +1,3 @@ +```release-note:enhancement +resource/aws_cloudwatch_event_rule: Add tags to AWS API request on Update to support [ABAC `aws:RequestTag` conditions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-requests) +``` \ No newline at end of file diff --git a/internal/service/events/rule.go b/internal/service/events/rule.go index 741d78e2866..0fe22b8cf1b 100644 --- a/internal/service/events/rule.go +++ b/internal/service/events/rule.go @@ -258,9 +258,17 @@ func resourceRuleUpdate(ctx context.Context, d *schema.ResourceData, meta interf } input := expandPutRuleInput(d, ruleName) + input.Tags = getTagsIn(ctx) // For ABAC aws:RequestTag condition. _, err = retryPutRule(ctx, conn, input) + // Some partitions (e.g. ISO) may not support tag-on-update. + if input.Tags != nil && errs.IsUnsupportedOperationInPartitionError(meta.(*conns.AWSClient).Partition, err) { + input.Tags = nil + + _, err = retryPutRule(ctx, conn, input) + } + if err != nil { return sdkdiag.AppendErrorf(diags, "updating EventBridge Rule (%s): %s", d.Id(), err) }