hashicorp · bflad · Jul 24, 2020 · Jul 22, 2020
diff --git a/aws/resource_aws_cognito_user_pool.go b/aws/resource_aws_cognito_user_pool.go
@@ -63,14 +63,6 @@ func resourceAwsCognitoUserPool() *schema.Resource {
 								},
 							},
 						},
-						"unused_account_validity_days": {
-							Type:          schema.TypeInt,
-							Optional:      true,
-							Computed:      true,
-							Deprecated:    "Use password_policy.temporary_password_validity_days instead",
-							ValidateFunc:  validation.IntBetween(0, 90),
-							ConflictsWith: []string{"password_policy.0.temporary_password_validity_days"},
-						},
 					},
 				},
 			},
@@ -301,10 +293,9 @@ func resourceAwsCognitoUserPool() *schema.Resource {
 							Optional: true,
 						},
 						"temporary_password_validity_days": {
-							Type:          schema.TypeInt,
-							Optional:      true,
-							ValidateFunc:  validation.IntBetween(0, 365),
-							ConflictsWith: []string{"admin_create_user_config.0.unused_account_validity_days"},
+							Type:         schema.TypeInt,
+							Optional:     true,
+							ValidateFunc: validation.IntBetween(0, 365),
 						},
 					},
 				},

diff --git a/aws/resource_aws_cognito_user_pool_test.go b/aws/resource_aws_cognito_user_pool_test.go
@@ -116,7 +116,6 @@ func TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration(t *testing.T) {
 				Config: testAccAWSCognitoUserPoolConfig_withAdminCreateUserConfiguration(name),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAWSCognitoUserPoolExists(resourceName),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "true"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and temporary password is {####}. "),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "FooBar {####}"),
@@ -128,21 +127,9 @@ func TestAccAWSCognitoUserPool_withAdminCreateUserConfiguration(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				Config: testAccAWSCognitoUserPoolConfig_withAdminCreateUserConfigurationUpdatedError(name),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "false"),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and constant password is {####}. "),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "Foo{####}BaBaz"),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.sms_message", "Your username is {username} and constant password is {####}."),
-				),
-				ExpectNonEmptyPlan: true,
-			},
 			{
 				Config: testAccAWSCognitoUserPoolConfig_withAdminCreateUserConfigurationUpdated(name),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and constant password is {####}. "),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "Foo{####}BaBaz"),
@@ -1104,7 +1091,6 @@ func TestAccAWSCognitoUserPool_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "email_verification_subject", "FooBar {####}"),
 					resource.TestCheckResourceAttr(resourceName, "sms_verification_message", "{####} Baz"),
 					resource.TestCheckResourceAttr(resourceName, "sms_authentication_message", authenticationMessage),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "true"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and temporary password is {####}. "),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "FooBar {####}"),
@@ -1133,7 +1119,6 @@ func TestAccAWSCognitoUserPool_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "email_verification_subject", "FooBar {####}"),
 					resource.TestCheckResourceAttr(resourceName, "sms_verification_message", "{####} Baz"),
 					resource.TestCheckResourceAttr(resourceName, "sms_authentication_message", updatedAuthenticationMessage),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "true"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and temporary password is {####}. "),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "FooBar {####}"),
@@ -1157,7 +1142,6 @@ func TestAccAWSCognitoUserPool_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "email_verification_subject", "FooBar {####}"),
 					resource.TestCheckResourceAttr(resourceName, "sms_verification_message", "{####} Baz"),
 					resource.TestCheckResourceAttr(resourceName, "sms_authentication_message", updatedAuthenticationMessage),
-					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.unused_account_validity_days", "6"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.allow_admin_create_user_only", "true"),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_message", "Your username is {username} and temporary password is {####}. "),
 					resource.TestCheckResourceAttr(resourceName, "admin_create_user_config.0.invite_message_template.0.email_subject", "FooBar {####}"),
@@ -1295,7 +1279,6 @@ resource "aws_cognito_user_pool" "test" {
 
   admin_create_user_config {
     allow_admin_create_user_only = true
-    unused_account_validity_days = 6
 
     invite_message_template {
       email_message = "Your username is {username} and temporary password is {####}. "
@@ -1307,33 +1290,13 @@ resource "aws_cognito_user_pool" "test" {
 `, name)
 }
 
-func testAccAWSCognitoUserPoolConfig_withAdminCreateUserConfigurationUpdatedError(name string) string {
-	return fmt.Sprintf(`
-resource "aws_cognito_user_pool" "test" {
-  name = "terraform-test-pool-%s"
-
-  admin_create_user_config {
-    allow_admin_create_user_only = false
-    unused_account_validity_days = 7
-
-    invite_message_template {
-      email_message = "Your username is {username} and constant password is {####}. "
-      email_subject = "Foo{####}BaBaz"
-      sms_message   = "Your username is {username} and constant password is {####}."
-    }
-  }
-}
-`, name)
-}
-
 func testAccAWSCognitoUserPoolConfig_withAdminCreateUserConfigurationUpdated(name string) string {
 	return fmt.Sprintf(`
 resource "aws_cognito_user_pool" "test" {
   name = "terraform-test-pool-%s"
 
   admin_create_user_config {
     allow_admin_create_user_only = false
-    unused_account_validity_days = 6
 
     invite_message_template {
       email_message = "Your username is {username} and constant password is {####}. "
@@ -1917,7 +1880,6 @@ resource "aws_cognito_user_pool" "test" {
 
   admin_create_user_config {
     allow_admin_create_user_only = true
-    unused_account_validity_days = 6
 
     invite_message_template {
       email_message = "Your username is {username} and temporary password is {####}. "

diff --git a/aws/structure.go b/aws/structure.go
@@ -2474,8 +2474,6 @@ func expandCognitoUserPoolAdminCreateUserConfig(config map[string]interface{}) *
 		}
 	}
 
-	configs.UnusedAccountValidityDays = aws.Int64(int64(config["unused_account_validity_days"].(int)))
-
 	return configs
 }
 
@@ -2510,8 +2508,6 @@ func flattenCognitoUserPoolAdminCreateUserConfig(s *cognitoidentityprovider.Admi
 		}
 	}
 
-	config["unused_account_validity_days"] = *s.UnusedAccountValidityDays
-
 	return []map[string]interface{}{config}
 }
 

diff --git a/website/docs/guides/version-3-upgrade.html.md b/website/docs/guides/version-3-upgrade.html.md
@@ -25,6 +25,7 @@ Upgrade topics:
 - [Resource: aws_acm_certificate](#resource-aws_acm_certificate)
 - [Resource: aws_api_gateway_method_settings](#resource-aws_api_gateway_method_settings)
 - [Resource: aws_autoscaling_group](#resource-aws_autoscaling_group)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
 - [Resource: aws_dx_gateway](#resource-aws_dx_gateway)
 - [Resource: aws_elastic_transcoder_preset](#resource-aws_elastic_transcoder_preset)
 - [Resource: aws_emr_cluster](#resource-aws_emr_cluster)
@@ -240,6 +241,40 @@ resource "aws_autoscaling_group" "example"{
 }
 ```
 
+## Resource: aws_cognito_user_pool
+
+### Removal of admin_create_user_config.unused_account_validity_days Argument
+
+The Cognito API previously deprecated the `admin_create_user_config` configuration block `unused_account_validity_days` argument in preference of the `password_policy` configuration block `temporary_password_validity_days` argument. Configurations will need to be updated to use the API supported configuration.
+
+For example, given this previous configuration:
+
+```hcl
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  admin_create_user_config {
+    # ... potentially other configuration ...
+
+    unused_account_validity_days = 7
+  }
+}
+```
+
+An updated configuration:
+
+```hcl
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  password_policy {
+    # ... potentially other configuration ...
+
+    temporary_password_validity_days = 7
+  }
+}
+```
+
 ## Resource: aws_dx_gateway
 
 ### Removal of Automatic aws_dx_gateway_association Import

diff --git a/website/docs/r/cognito_user_pool.markdown b/website/docs/r/cognito_user_pool.markdown
@@ -73,7 +73,6 @@ The following arguments are supported:
 
 * `allow_admin_create_user_only` (Optional) - Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
 * `invite_message_template` (Optional) - The [invite message template structure](#invite-message-template).
-* `unused_account_validity_days` (Optional) - **DEPRECATED** Use password_policy.temporary_password_validity_days instead - The user account expiration limit, in days, after which the account is no longer usable.
 
 ##### Invite Message template