Vpc endpoint suppress policy diff

[snakeb1t]

• Suppresses policy diff for vpc endpoint policy when old and new policy is structurally equivalent
  • Lack of this feature is considered a bug on our side, since a change is occurring despite both old and new policy being logically equivalent. We're using PTFE, so we require the upstream change for Terraform runs to be kosher.

[bflad]

This LGTM, thanks for catching this @snakeb1t. 🚀 I also implemented a covering acceptance test for this to ensure the new DiffSuppressFunc is working properly on the policy attribute and catch regressions in the future:

func TestAccAWSVpcEndpoint_Gateway_Policy(t *testing.T) {
	var endpoint ec2.VpcEndpoint
	// This policy checks the DiffSuppressFunc
	policy1 := `
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonLinux2AMIRepositoryAccess",
      "Principal": "*",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::amazonlinux.*.amazonaws.com/*"
      ]
    }
  ]
}
`
	policy2 := `
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowAll",
    "Effect": "Allow",
    "Principal": {"AWS": "*" },
    "Action": "*",
    "Resource": "*"
  }]
}
`
	resourceName := "aws_vpc_endpoint.test"

	resource.ParallelTest(t, resource.TestCase{
		PreCheck:     func() { testAccPreCheck(t) },
		Providers:    testAccProviders,
		CheckDestroy: testAccCheckVpcEndpointDestroy,
		Steps: []resource.TestStep{
			{
				Config: testAccVpcEndpointConfigGatewayPolicy(policy1),
				Check: resource.ComposeTestCheckFunc(
					testAccCheckVpcEndpointExists(resourceName, &endpoint),
				),
			},
			{
				ResourceName:      resourceName,
				ImportState:       true,
				ImportStateVerify: true,
			},
			{
				Config: testAccVpcEndpointConfigGatewayPolicy(policy2),
				Check: resource.ComposeTestCheckFunc(
					testAccCheckVpcEndpointExists(resourceName, &endpoint),
				),
			},
		},
	})
}

func testAccVpcEndpointConfigGatewayPolicy(policy string) string {
	return fmt.Sprintf(`
data "aws_vpc_endpoint_service" "s3" {
  service = "s3"
}

resource "aws_vpc" "test" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "terraform-testacc-vpc-endpoint-gateway-policy"
  }
}

resource "aws_vpc_endpoint" "test" {
  policy       = <<POLICY%[1]sPOLICY
  service_name = "${data.aws_vpc_endpoint_service.s3.service_name}"
  vpc_id       = "${aws_vpc.test.id}"
}
`, policy)
}

Previous output from acceptance testing (before code update):

--- FAIL: TestAccAWSVpcEndpoint_Gateway_Policy (32.82s)
    testing.go:538: Step 0 error: After applying this step, the plan was not empty:

        DIFF:

        UPDATE: aws_vpc_endpoint.test
          policy: "{\"Statement\":[{\"Action\":\"s3:GetObject\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Resource\":\"arn:aws:s3:::amazonlinux.*.amazonaws.com/*\",\"Sid\":\"AmazonLinux2AMIRepositoryAccess\"}],\"Version\":\"2012-10-17\"}" => "{\"Statement\":[{\"Action\":[\"s3:GetObject\"],\"Effect\":\"Allow\",\"Principal\":\"*\",\"Resource\":[\"arn:aws:s3:::amazonlinux.*.amazonaws.com/*\"],\"Sid\":\"AmazonLinux2AMIRepositoryAccess\"}],\"Version\":\"2012-10-17\"}"

Output from acceptance testing (after code update):

--- PASS: TestAccAWSVpcEndpoint_Gateway_Policy (57.54s)

[bflad]

This has been released in version 1.60.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!