Merge pull request #42412 from hashicorp/f-per-resource-override-Region-documentation

Enhanced Region Support guide

Author: ewbankkit

.ci/semgrep/acctest/naming/naming.yml

@@ -26,6 +26,19 @@ rules:
           regex: '^testAccCheck[a-zA-Z]+Destroy(?!With)Provider'
     severity: WARNING
 
+  - id: destroy-check-with-region
+    languages: [go]
+    message: The check destroy with region function should match the pattern "testAccCheck<Resource>DestroyWithRegion".
+    paths:
+      include:
+        - "internal/**/*_test.go"
+    patterns:
+      - pattern: func $FUNCNAME(...) { ... }
+      - metavariable-regex:
+          metavariable: "$FUNCNAME"
+          regex: '^testAccCheck[a-zA-Z]+Destroy(?!With)Region'
+    severity: WARNING
+
   - id: destroy-check-signature
     languages: [go]
     message: The check destroy function should have the correct signature
@@ -36,7 +49,7 @@ rules:
       - pattern: func $FUNCNAME(...) { ... }
       - metavariable-regex:
           metavariable: "$FUNCNAME"
-          regex: "^testAccCheck[a-zA-Z]+Destroy(?!WithProvider)"
+          regex: "^testAccCheck[a-zA-Z]+Destroy(?!WithProvider)(?!WithRegion)"
       - pattern-not: func $FUNCNAME(s *terraform.State) error { ... }
       - pattern-not: func $FUNCNAME(...) resource.TestCheckFunc { ... }
     severity: WARNING

internal/acctest/acctest.go

@@ -1529,6 +1529,19 @@ func CheckWithNamedProviders(f TestCheckWithProviderFunc, providers map[string]*
 	}
 }
 
+type TestCheckWithRegionFunc func(*terraform.State, string) error
+
+func CheckWithRegions(f TestCheckWithRegionFunc, regions ...string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, region := range regions {
+			if err := f(s, region); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
 func ErrorCheckSequence(funcs ...resource.ErrorCheckFunc) resource.ErrorCheckFunc {
 	return func(err error) error {
 		for _, f := range funcs {

internal/service/kms/replica_key_test.go

@@ -33,7 +33,7 @@ func TestAccKMSReplicaKey_basic(t *testing.T) {
 			acctest.PreCheckMultipleRegion(t, 2)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
@@ -77,7 +77,7 @@ func TestAccKMSReplicaKey_disappears(t *testing.T) {
 			acctest.PreCheckMultipleRegion(t, 2)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
@@ -107,7 +107,7 @@ func TestAccKMSReplicaKey_descriptionAndEnabled(t *testing.T) {
 			acctest.PreCheckMultipleRegion(t, 2)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
@@ -158,7 +158,7 @@ func TestAccKMSReplicaKey_policy(t *testing.T) {
 			acctest.PreCheckMultipleRegion(t, 2)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
@@ -199,7 +199,7 @@ func TestAccKMSReplicaKey_twoReplicas(t *testing.T) {
 			acctest.PreCheckMultipleRegion(t, 3)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesMultipleRegions(ctx, t, 3),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
@@ -212,6 +212,51 @@ func TestAccKMSReplicaKey_twoReplicas(t *testing.T) {
 	})
 }
 
+func TestAccKMSReplicaKey_multipleProviders(t *testing.T) {
+	ctx := acctest.Context(t)
+	var key awstypes.KeyMetadata
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	primaryKeyResourceName := "aws_kms_key.test"
+	resourceName := "aws_kms_replica_key.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckMultipleRegion(t, 2)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.KMSServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		CheckDestroy:             testAccCheckKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicaKeyConfig_multipleProviders(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					acctest.MatchResourceAttrRegionalARN(ctx, resourceName, names.AttrARN, "kms", regexache.MustCompile(`key/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "bypass_policy_lockout_safety_check", acctest.CtFalse),
+					resource.TestCheckResourceAttr(resourceName, "deletion_window_in_days", "30"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrDescription, ""),
+					resource.TestCheckResourceAttr(resourceName, names.AttrEnabled, acctest.CtTrue),
+					resource.TestCheckResourceAttr(resourceName, "key_rotation_enabled", acctest.CtFalse),
+					resource.TestCheckResourceAttr(resourceName, "key_spec", "SYMMETRIC_DEFAULT"),
+					resource.TestMatchResourceAttr(resourceName, names.AttrPolicy, regexache.MustCompile(`Enable IAM User Permissions`)),
+					resource.TestCheckResourceAttrPair(resourceName, "primary_key_arn", primaryKeyResourceName, names.AttrARN),
+				),
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New(names.AttrTags), knownvalue.Null()),
+					statecheck.ExpectKnownValue(resourceName, tfjsonpath.New(names.AttrTagsAll), knownvalue.MapExact(map[string]knownvalue.Check{})),
+				},
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_window_in_days", "bypass_policy_lockout_safety_check"},
+			},
+		},
+	})
+}
+
 func testAccCheckReplicaKeyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return testAccCheckKeyDestroy(ctx)
 }
@@ -221,9 +266,9 @@ func testAccCheckReplicaKeyExists(ctx context.Context, name string, key *awstype
 }
 
 func testAccReplicaKeyConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  provider = awsalternate
+  region = %[2]q
 
   description             = %[1]q
   multi_region            = true
@@ -234,13 +279,13 @@ resource "aws_kms_key" "test" {
 resource "aws_kms_replica_key" "test" {
   primary_key_arn = aws_kms_key.test.arn
 }
-`, rName))
+`, rName, acctest.AlternateRegion())
 }
 
 func testAccReplicaKeyConfig_descriptionAndEnabled(rName, description string, enabled bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  provider = awsalternate
+  region = %[4]q
 
   description  = %[1]q
   multi_region = true
@@ -256,13 +301,13 @@ resource "aws_kms_replica_key" "test" {
 
   deletion_window_in_days = 7
 }
-`, rName, description, enabled))
+`, rName, description, enabled, acctest.AlternateRegion())
 }
 
 func testAccReplicaKeyConfig_policy(rName, policy string, bypassLockoutCheck bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  provider = awsalternate
+  region = %[4]q
 
   description  = %[1]q
   multi_region = true
@@ -281,13 +326,13 @@ resource "aws_kms_replica_key" "test" {
 
   policy = %[2]q
 }
-`, rName, policy, bypassLockoutCheck))
+`, rName, policy, bypassLockoutCheck, acctest.AlternateRegion())
 }
 
 func testAccReplicaKeyConfig_two(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigMultipleRegionProvider(3), fmt.Sprintf(`
+	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  provider = awsalternate
+  region = %[2]q
 
   description  = %[1]q
   multi_region = true
@@ -304,12 +349,27 @@ resource "aws_kms_replica_key" "test1" {
 }
 
 resource "aws_kms_replica_key" "test2" {
-  provider = awsthird
+  region = %[3]q
 
   description     = %[1]q
   primary_key_arn = aws_kms_key.test.arn
 
   deletion_window_in_days = 7
 }
+`, rName, acctest.AlternateRegion(), acctest.ThirdRegion())
+}
+
+func testAccReplicaKeyConfig_multipleProviders(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+resource "aws_kms_key" "test" {
+  provider = awsalternate
+
+  description  = %[1]q
+  multi_region = true
+}
+
+resource "aws_kms_replica_key" "test" {
+  primary_key_arn = aws_kms_key.test.arn
+}
 `, rName))
 }