Fix update of imported ACM certificates

[julienduchesne]

The update for the ACM certificates did not work for imported (external) certificates. The reason for that is that only the hash of the certificates was stored in the state. The API call requires all three parts (chain, body and private key) of a certificate when updating.

Therefore, an update would only work if you changed all three parts, otherwise, it would try to send the hash instead of the actual certificate.

I tried to hack something together with CustomizeDiff but I couldn't manage to force Terraform to go re-read the source of the unchanged parts instead of getting them from the state when one of the three parts has changed.

The way I made it work was by putting the certificate in the state

Output from acceptance testing:

TF_ACC=1 go test  github.com/terraform-providers/terraform-provider-aws/aws -run "^(TestAccAWSAcmCertificate_imported_DomainName)$" -v
=== RUN   TestAccAWSAcmCertificate_imported_DomainName
=== PAUSE TestAccAWSAcmCertificate_imported_DomainName
=== CONT  TestAccAWSAcmCertificate_imported_DomainName
--- PASS: TestAccAWSAcmCertificate_imported_DomainName (76.78s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       76.819s

[edahlseng]

Linking everything up to be pedantic, it looks like this should address #10847, and perhaps #9809.

[bflad]

Pulling this in as part of our 3.0.0 work, thanks @julienduchesne 🚀 Please note that the major version will not include the DiffSuppressFunc (and some logic to not call the API on hash removal only updates) to encourage updating the state immediately. 👍

Output from acceptance testing (failure related to other upcoming 3.0.0 work):

--- FAIL: TestAccAWSAcmCertificate_san_multiple (23.72s)

--- PASS: TestAccAWSAcmCertificate_disableCTLogging (14.97s)
--- PASS: TestAccAWSAcmCertificate_dnsValidation (16.95s)
--- PASS: TestAccAWSAcmCertificate_emailValidation (18.91s)
--- PASS: TestAccAWSAcmCertificate_imported_DomainName (28.06s)
--- PASS: TestAccAWSAcmCertificate_imported_IpAddress (11.75s)
--- PASS: TestAccAWSAcmCertificate_privateCert (20.73s)
--- PASS: TestAccAWSAcmCertificate_root (14.59s)
--- PASS: TestAccAWSAcmCertificate_root_TrailingPeriod (15.02s)
--- PASS: TestAccAWSAcmCertificate_rootAndWildcardSan (15.84s)
--- PASS: TestAccAWSAcmCertificate_san_single (19.04s)
--- PASS: TestAccAWSAcmCertificate_san_TrailingPeriod (19.81s)
--- PASS: TestAccAWSAcmCertificate_tags (39.78s)
--- PASS: TestAccAWSAcmCertificate_wildcard (20.89s)
--- PASS: TestAccAWSAcmCertificate_wildcardAndRootSan (19.73s)

[ghost]

This has been released in version 3.0.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!