r/aws_cognito_identity_pool_provider_principal_tag 🐛 fix read operation when using oidc provider

.changelog/25964.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_identity_pool_provider_principal_tag: Fix read operation when using an OIDC provider
+```

internal/service/cognitoidentity/pool_provider_principal_tag.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"log"
 	"regexp"
-	"strings"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
@@ -91,6 +90,7 @@ func resourcePoolProviderPrincipalTagRead(d *schema.ResourceData, meta interface
 	log.Printf("[DEBUG] Reading Cognito Identity Provider Principal Tags: %s", d.Id())
 
 	poolId, providerName, err := DecodePoolProviderPrincipalTagsID(d.Id())
+
 	if err != nil {
 		return err
 	}
@@ -176,11 +176,10 @@ func resourcePoolProviderPrincipalTagDelete(d *schema.ResourceData, meta interfa
 }
 
 func DecodePoolProviderPrincipalTagsID(id string) (string, string, error) {
-	idParts := strings.Split(id, ":")
+	r := regexp.MustCompile(`(?P<ProviderID>[\w-]+:[0-9a-f-]+):(?P<ProviderName>[[:graph:]]+)`)
+	idParts := r.FindStringSubmatch(id)
 	if len(idParts) <= 2 {
 		return "", "", fmt.Errorf("expected ID in format UserPoolID:ProviderName, received: %s", id)
 	}
-	providerName := idParts[len(idParts)-1:]
-	userPoolId := idParts[:len(idParts)-1]
-	return strings.Join(userPoolId, ":"), strings.Join(providerName, ""), nil
+	return idParts[1], idParts[2], nil
 }

internal/service/cognitoidentity/pool_provider_principal_tag_test.go

@@ -95,6 +95,28 @@ func TestAccCognitoIdentityPoolProviderPrincipalTags_disappears(t *testing.T) {
 	})
 }
 
+func TestAccCognitoIdentityPoolProviderPrincipalTags_oidc(t *testing.T) {
+	resourceName := "aws_cognito_identity_pool_provider_principal_tag.test"
+	name := sdkacctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(t); testAccPreCheck(t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolProviderPrincipalTagsDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolProviderPrincipalTagsConfig_oidc(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPoolProviderPrincipalTagsExists(resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "identity_pool_id"),
+					resource.TestCheckResourceAttr(resourceName, "principal_tags.test", "value"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckPoolProviderPrincipalTagsExists(n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -197,3 +219,33 @@ resource "aws_cognito_identity_pool_provider_principal_tag" "test" {
 }
 `)
 }
+
+func testAccPoolProviderPrincipalTagsConfig_oidc(name string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_openid_connect_provider" "idp" {
+  url = "https://accounts.example.com"
+  client_id_list = [
+    "sts.amazonaws.com"
+  ]
+  thumbprint_list = ["990f4193972f2becf12ddeda5237f9c952f20d9e"]
+}
+
+resource "aws_cognito_identity_pool" "pool" {
+  identity_pool_name               = "%s"
+  allow_unauthenticated_identities = false
+  allow_classic_flow               = false
+
+  openid_connect_provider_arns = [
+    aws_iam_openid_connect_provider.idp.arn
+  ]
+}
+
+resource "aws_cognito_identity_pool_provider_principal_tag" "test" {
+  identity_pool_id       = aws_cognito_identity_pool.pool.id
+  identity_provider_name = aws_iam_openid_connect_provider.idp.arn
+  use_defaults           = false
+  principal_tags = {
+    test = "value"
+  }
+}`, name)
+}