[Enhancement]: Add `etag` argument to `aws_cloudfrontkeyvaluestore_key`

[tadair231]

Terraform Core Version

1.5.7

AWS Provider Version

5.90.0

Affected Resource(s)

So aws_cloudfrontkeyvaluestore_key only has 3 parameter in terraform
key
key_value_store_arn
value

The matching command in aws is aws cloudfront-keyvaluestore put-key
It requires 4 parameters
key
value
arn
And if-match which is etag

there’s no way in terraform to provide etag and thus this fails for authentication

Expected Behavior

Should be able to provide etag from aws_cloudfront_key_store to aws_cloudfrontkeyvaluestore_key

Actual Behavior

Fails without etag for authentication

Relevant Error/Panic Output Snippet

Terraform Configuration Files

Na

Steps to Reproduce

Try it doesn’t work without etag

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[tadair231]

Additional information so the issue seems to be that it’s trying to use DescribeKeyValue function to use arn to get etag. The response is a 403 error because I’m assuming that there’s no permissions to the api. If you can just add the etag as a input which we can get via aws_cloudfront_key_value_store.example.etag

[justinretzolk]

Hey @tadair231 👋 Thank you for taking the time to raise this! We consider adding additional functionality to existing resources to be an enhancement rather than a bug, so I'll be updating a couple of things about the issue. There's no further action needed from you, I just like to let people know before I make these kinds of modifications.

Before making those modifications, I took a quick look over the resource's code, and noticed a couple of things that I think are worth mentioning.

The etag value is indeed read during creation of the key (here, which calls this function). This is likely why you saw the 403 error, assuming the credentials being used don't have the cloudfront-keyvaluestore:DescribeKeyValueStore permission.

There's also a comment in the code that mentions that adding a key changes the etag of the key value store, which might partially explain why the value is read at apply time, rather than being a supplied value. If you supplied a value, it seems like it would cause drift on every run if I'm understanding the comment correctly.

Finally, the AWS documentation mentions that the etag value returned by the CloudFront DescribeKeyValueStore (that's used by the aws_cloudfront_key_value_store resource) returns a different etag value than what's returned by CloudFront KeyValueStore's DescribeKeyValueStore, and that the etags aren't interchangeable. With that in mind, I don't think supplying aws_cloudfront_key_value_store.example.etag to the proposed new etag argument would work.