tags: send all old and new tags to updateTags

.changelog/33226.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_kms_key: Fix `tag propagation: timeout while waiting for state to become 'TRUE'` errors when any tag value is empty (`""`)
+```
+
+```release-note:bug
+provider: Correctly use old and new tag values when updating `tags` that are `computed`
+```

internal/provider/tags_interceptor.go

@@ -61,27 +61,24 @@ func tagsUpdateFunc(ctx context.Context, d schemaResourceData, sp conns.ServiceP
 		}
 	}
 
-	tagsAll := tftags.New(ctx, stateTags)
+	oldTags := tftags.New(ctx, stateTags)
 	// if tags_all was computed because not wholly known
 	// Merge the resource's configured tags with any provider configured default_tags.
-	configAll := tagsInContext.DefaultConfig.MergeTags(tftags.New(ctx, configTags))
+	newTags := tagsInContext.DefaultConfig.MergeTags(tftags.New(ctx, configTags))
 	// Remove system tags.
-	configAll = configAll.IgnoreSystem(inContext.ServicePackageName)
-
-	toAdd := configAll.Difference(tagsAll)
-	toRemove := tagsAll.Difference(configAll)
+	newTags = newTags.IgnoreSystem(inContext.ServicePackageName)
 
 	// If the service package has a generic resource update tags methods, call it.
 	var err error
 
 	if v, ok := sp.(interface {
 		UpdateTags(context.Context, any, string, any, any) error
 	}); ok {
-		err = v.UpdateTags(ctx, meta, identifier, toRemove, toAdd)
+		err = v.UpdateTags(ctx, meta, identifier, oldTags, newTags)
 	} else if v, ok := sp.(interface {
 		UpdateTags(context.Context, any, string, string, any, any) error
 	}); ok && spt.ResourceType != "" {
-		err = v.UpdateTags(ctx, meta, identifier, spt.ResourceType, toRemove, toAdd)
+		err = v.UpdateTags(ctx, meta, identifier, spt.ResourceType, oldTags, newTags)
 	}
 
 	// ISO partitions may not support tagging, giving error.

internal/service/kms/key_test.go

@@ -558,6 +558,41 @@ func TestAccKMSKey_ignoreTags(t *testing.T) {
 	})
 }
 
+// https://github.com/hashicorp/terraform-provider-aws/issues/33219.
+func TestAccKMSKey_updateTagsEmptyValue(t *testing.T) {
+	ctx := acctest.Context(t)
+	var key kms.KeyMetadata
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_kms_key.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, kms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKeyConfig_tags2(rName, "key1", "value1", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccKeyConfig_tags2(rName, "key1", "value1", "key2", ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", ""),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckKeyHasPolicy(ctx context.Context, name string, expectedPolicyText string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]