r/aws_lakeformation_resource: add hybrid_access_enabled argument

.changelog/35571.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lakeformation_resource: Add `hybrid_access_enabled` argument
+```

internal/service/lakeformation/resource.go

@@ -48,6 +48,11 @@ func ResourceResource() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 			},
+			"hybrid_access_enabled": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
 		},
 	}
 }
@@ -71,6 +76,10 @@ func resourceResourceCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.UseServiceLinkedRole = aws.Bool(v.(bool))
 	}
 
+	if v, ok := d.GetOk("hybrid_access_enabled"); ok {
+		input.HybridAccessEnabled = aws.Bool(v.(bool))
+	}
+
 	_, err := conn.RegisterResourceWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, lakeformation.ErrCodeAlreadyExistsException) {

internal/service/lakeformation/resource_test.go

@@ -169,6 +169,33 @@ func TestAccLakeFormationResource_updateSLRToRole(t *testing.T) {
 	})
 }
 
+func TestAccLakeFormationResource_hybridAccessEnabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceAddr := "aws_lakeformation_resource.test"
+	bucketAddr := "aws_s3_bucket.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, lakeformation.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, lakeformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckResourceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceConfig_hybridAccessEnabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckResourceExists(ctx, resourceAddr),
+					resource.TestCheckResourceAttrPair(resourceAddr, "arn", bucketAddr, "arn"),
+					resource.TestCheckResourceAttr(resourceAddr, "hybrid_access_enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
 // AWS does not support changing from an IAM role to an SLR. No error is thrown
 // but the registration is not changed (the IAM role continues in the registration).
 //
@@ -310,3 +337,16 @@ resource "aws_lakeformation_resource" "test" {
 }
 `, rName)
 }
+
+func testAccResourceConfig_hybridAccessEnabled(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_lakeformation_resource" "test" {
+  arn                     = aws_s3_bucket.test.arn
+  hybrid_access_enabled = true
+}
+`, rName)
+}

website/docs/r/lakeformation_resource.html.markdown

@@ -37,6 +37,7 @@ The following arguments are optional:
 
 * `role_arn` – (Optional) Role that has read/write access to the resource.
 * `use_service_linked_role` - (Optional) Designates an AWS Identity and Access Management (IAM) service-linked role by registering this role with the Data Catalog.
+* `hybrid_access_enabled` - (Optional) Flag to enable AWS LakeFormation hybrid access permission mode.
 
 ~> **NOTE:** AWS does not support registering an S3 location with an IAM role and subsequently updating the S3 location registration to a service-linked role.