r/aws_dax_cluster: Support encryption at rest

[ewbankkit]

Fixes #5500.
Acceptance tests:

$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSDAXCluster_basic'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAWSDAXCluster_basic -timeout 120m
=== RUN   TestAccAWSDAXCluster_basic
--- PASS: TestAccAWSDAXCluster_basic (669.50s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	669.513s
$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSDAXCluster_encryption'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -run=TestAccAWSDAXCluster_encryption -timeout 120m
=== RUN   TestAccAWSDAXCluster_encryption
--- PASS: TestAccAWSDAXCluster_encryption (596.19s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	596.203s

[ewbankkit]

Node type changed as encryption at rest is not supported for dax.r3.* node types:

• https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html

[bflad]

👍

[ewbankkit]

Moved these 2 functions to structure.go.

[bflad]

Nice work, @ewbankkit! 🚀 I made some nitpicky cleanup in a commit after yours (we generally recommend against using CustomizeDiff unless really necessary).

--- PASS: TestAccAWSDAXCluster_encryption_disabled (597.08s)
--- PASS: TestAccAWSDAXCluster_importBasic (605.43s)
--- PASS: TestAccAWSDAXCluster_encryption_enabled (679.29s)
--- PASS: TestAccAWSDAXCluster_basic (736.60s)
--- PASS: TestAccAWSDAXCluster_resize (1289.44s)

[bflad]

It looks like this check was extraneously added 😉

--- FAIL: TestAccAWSDAXCluster_resize (1252.75s)
	testing.go:527: Step 2 error: Check failed: Check 3/3 error: aws_dax_cluster.test: Attribute 'server_side_encryption.0.enabled' expected "true", got "false"

[bflad]

👍

[bflad]

I was able to remove the following by changing the schema definition:

• Computed: true
• CustomizeDiff
• isDaxClusterOptionDisabled

Check this out:

"server_side_encryption": {
	Type:     schema.TypeList,
	Optional: true,
	MaxItems: 1,
	DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
		if old == "1" && new == "0" {
			return true
		}
		return false
	},
	Elem: &schema.Resource{
		Schema: map[string]*schema.Schema{
			"enabled": {
				Type:     schema.TypeBool,
				Optional: true,
				Default:  false,
			},
		},
	},
},

At some point I need to make that DiffSuppressFunc into its own function 😅 , its basically just there to ignore the container attribute being unset in the Terraform configuration (all child attribute differences still apply).

[ewbankkit]

👍 I reused the logic from aws_dynamodb_table so we may want to refactor there also.

[ewbankkit]

Especially as it looks like with AWS SDK v1.15.16 aws_dynamodb_table SSE can be updated without recreating the table.

[bflad]

This has been released in version 1.33.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!