Fix Cognito RoleMapping validation for Token types

[tomelliff]

If the mapping_rule isn't set then this should be the equivalent of it not having any mapping rules defined.
Looks like the negation was missed on this.

Fixes #2232

[tomelliff]

Just seen another pull request for this after checking for the issue but it was missing tests: #2246.

Happy to rebase this on the previous PR so that @makapuu's work can be accepted too.

Also, I wanted to add a wider acceptance test for aws_cognito_identity_pool_roles_attachment so that we created a token based role mapping there (there's an acceptance test for the error https://github.com/terraform-providers/terraform-provider-aws/blob/79ed212c594fd8e848d0274cd0efc70bbf4cede8/aws/resource_aws_cognito_identity_pool_roles_attachment_test.go#L126-L140) but token based role mappings can only be done with Cognito identity providers and that requires an app client so we'd need #2874 to be merged first.

[bflad]

@tomelliff thanks for your work here. Given #2246 (comment) and #1803 being merged could you rebase against #2246 and help finish this up? We'd greatly appreciate it. 😄 🚀

[tomelliff]

@bflad I've rebased against that commit so it's now included along with my further changes plus the test.

Let me know if you need anything else.

[tomelliff]

@bflad Did you need anything else from me on this? Would be great if we can get this fix in for the next release because then I think I can tear out my Cloudformation workarounds for what was the missing Terraform Cognito resources plus this bug.

[bflad]

@tomelliff thanks for the gentle ping - I missed coming back to this for you. Sorry about that. 😢 Taking a look now.

[bflad]

Thanks so much for the rebase, fix, and additional unit test, this looks good!

 make testacc TEST=./aws TESTARGS='-run=TestAccAWSCognitoIdentityPoolRolesAttachment'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSCognitoIdentityPoolRolesAttachment -timeout 120m
=== RUN   TestAccAWSCognitoIdentityPoolRolesAttachment_basic
--- PASS: TestAccAWSCognitoIdentityPoolRolesAttachment_basic (22.64s)
=== RUN   TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappings
--- PASS: TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappings (36.52s)
=== RUN   TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithAmbiguousRoleResolutionError
--- PASS: TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithAmbiguousRoleResolutionError (6.35s)
=== RUN   TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithRulesTypeError
--- PASS: TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithRulesTypeError (6.14s)
=== RUN   TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithTokenTypeError
--- PASS: TestAccAWSCognitoIdentityPoolRolesAttachment_roleMappingsWithTokenTypeError (6.80s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	78.494s

[bflad]

This has been released in terraform-provider-aws version 1.9.0. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!