resource/aws_ssm_association: Finalize apply_only_at_cron_interval an…

…d add CHANGELOG entry for #15038

Output from acceptance testing in AWS Commercial:

```
--- PASS: TestAccAWSSSMAssociation_withDocumentVersion (26.48s)
--- PASS: TestAccAWSSSMAssociation_rateControl (36.32s)
--- PASS: TestAccAWSSSMAssociation_withScheduleExpression (39.12s)
--- PASS: TestAccAWSSSMAssociation_withAssociationNameAndScheduleExpression (39.44s)
--- PASS: TestAccAWSSSMAssociation_withParameters (41.73s)
--- PASS: TestAccAWSSSMAssociation_withAssociationName (41.97s)
--- PASS: TestAccAWSSSMAssociation_withComplianceSeverity (49.30s)
--- PASS: TestAccAWSSSMAssociation_ApplyOnlyAtCronInterval (53.28s)
--- PASS: TestAccAWSSSMAssociation_withTargets (57.36s)
--- PASS: TestAccAWSSSMAssociation_withAutomationTargetParamName (57.49s)
--- PASS: TestAccAWSSSMAssociation_withOutputLocation (87.00s)
--- PASS: TestAccAWSSSMAssociation_basic (98.52s)
--- PASS: TestAccAWSSSMAssociation_disappears (116.82s)
```

Output from acceptance testing in AWS GovCloud (US):

```
--- PASS: TestAccAWSSSMAssociation_withDocumentVersion (38.37s)
--- PASS: TestAccAWSSSMAssociation_withParameters (49.05s)
--- PASS: TestAccAWSSSMAssociation_rateControl (49.73s)
--- PASS: TestAccAWSSSMAssociation_ApplyOnlyAtCronInterval (52.95s)
--- PASS: TestAccAWSSSMAssociation_withAssociationName (52.95s)
--- PASS: TestAccAWSSSMAssociation_withComplianceSeverity (56.16s)
--- PASS: TestAccAWSSSMAssociation_withAssociationNameAndScheduleExpression (63.14s)
--- PASS: TestAccAWSSSMAssociation_withScheduleExpression (63.99s)
--- PASS: TestAccAWSSSMAssociation_withAutomationTargetParamName (64.88s)
--- PASS: TestAccAWSSSMAssociation_withTargets (71.86s)
--- PASS: TestAccAWSSSMAssociation_withOutputLocation (87.33s)
--- PASS: TestAccAWSSSMAssociation_basic (112.52s)
--- PASS: TestAccAWSSSMAssociation_disappears (119.66s)
```

.changelog/15038.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ssm_association: Add `apply_only_at_cron_interval` argument
+```

aws/resource_aws_ssm_association_test.go

@@ -24,6 +24,7 @@ func TestAccAWSSSMAssociation_basic(t *testing.T) {
 				Config: testAccAWSSSMAssociationBasicConfig(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSSMAssociationExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "false"),
 				),
 			},
 			{
@@ -56,6 +57,38 @@ func TestAccAWSSSMAssociation_disappears(t *testing.T) {
 	})
 }
 
+func TestAccAWSSSMAssociation_ApplyOnlyAtCronInterval(t *testing.T) {
+	name := acctest.RandString(10)
+	resourceName := "aws_ssm_association.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSSMAssociationDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSSMAssociationBasicConfigWithApplyOnlyAtCronInterval(name, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSSMAssociationExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccAWSSSMAssociationBasicConfigWithApplyOnlyAtCronInterval(name, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSSMAssociationExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "false"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSSSMAssociation_withTargets(t *testing.T) {
 	name := acctest.RandString(10)
 	resourceName := "aws_ssm_association.test"
@@ -351,7 +384,7 @@ func TestAccAWSSSMAssociation_withAutomationTargetParamName(t *testing.T) {
 	})
 }
 
-func TestAccAWSSSMAssociation_withScheduleExpressionAndCronInterval(t *testing.T) {
+func TestAccAWSSSMAssociation_withScheduleExpression(t *testing.T) {
 	name := acctest.RandString(10)
 	resourceName := "aws_ssm_association.test"
 
@@ -365,7 +398,6 @@ func TestAccAWSSSMAssociation_withScheduleExpressionAndCronInterval(t *testing.T
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSSMAssociationExists(resourceName),
 					resource.TestCheckResourceAttr(resourceName, "schedule_expression", "cron(0 16 ? * TUE *)"),
-					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "true"),
 				),
 			},
 			{
@@ -378,7 +410,6 @@ func TestAccAWSSSMAssociation_withScheduleExpressionAndCronInterval(t *testing.T
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAWSSSMAssociationExists(resourceName),
 					resource.TestCheckResourceAttr(resourceName, "schedule_expression", "cron(0 16 ? * WED *)"),
-					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "false"),
 				),
 			},
 		},
@@ -519,6 +550,47 @@ func testAccCheckAWSSSMAssociationDestroy(s *terraform.State) error {
 	return nil
 }
 
+func testAccAWSSSMAssociationBasicConfigWithApplyOnlyAtCronInterval(rName string, applyOnlyAtCronInterval bool) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_document" "test" {
+  name          = "test_document_association-%s"
+  document_type = "Command"
+
+  content = <<DOC
+{
+  "schemaVersion": "1.2",
+  "description": "Check ip configuration of a Linux instance.",
+  "parameters": {},
+  "runtimeConfig": {
+    "aws:runShellScript": {
+      "properties": [
+        {
+          "id": "0.aws:runShellScript",
+          "runCommand": [
+            "ifconfig"
+          ]
+        }
+      ]
+    }
+  }
+}
+DOC
+
+}
+
+resource "aws_ssm_association" "test" {
+  name                        = aws_ssm_document.test.name
+  schedule_expression         = "cron(0 16 ? * TUE *)"
+  apply_only_at_cron_interval = %[2]t
+
+  targets {
+    key    = "tag:Name"
+    values = ["acceptanceTest"]
+  }
+}
+`, rName, applyOnlyAtCronInterval)
+}
+
 func testAccAWSSSMAssociationBasicConfigWithAutomationTargetParamName(rName string) string {
 	return composeConfig(testAccLatestAmazonLinuxHvmEbsAmiConfig(), fmt.Sprintf(`
 resource "aws_iam_instance_profile" "ssm_profile" {
@@ -934,7 +1006,6 @@ DOC
 resource "aws_ssm_association" "test" {
   name                = aws_ssm_document.test.name
   schedule_expression = "cron(0 16 ? * TUE *)"
-  apply_only_at_cron_interval = true
 
   targets {
     key    = "tag:Name"
@@ -975,7 +1046,6 @@ DOC
 resource "aws_ssm_association" "test" {
   name                = aws_ssm_document.test.name
   schedule_expression = "cron(0 16 ? * WED *)"
-  apply_only_at_cron_interval = false
 
   targets {
     key    = "tag:Name"

website/docs/r/ssm_association.html.markdown

@@ -28,7 +28,7 @@ resource "aws_ssm_association" "example" {
 The following arguments are supported:
 
 * `name` - (Required) The name of the SSM document to apply.
-* `apply_only_at_cron_interval` - (Optional) System runs the new associations immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it (Default: `false`).
+* `apply_only_at_cron_interval` - (Optional) By default, when you create a new or update associations, the system runs it immediately and then according to the schedule you specified. Enable this option if you do not want an association to run immediately after you create or update it. This parameter is not supported for rate expressions. Default: `false`.
 * `association_name` - (Optional) The descriptive name for the association.
 * `document_version` - (Optional) The document version you want to associate with the target(s). Can be a specific version or the default version.
 * `instance_id` - (Optional) The instance ID to apply an SSM document to. Use `targets` with key `InstanceIds` for document schema versions 2.0 and above.