r/s3_bucket_replication_configuration: Add token parameter for x-amz-bucket-object-lock-token

[alexb-dd]

This allows one to enable replication on an object-lock enabled bucket, OR enabling object lock on an existing bucket. See https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-replication for details.

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #14061.

Output from acceptance testing:

% make testacc TESTS='TestAccS3BucketReplication.*' PKG=s3
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/s3/... -v -count 1 -parallel 20 -run='TestAccS3BucketReplication.*'  -timeout 180m
=== RUN   TestAccS3BucketReplicationConfiguration_basic
=== PAUSE TestAccS3BucketReplicationConfiguration_basic
=== RUN   TestAccS3BucketReplicationConfiguration_disappears
=== PAUSE TestAccS3BucketReplicationConfiguration_disappears
=== RUN   TestAccS3BucketReplicationConfiguration_multipleDestinationsEmptyFilter
=== PAUSE TestAccS3BucketReplicationConfiguration_multipleDestinationsEmptyFilter
=== RUN   TestAccS3BucketReplicationConfiguration_multipleDestinationsNonEmptyFilter
=== PAUSE TestAccS3BucketReplicationConfiguration_multipleDestinationsNonEmptyFilter
=== RUN   TestAccS3BucketReplicationConfiguration_twoDestination
=== PAUSE TestAccS3BucketReplicationConfiguration_twoDestination
=== RUN   TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAccessControlTranslation
=== PAUSE TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAccessControlTranslation
=== RUN   TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAddAccessControlTranslation
=== PAUSE TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAddAccessControlTranslation
=== RUN   TestAccS3BucketReplicationConfiguration_replicationTimeControl
=== PAUSE TestAccS3BucketReplicationConfiguration_replicationTimeControl
=== RUN   TestAccS3BucketReplicationConfiguration_replicaModifications
=== PAUSE TestAccS3BucketReplicationConfiguration_replicaModifications
=== RUN   TestAccS3BucketReplicationConfiguration_withoutStorageClass
=== PAUSE TestAccS3BucketReplicationConfiguration_withoutStorageClass
=== RUN   TestAccS3BucketReplicationConfiguration_schemaV2
=== PAUSE TestAccS3BucketReplicationConfiguration_schemaV2
=== RUN   TestAccS3BucketReplicationConfiguration_schemaV2SameRegion
=== PAUSE TestAccS3BucketReplicationConfiguration_schemaV2SameRegion
=== RUN   TestAccS3BucketReplicationConfiguration_schemaV2DestinationMetrics
=== PAUSE TestAccS3BucketReplicationConfiguration_schemaV2DestinationMetrics
=== RUN   TestAccS3BucketReplicationConfiguration_existingObjectReplication
    bucket_replication_configuration_test.go:714: skipping test: AWS Technical Support request required to allow ExistingObjectReplication
--- SKIP: TestAccS3BucketReplicationConfiguration_existingObjectReplication (0.00s)
=== RUN   TestAccS3BucketReplicationConfiguration_filter_tagFilter
=== PAUSE TestAccS3BucketReplicationConfiguration_filter_tagFilter
=== RUN   TestAccS3BucketReplicationConfiguration_filter_andOperator
=== PAUSE TestAccS3BucketReplicationConfiguration_filter_andOperator
=== RUN   TestAccS3BucketReplicationConfiguration_withoutPrefix
=== PAUSE TestAccS3BucketReplicationConfiguration_withoutPrefix
=== CONT  TestAccS3BucketReplicationConfiguration_basic
=== CONT  TestAccS3BucketReplicationConfiguration_replicaModifications
=== CONT  TestAccS3BucketReplicationConfiguration_withoutPrefix
=== CONT  TestAccS3BucketReplicationConfiguration_twoDestination
=== CONT  TestAccS3BucketReplicationConfiguration_replicationTimeControl
=== CONT  TestAccS3BucketReplicationConfiguration_filter_andOperator
=== CONT  TestAccS3BucketReplicationConfiguration_filter_tagFilter
=== CONT  TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAccessControlTranslation
=== CONT  TestAccS3BucketReplicationConfiguration_schemaV2DestinationMetrics
=== CONT  TestAccS3BucketReplicationConfiguration_schemaV2SameRegion
=== CONT  TestAccS3BucketReplicationConfiguration_schemaV2
=== CONT  TestAccS3BucketReplicationConfiguration_withoutStorageClass
=== CONT  TestAccS3BucketReplicationConfiguration_disappears
=== CONT  TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAddAccessControlTranslation
=== CONT  TestAccS3BucketReplicationConfiguration_multipleDestinationsEmptyFilter
=== CONT  TestAccS3BucketReplicationConfiguration_multipleDestinationsNonEmptyFilter
--- PASS: TestAccS3BucketReplicationConfiguration_disappears (59.40s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2SameRegion (171.63s)
--- PASS: TestAccS3BucketReplicationConfiguration_filter_tagFilter (305.94s)
--- PASS: TestAccS3BucketReplicationConfiguration_replicaModifications (307.00s)
--- PASS: TestAccS3BucketReplicationConfiguration_replicationTimeControl (307.06s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2 (307.94s)
--- PASS: TestAccS3BucketReplicationConfiguration_withoutStorageClass (309.00s)
--- PASS: TestAccS3BucketReplicationConfiguration_withoutPrefix (309.10s)
--- PASS: TestAccS3BucketReplicationConfiguration_multipleDestinationsNonEmptyFilter (309.21s)
--- PASS: TestAccS3BucketReplicationConfiguration_twoDestination (309.21s)
--- PASS: TestAccS3BucketReplicationConfiguration_multipleDestinationsEmptyFilter (309.34s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2DestinationMetrics (309.42s)
--- PASS: TestAccS3BucketReplicationConfiguration_filter_andOperator (331.59s)
--- PASS: TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAddAccessControlTranslation (336.38s)
--- PASS: TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAccessControlTranslation (336.73s)
--- PASS: TestAccS3BucketReplicationConfiguration_basic (347.10s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/s3	353.025s
...

make test passed, and tested this on an ad-hoc TF module and was able to successfully enable replication on an object-lock enabled bucket. Before:

│ Error: error creating S3 replication configuration for bucket (<redacted>): InvalidRequest: Replication configuration cannot be applied to an Object Lock enabled bucket

After:

aws_s3_bucket_replication_configuration.replication: Creating...
aws_s3_bucket_replication_configuration.replication: Creation complete after 1s [id=<redacted>]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

[github-actions]

Welcome @alexb-dd 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[anGie44]

Hi @alexb-dd , thank you for this PR! Overall it's looking great, just a couple comments to address and if you could please add the token argument to the documentation (website/docs/r/s3_bucket_replication_configuration.html) similar to the description provided in the aws_s3_bucket_object_lock_configuration resource's token arg, then we should be good to go, e.g.

https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/s3_bucket_object_lock_configuration.html.markdown#argument-reference

I'm curious, did AWS support first recommend enabling bucket versioning to then get the token that get's generated behind the scenes? (that's currently what is noted in the aws_s3_bucket_object_lock_configurationdocs)

[alexb-dd]

I'm curious, did AWS support first recommend enabling bucket versioning to then get the token that get's generated behind the scenes? (that's currently what is noted in the aws_s3_bucket_object_lock_configurationdocs)

They asked me for the bucket for which to generate the token. Thus the bucket needed to exist. I think since object lock being enabled on a bucket (whether at creation time or after the fact) implies versioning is on, they did not need to ask for versioning explicitly.

[anGie44]

Very minor nit: do you mind moving token just below rule to maintain the order?

[anGie44]

Going to edit this as we're going to do a release today and would love to get this in as it's ready to go 🚀

[anGie44]

Output of acceptance tests:

--- SKIP: TestAccS3BucketReplicationConfiguration_existingObjectReplication (0.00s)
--- PASS: TestAccS3BucketReplicationConfiguration_replicaModifications (270.65s)
--- PASS: TestAccS3BucketReplicationConfiguration_twoDestination (272.33s)
--- PASS: TestAccS3BucketReplicationConfiguration_replicationTimeControl (272.38s)
--- PASS: TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAddAccessControlTranslation (296.10s)
--- PASS: TestAccS3BucketReplicationConfiguration_basic (314.84s)
--- PASS: TestAccS3BucketReplicationConfiguration_multipleDestinationsEmptyFilter (269.47s)
--- PASS: TestAccS3BucketReplicationConfiguration_multipleDestinationsNonEmptyFilter (269.48s)
--- PASS: TestAccS3BucketReplicationConfiguration_configurationRuleDestinationAccessControlTranslation (291.62s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2DestinationMetrics (268.07s)
--- PASS: TestAccS3BucketReplicationConfiguration_withoutPrefix (267.35s)
--- PASS: TestAccS3BucketReplicationConfiguration_disappears (25.03s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2SameRegion (146.25s)
--- PASS: TestAccS3BucketReplicationConfiguration_filter_tagFilter (267.76s)
--- PASS: TestAccS3BucketReplicationConfiguration_filter_andOperator (289.40s)
--- PASS: TestAccS3BucketReplicationConfiguration_withoutStorageClass (268.14s)
--- PASS: TestAccS3BucketReplicationConfiguration_schemaV2 (267.31s)

[anGie44]

Thanks again @alexb-dd , LGTM 🚀

[github-actions]

This functionality has been released in v4.5.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.