r/aws_ssm_parameter: Mark version as computed when value changes

.changelog/22522.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_parameter: Mark `version` as Computed when `value` changes
+```

internal/service/ssm/parameter.go

@@ -101,14 +101,17 @@ func ResourceParameter() *schema.Resource {
 			"tags_all": tftags.TagsSchemaComputed(),
 		},
 
-		CustomizeDiff: customdiff.All(
+		CustomizeDiff: customdiff.Sequence(
 			// Prevent the following error during tier update from Advanced to Standard:
 			// ValidationException: This parameter uses the advanced-parameter tier. You can't downgrade a parameter from the advanced-parameter tier to the standard-parameter tier. If necessary, you can delete the advanced parameter and recreate it as a standard parameter.
 			// In the case of Advanced to Intelligent-Tiering, a ValidationException is not thrown
 			// but rather no change occurs without resource re-creation
 			customdiff.ForceNewIfChange("tier", func(_ context.Context, old, new, meta interface{}) bool {
 				return old.(string) == ssm.ParameterTierAdvanced && (new.(string) == ssm.ParameterTierStandard || new.(string) == ssm.ParameterTierIntelligentTiering)
 			}),
+			customdiff.ComputedIf("version", func(_ context.Context, diff *schema.ResourceDiff, meta interface{}) bool {
+				return diff.HasChange("value")
+			}),
 			verify.SetTagsDiff,
 		),
 	}

internal/service/ssm/parameter_test.go

@@ -222,7 +222,10 @@ func TestAccSSMParameter_overwrite(t *testing.T) {
 		CheckDestroy: testAccCheckParameterDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccParameterBasicConfig(name, "String", "test2"),
+				Config: testAccParameterBasicOverwriteConfig(name, "String", "test2"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "version", "1"),
+				),
 			},
 			{
 				ResourceName:            resourceName,
@@ -236,12 +239,38 @@ func TestAccSSMParameter_overwrite(t *testing.T) {
 					testAccCheckParameterExists(resourceName, &param),
 					resource.TestCheckResourceAttr(resourceName, "value", "test3"),
 					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "version", "2"),
 				),
 			},
 		},
 	})
 }
 
+// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/12213
+func TestAccSSMParameter_overwriteCascade(t *testing.T) {
+	name := fmt.Sprintf("%s_%s", t.Name(), sdkacctest.RandString(10))
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(t) },
+		ErrorCheck:   acctest.ErrorCheck(t, ssm.EndpointsID),
+		Providers:    acctest.Providers,
+		CheckDestroy: testAccCheckParameterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterCascadeOverwriteConfig(name, "test1"),
+			},
+			{
+				Config: testAccParameterCascadeOverwriteConfig(name, "test2"),
+			},
+			{
+				Config:             testAccParameterCascadeOverwriteConfig(name, "test2"),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: false,
+			},
+		},
+	})
+}
+
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/18550
 func TestAccSSMParameter_overwriteWithTags(t *testing.T) {
 	var param ssm.Parameter
@@ -820,6 +849,24 @@ resource "aws_ssm_parameter" "test" {
 `, rName, overwrite, tagKey1, tagValue1)
 }
 
+func testAccParameterCascadeOverwriteConfig(rName, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test_upstream" {
+  name      = "test_parameter_upstream-%[1]s"
+  type      = "String"
+  value     = "%[2]s"
+  overwrite = true
+}
+
+resource "aws_ssm_parameter" "test_downstream" {
+  name      = "test_parameter_downstream-%[1]s"
+  type      = "String"
+  value     = aws_ssm_parameter.test_upstream.version
+  overwrite = true
+}
+`, rName, value)
+}
+
 func testAccParameterSecureConfig(rName string, value string) string {
 	return fmt.Sprintf(`
 resource "aws_ssm_parameter" "secret_test" {