provider/aws: Fix KMS Key reading with Exists method (#13348)

* provider/aws: Fix KMS Key reading with Exists method

Fixes #13322 by checking if the key Exists and offering to recreate if
not found, or pending delete

* remove redundant code

builtin/providers/aws/resource_aws_kms_key.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform/helper/resource"
@@ -18,6 +19,7 @@ func resourceAwsKmsKey() *schema.Resource {
 		Read:   resourceAwsKmsKeyRead,
 		Update: resourceAwsKmsKeyUpdate,
 		Delete: resourceAwsKmsKeyDelete,
+		Exists: resourceAwsKmsKeyExists,
 
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
@@ -368,6 +370,30 @@ func updateKmsKeyRotationStatus(conn *kms.KMS, d *schema.ResourceData) error {
 	return nil
 }
 
+func resourceAwsKmsKeyExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	conn := meta.(*AWSClient).kmsconn
+
+	req := &kms.DescribeKeyInput{
+		KeyId: aws.String(d.Id()),
+	}
+	resp, err := conn.DescribeKey(req)
+	if err != nil {
+		if awsErr, ok := err.(awserr.Error); ok {
+			if awsErr.Code() == "NotFoundException" {
+				return false, nil
+			}
+		}
+		return false, err
+	}
+	metadata := resp.KeyMetadata
+
+	if *metadata.KeyState == "PendingDeletion" {
+		return false, nil
+	}
+
+	return true, nil
+}
+
 func resourceAwsKmsKeyDelete(d *schema.ResourceData, meta interface{}) error {
 	conn := meta.(*AWSClient).kmsconn
 	keyId := d.Get("key_id").(string)

builtin/providers/aws/resource_aws_kms_key_test.go

@@ -37,6 +37,29 @@ func TestAccAWSKmsKey_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSKmsKey_disappears(t *testing.T) {
+	var key kms.KeyMetadata
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSKmsKeyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSKmsKey,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSKmsKeyExists("aws_kms_key.foo", &key),
+				),
+			},
+			{
+				Config:             testAccAWSKmsKey_other_region,
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccAWSKmsKey_policy(t *testing.T) {
 	var key kms.KeyMetadata
 	expectedPolicyText := `{"Version":"2012-10-17","Id":"kms-tf-1","Statement":[{"Sid":"Enable IAM User Permissions","Effect":"Allow","Principal":{"AWS":"*"},"Action":"kms:*","Resource":"*"}]}`
@@ -238,6 +261,32 @@ resource "aws_kms_key" "foo" {
 POLICY
 }`, kmsTimestamp)
 
+var testAccAWSKmsKey_other_region = fmt.Sprintf(`
+provider "aws" { 
+	region = "us-east-1"
+}
+resource "aws_kms_key" "foo" {
+    description = "Terraform acc test %s"
+    deletion_window_in_days = 7
+    policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "kms-tf-1",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    }
+  ]
+}
+POLICY
+}`, kmsTimestamp)
+
 var testAccAWSKmsKey_removedPolicy = fmt.Sprintf(`
 resource "aws_kms_key" "foo" {
     description = "Terraform acc test %s"