diff --git a/builtin/providers/aws/resource_aws_kms_key.go b/builtin/providers/aws/resource_aws_kms_key.go index 4c8343062..2fa8e3287 100644 --- a/builtin/providers/aws/resource_aws_kms_key.go +++ b/builtin/providers/aws/resource_aws_kms_key.go @@ -6,6 +6,7 @@ import ( "time" "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/service/kms" "github.com/hashicorp/errwrap" "github.com/hashicorp/terraform/helper/resource" @@ -18,6 +19,7 @@ func resourceAwsKmsKey() *schema.Resource { Read: resourceAwsKmsKeyRead, Update: resourceAwsKmsKeyUpdate, Delete: resourceAwsKmsKeyDelete, + Exists: resourceAwsKmsKeyExists, Importer: &schema.ResourceImporter{ State: schema.ImportStatePassthrough, @@ -368,6 +370,30 @@ func updateKmsKeyRotationStatus(conn *kms.KMS, d *schema.ResourceData) error { return nil } +func resourceAwsKmsKeyExists(d *schema.ResourceData, meta interface{}) (bool, error) { + conn := meta.(*AWSClient).kmsconn + + req := &kms.DescribeKeyInput{ + KeyId: aws.String(d.Id()), + } + resp, err := conn.DescribeKey(req) + if err != nil { + if awsErr, ok := err.(awserr.Error); ok { + if awsErr.Code() == "NotFoundException" { + return false, nil + } + } + return false, err + } + metadata := resp.KeyMetadata + + if *metadata.KeyState == "PendingDeletion" { + return false, nil + } + + return true, nil +} + func resourceAwsKmsKeyDelete(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).kmsconn keyId := d.Get("key_id").(string) diff --git a/builtin/providers/aws/resource_aws_kms_key_test.go b/builtin/providers/aws/resource_aws_kms_key_test.go index 86cabe4ed..b184fa30c 100644 --- a/builtin/providers/aws/resource_aws_kms_key_test.go +++ b/builtin/providers/aws/resource_aws_kms_key_test.go @@ -37,6 +37,29 @@ func TestAccAWSKmsKey_basic(t *testing.T) { }) } +func TestAccAWSKmsKey_disappears(t *testing.T) { + var key kms.KeyMetadata + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckAWSKmsKeyDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAWSKmsKey, + Check: resource.ComposeTestCheckFunc( + testAccCheckAWSKmsKeyExists("aws_kms_key.foo", &key), + ), + }, + { + Config: testAccAWSKmsKey_other_region, + PlanOnly: true, + ExpectNonEmptyPlan: true, + }, + }, + }) +} + func TestAccAWSKmsKey_policy(t *testing.T) { var key kms.KeyMetadata expectedPolicyText := `{"Version":"2012-10-17","Id":"kms-tf-1","Statement":[{"Sid":"Enable IAM User Permissions","Effect":"Allow","Principal":{"AWS":"*"},"Action":"kms:*","Resource":"*"}]}` @@ -238,6 +261,32 @@ resource "aws_kms_key" "foo" { POLICY }`, kmsTimestamp) +var testAccAWSKmsKey_other_region = fmt.Sprintf(` +provider "aws" { + region = "us-east-1" +} +resource "aws_kms_key" "foo" { + description = "Terraform acc test %s" + deletion_window_in_days = 7 + policy = <