r/aws_cognito_identity_provider: Change idp_identifiers to a set 🤖🤖🤖

[mhorbul]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

None.

Description

aws_cognito_identity_provider.idp_identifiers was modelled as a TypeList, but Cognito returns the identifiers in its own order, which does not necessarily match the order they were sent in. Whenever the two orders differ, the resource has a permanent diff: every apply rewrites the identifiers with the configured order, DescribeIdentityProvider returns a different order, and the next plan shows the same reordering again.

The order of the identifiers carries no meaning for Cognito, so this changes the attribute to a TypeSet.

CloudTrail for a single affected resource, showing the write and the subsequent read disagreeing (domains redacted):

UpdateIdentityProvider    requestParameters.idpIdentifiers: ["alpha.example.com","beta.example.org"]
DescribeIdentityProvider  IdentityProvider.IdpIdentifiers:  ["beta.example.org","alpha.example.com"]

Existing state written by the previous TypeList schema is read back into the set without a diff or a replacement, so no state upgrade is required. I verified this against real infrastructure that was showing the perpetual diff: a locally built provider with this patch produces No changes. Your infrastructure matches the configuration. for four aws_cognito_identity_provider resources that the released provider wanted to update in-place on every run, with no configuration change.

TestAccCognitoIDPIdentityProvider_idpIdentifiersOrder is a regression test: it applies two identifiers, then reorders them in the configuration and asserts an empty plan.

AI Usage

Disclosed per the AI usage policy. This change was produced with an AI coding agent (Claude Code) working under my direction:

• The agent diagnosed the root cause from CloudTrail evidence in my own AWS account, wrote the schema and expander changes, wrote the new acceptance test and the test configuration function, and drafted this description.
• I directed the work, reviewed the diff, and ran the verification myself on my machine: go build, go vet, gofmt, the SDKv2 provider InternalValidate test, and the acceptance tests against a real AWS account.
• The regression test was validated in both directions: it fails on unpatched code with the exact reported drift, and passes with the change applied. Both runs are included below.

Relations

Closes #46686

References

• Maintainer-approved analysis in aws_cognito_identity_provider.idp_identifiers always attempting changes #46686 identifying TypeList as the root cause and TypeSet as the fix.
• resource/aws_lakeformation_opt_in ([Bug]: aws_lakeformation_opt_in lf_tag resource uses incorrect field name - should be "values" (array) not "value" (string) #46788) made the same kind of list-to-set change in a minor release, v6.37.0, where it was announced under BREAKING CHANGES.

Output from Acceptance Testing

% make testacc TESTS='TestAccCognitoIDPIdentityProvider_' PKG=cognitoidp

--- PASS: TestAccCognitoIDPIdentityProvider_Disappears_userPool (22.26s)
--- PASS: TestAccCognitoIDPIdentityProvider_disappears (23.00s)
--- PASS: TestAccCognitoIDPIdentityProvider_idpIdentifiersOrder (31.77s)
--- PASS: TestAccCognitoIDPIdentityProvider_basic (37.16s)
--- PASS: TestAccCognitoIDPIdentityProvider_idpIdentifiers (37.51s)
--- PASS: TestAccCognitoIDPIdentityProvider_saml (49.55s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp 55.922s

Without the schema change (new test only, TypeList restored), the new test fails with exactly the reported drift:

% make testacc TESTS='TestAccCognitoIDPIdentityProvider_idpIdentifiersOrder' PKG=cognitoidp

          # aws_cognito_identity_provider.test will be updated in-place
          ~ resource "aws_cognito_identity_provider" "test" {
                id                = "us-east-1_XXXXXXXXX:Google"
              ~ idp_identifiers   = [
                  - "test2",
                    "test1",
                  + "test2",
                ]
                # (6 unchanged attributes hidden)
            }

        Plan: 0 to add, 1 to change, 0 to destroy.
FAIL
FAIL    github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp 23.839s

Compatibility

idp_identifiers can no longer be indexed. Configurations using aws_cognito_identity_provider.example.idp_identifiers[0], or passing the attribute to functions that require a list such as join, need tolist(). I am happy to retarget this at a major release if you would prefer to hold it. If the type change is not acceptable at all, the alternative is to keep TypeList and suppress the ordering difference with a sorted-comparison DiffSuppressFunc, which I think is more fragile than modelling the attribute correctly.

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.