r/aws_cognito_log_delivery_configuration: fix log_configurations order inconsistency

[PanosKard]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No. This is purely a fix for a Terraform plan/apply consistency error — a schema type change from a list to a set. It doesn't change what gets logged, where it's delivered, the log levels, or anything to do with access, encryption, or IAM.

Description

Right now, if you write the log_configurations blocks in a different order than Cognito hands them back, terraform apply fails with Error: Provider produced inconsistent result after apply.

Here's why: Cognito's GetLogDeliveryConfiguration always returns the blocks in its own fixed order (userNotification before userAuthEvents), no matter what order you sent. The resource stored log_configurations as an ordered list, so after apply flex.Flatten writes AWS's order into state — and if that doesn't match your config, the block at index 0 isn't the one Terraform planned for index 0, so it throws the inconsistent-result error.

The fix is to stop treating it as ordered: make log_configurations a SetNestedBlock instead of a ListNestedBlock (and switch the model field to the set type). Each block is keyed by event_source and the order means nothing, so a set is what this should have been. Sets don't care about order, so the error is gone for create, update, and read — no sorting code needed. The inner blocks (cloud_watch_logs_configuration, firehose_configuration, s3_configuration) stay as they are. Same fix that already landed for aws_cloudfront_multitenant_distribution (#46045).

Tests. With a set, the old index-based checks (log_configurations.0.…) don't work anymore, so I moved them to TestCheckTypeSetElemNestedAttrs / TestCheckTypeSetElemAttrPair. I also added TestAccCognitoIDPLogDeliveryConfiguration_orderSwap — it applies two blocks, swaps their order, and expects an empty plan. That's exactly the case that used to break.

Getting the userAuthEvents tests to actually pass against real AWS meant fixing a few unrelated things the existing fixtures got wrong:

• The test pools default to the ESSENTIALS tier, but userAuthEvents needs Threat Protection, which needs PLUS. Added user_pool_tier = "PLUS" + advanced_security_mode = "AUDIT".
• userAuthEvents only sends INFO logs, so log_level = "ERROR" gets rejected. Changed those to INFO.
• Cognito adds a LogDeliveryEnabled tag to the Firehose stream on its own, which leaves a dirty plan. Added ignore_changes = [tags, tags_all] on the stream in the test.

One test I left alone. TestAccCognitoIDPLogDeliveryConfiguration_disappears fails with expected Create, got update. That's not from this change — delete just empties the config, but Read still returns the empty config, so the plan is an update instead of a recreate (same behavior whether it's a list or a set). Fixing it means touching the read/delete logic, so I kept it out of this PR to stay focused. Happy to do it separately.

Heads-up on compatibility. List → set is technically breaking if someone references these blocks by index (log_configurations[0]). But the resource is new and today it just errors whenever the order doesn't match AWS, so I think this is the right trade. Glad to switch to a non-breaking reorder approach if you'd rather.

---

AI disclaimer: The acceptance tests were amended with AI help. I've reviewed everything and confirmed it with real acceptance-test runs against AWS.

Relations

Closes #49202

References

Same bug and the same fix on another Plugin Framework resource: #46045 (aws_cloudfront_multitenant_distribution origin ordering).

Output from Acceptance Testing

--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_basic (51.86s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_logLevelUpdate (60.28s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_orderSwap (61.51s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_Identity_regionOverride (61.91s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_Identity_basic (62.18s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_firehose (161.33s)
--- PASS: TestAccCognitoIDPLogDeliveryConfiguration_update (224.89s)

Pre-existing, unrelated to this change (see Description):

--- FAIL: TestAccCognitoIDPLogDeliveryConfiguration_disappears

AWS_DEFAULT_REGION=us-east-1 make testacc TESTS=TestAccCognitoIDPLogDeliveryConfiguration_ PKG=cognitoidp

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.