resource/aws_lambda_event_source_mapping & resource/aws_lambda_code_signing_config: Add tags support

.changelog/39535.txt

@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_lambda_event_source_mapping: Add `tags` argument and `tags_all` attribute
+```
+
+```release-note:enhancement
+resource/aws_lambda_event_source_mapping: Add `arn` attribute
+```
+
+```release-note:enhancement
+resource/aws_lambda_code_signing_config: Add `tags` argument and `tags_all` attribute
+```

internal/service/lambda/code_signing_config.go

@@ -11,6 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/lambda/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -19,12 +20,15 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_lambda_code_signing_config", name="Code Signing Config")
+// @Tags(identifierAttribute="arn")
+// @Testing(tagsTest=false)
 func resourceCodeSigningConfig() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceCodeSigningConfigCreate,
@@ -88,7 +92,13 @@ func resourceCodeSigningConfig() *schema.Resource {
 					},
 				},
 			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
+
+		CustomizeDiff: customdiff.Sequence(
+			verify.SetTagsDiff,
+		),
 	}
 }
 
@@ -99,6 +109,7 @@ func resourceCodeSigningConfigCreate(ctx context.Context, d *schema.ResourceData
 	input := &lambda.CreateCodeSigningConfigInput{
 		AllowedPublishers: expandAllowedPublishers(d.Get("allowed_publishers").([]interface{})),
 		Description:       aws.String(d.Get(names.AttrDescription).(string)),
+		Tags:              getTagsIn(ctx),
 	}
 
 	if v, ok := d.GetOk("policies"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -153,31 +164,33 @@ func resourceCodeSigningConfigUpdate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).LambdaClient(ctx)
 
-	input := &lambda.UpdateCodeSigningConfigInput{
-		CodeSigningConfigArn: aws.String(d.Id()),
-	}
+	if d.HasChangesExcept(names.AttrTags, names.AttrTagsAll) {
+		input := &lambda.UpdateCodeSigningConfigInput{
+			CodeSigningConfigArn: aws.String(d.Id()),
+		}
 
-	if d.HasChange("allowed_publishers") {
-		input.AllowedPublishers = expandAllowedPublishers(d.Get("allowed_publishers").([]interface{}))
-	}
+		if d.HasChange("allowed_publishers") {
+			input.AllowedPublishers = expandAllowedPublishers(d.Get("allowed_publishers").([]interface{}))
+		}
 
-	if d.HasChange(names.AttrDescription) {
-		input.Description = aws.String(d.Get(names.AttrDescription).(string))
-	}
+		if d.HasChange(names.AttrDescription) {
+			input.Description = aws.String(d.Get(names.AttrDescription).(string))
+		}
 
-	if d.HasChange("policies") {
-		if v, ok := d.GetOk("policies"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-			tfMap := v.([]interface{})[0].(map[string]interface{})
-			input.CodeSigningPolicies = &awstypes.CodeSigningPolicies{
-				UntrustedArtifactOnDeployment: awstypes.CodeSigningPolicy(tfMap["untrusted_artifact_on_deployment"].(string)),
+		if d.HasChange("policies") {
+			if v, ok := d.GetOk("policies"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				tfMap := v.([]interface{})[0].(map[string]interface{})
+				input.CodeSigningPolicies = &awstypes.CodeSigningPolicies{
+					UntrustedArtifactOnDeployment: awstypes.CodeSigningPolicy(tfMap["untrusted_artifact_on_deployment"].(string)),
+				}
 			}
 		}
-	}
 
-	_, err := conn.UpdateCodeSigningConfig(ctx, input)
+		_, err := conn.UpdateCodeSigningConfig(ctx, input)
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Lambda Code Signing Config (%s): %s", d.Id(), err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Lambda Code Signing Config (%s): %s", d.Id(), err)
+		}
 	}
 
 	return append(diags, resourceCodeSigningConfigRead(ctx, d, meta)...)

internal/service/lambda/code_signing_config_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	awstypes "github.com/aws/aws-sdk-go-v2/service/lambda/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -74,6 +75,52 @@ func TestAccLambdaCodeSigningConfig_disappears(t *testing.T) {
 	})
 }
 
+func TestAccLambdaCodeSigningConfig_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_lambda_code_signing_config.code_signing_config"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var conf awstypes.CodeSigningConfig
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.LambdaServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCodeSigningConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCodeSigningConfigConfig_tags1(rName, acctest.CtKey1, acctest.CtValue1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCodeSigningConfigExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct1),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsKey1, acctest.CtValue1),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccCodeSigningConfigConfig_tags2(rName, acctest.CtKey1, acctest.CtValue1Updated, acctest.CtKey2, acctest.CtValue2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCodeSigningConfigExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct2),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsKey1, acctest.CtValue1Updated),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsKey2, acctest.CtValue2),
+				),
+			},
+			{
+				Config: testAccCodeSigningConfigConfig_tags1(rName, acctest.CtKey2, acctest.CtValue2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCodeSigningConfigExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct1),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsKey2, acctest.CtValue2),
+				),
+			},
+		},
+	})
+}
+
 func TestAccLambdaCodeSigningConfig_updatePolicy(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_lambda_code_signing_config.code_signing_config"
@@ -222,6 +269,47 @@ resource "aws_lambda_code_signing_config" "code_signing_config" {
 }`
 }
 
+func testAccCodeSigningConfigConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_signer_signing_profile" "test" {
+  platform_id = "AWSLambda-SHA384-ECDSA"
+}
+
+resource "aws_lambda_code_signing_config" "code_signing_config" {
+  allowed_publishers {
+    signing_profile_version_arns = [
+      aws_signer_signing_profile.test.version_arn,
+    ]
+  }
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccCodeSigningConfigConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_signer_signing_profile" "test" {
+  platform_id = "AWSLambda-SHA384-ECDSA"
+}
+
+resource "aws_lambda_code_signing_config" "code_signing_config" {
+  allowed_publishers {
+    signing_profile_version_arns = [
+      aws_signer_signing_profile.test.version_arn,
+    ]
+  }
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
+
 func testAccCodeSigningConfigConfig_updatePublishers() string {
 	return `
 resource "aws_signer_signing_profile" "test1" {