provider/aws: Add user_data_not_updatable for EC2

Allow instances to have user data that might change over time but don't need to replace the instance when it occurs.

builtin/providers/aws/resource_aws_instance.go

@@ -104,6 +104,23 @@ func resourceAwsInstance() *schema.Resource {
 						return ""
 					}
 				},
+				ConflictsWith: []string{"user_data_not_updatable"},
+			},
+
+			"user_data_not_updatable": &schema.Schema{
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+				StateFunc: func(v interface{}) string {
+					switch v.(type) {
+					case string:
+						hash := sha1.Sum([]byte(v.(string)))
+						return hex.EncodeToString(hash[:])
+					default:
+						return ""
+					}
+				},
+				ConflictsWith: []string{"user_data"},
 			},
 
 			"security_groups": &schema.Schema{
@@ -1008,6 +1025,10 @@ func buildAwsInstanceOpts(
 
 	user_data := d.Get("user_data").(string)
 
+	if user_data == "" {
+		user_data = d.Get("user_data_not_updatable").(string)
+	}
+
 	// Check whether the user_data is already Base64 encoded; don't double-encode
 	_, base64DecodeError := base64.StdEncoding.DecodeString(user_data)
 

builtin/providers/aws/resource_aws_instance_test.go

@@ -589,6 +589,41 @@ func TestAccAWSInstance_rootBlockDeviceMismatch(t *testing.T) {
 	})
 }
 
+func TestAccAWSInstance_UserDataNotUpdateableDoesNotRebuildInstances(t *testing.T) {
+	var v ec2.Instance
+	var v1 ec2.Instance
+
+	testCheck := func(*terraform.State) error {
+		if (*v.InstanceId) != (*v1.InstanceId) {
+			return fmt.Errorf("Instance rebuilt: %#v  - %#v", *v.InstanceId, *v1.InstanceId)
+		}
+
+		return nil
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckInstanceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccInstanceNonDestructiveUserDataConfig_Step1,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccInstanceNonDestructiveUserDataConfig_Step2,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists("aws_instance.foo", &v1),
+					testCheck,
+				),
+			},
+		},
+	})
+}
+
 // This test reproduces the bug here:
 //   https://github.com/hashicorp/terraform/issues/1752
 //
@@ -806,6 +841,54 @@ resource "aws_instance" "foo" {
 }
 `
 
+const testAccInstanceNonDestructiveUserDataConfig_Step1 = `
+resource "aws_security_group" "tf_test_foo" {
+	name = "tf_test_foo"
+	description = "foo"
+
+	ingress {
+		protocol = "icmp"
+		from_port = -1
+		to_port = -1
+		cidr_blocks = ["0.0.0.0/0"]
+	}
+}
+
+resource "aws_instance" "foo" {
+	# us-west-2
+	ami = "ami-4fccb37f"
+	availability_zone = "us-west-2a"
+
+	instance_type = "m1.small"
+	security_groups = ["${aws_security_group.tf_test_foo.name}"]
+	user_data_not_updatable = "foo:-with-character's"
+}
+`
+
+const testAccInstanceNonDestructiveUserDataConfig_Step2 = `
+resource "aws_security_group" "tf_test_foo" {
+	name = "tf_test_foo"
+	description = "foo"
+
+	ingress {
+		protocol = "icmp"
+		from_port = -1
+		to_port = -1
+		cidr_blocks = ["0.0.0.0/0"]
+	}
+}
+
+resource "aws_instance" "foo" {
+	# us-west-2
+	ami = "ami-4fccb37f"
+	availability_zone = "us-west-2a"
+
+	instance_type = "m1.small"
+	security_groups = ["${aws_security_group.tf_test_foo.name}"]
+	user_data_not_updatable = "foo:-with-different-character's"
+}
+`
+
 const testAccInstanceConfigBlockDevices = `
 resource "aws_instance" "foo" {
 	# us-west-2

website/source/docs/providers/aws/r/instance.html.markdown

@@ -44,6 +44,8 @@ resource "aws_instance" "web" {
 
 ## Argument Reference
 
+-> **Note:** `user_data` and `user_data_not_updatable` are mutually exclusive options.
+
 The following arguments are supported:
 
 * `ami` - (Required) The AMI to use for the instance.
@@ -70,7 +72,8 @@ instances. See [Shutdown Behavior](https://docs.aws.amazon.com/AWSEC2/latest/Use
      instance in a VPC.
 * `source_dest_check` - (Optional) Controls if traffic is routed to the instance when
   the destination address does not match the instance. Used for NAT or VPNs. Defaults true.
-* `user_data` - (Optional) The user data to provide when launching the instance.
+* `user_data` - (Optional) The user data to provide when launching the instance. Subsequent changes to this will result in the instance being destroyed and recreated.
+* `user_data_not_updatable` - (Optional) The user to provide when launching the instance. Subsequent changes to this **will not** result in the instance being destroyed and recreated.
 * `iam_instance_profile` - (Optional) The IAM Instance Profile to
   launch the instance with.
 * `tags` - (Optional) A mapping of tags to assign to the resource.