Merge pull request #43908 from shawnaws/f/ddb-mrsc-witness-updates

feat: Add support for Witness Region for Global Tables with MRSC

Author: ewbankkit

.changelog/43908.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dynamodb_table: Add `global_table_witness` argument
+```

internal/service/dynamodb/table.go

@@ -226,6 +226,22 @@ func resourceTable() *schema.Resource {
 						},
 					},
 				},
+				"global_table_witness": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"region_name": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: verify.ValidRegionName,
+							},
+						},
+					},
+				},
 				"hash_key": {
 					Type:     schema.TypeString,
 					Optional: true,
@@ -884,7 +900,7 @@ func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta any)
 	}
 
 	if v := d.Get("replica").(*schema.Set); v.Len() > 0 {
-		if err := createReplicas(ctx, conn, d.Id(), v.List(), true, d.Timeout(schema.TimeoutCreate)); err != nil {
+		if err := createReplicas(ctx, conn, d.Id(), v.List(), expandGlobalTableWitness(d.Get("global_table_witness")), true, d.Timeout(schema.TimeoutCreate)); err != nil {
 			return create.AppendDiagError(diags, names.DynamoDB, create.ErrActionCreating, resNameTable, d.Id(), fmt.Errorf("replicas: %w", err))
 		}
 
@@ -951,6 +967,10 @@ func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta any) di
 		return create.AppendDiagSettingError(diags, names.DynamoDB, resNameTable, d.Id(), "global_secondary_index", err)
 	}
 
+	if err := d.Set("global_table_witness", flattenGlobalTableWitnesses(table.GlobalTableWitnesses)); err != nil {
+		return create.AppendDiagSettingError(diags, names.DynamoDB, resNameTable, d.Id(), "global_table_witness", err)
+	}
+
 	if err := d.Set("on_demand_throughput", flattenOnDemandThroughput(table.OnDemandThroughput)); err != nil {
 		return create.AppendDiagSettingError(diags, names.DynamoDB, resNameTable, d.Id(), "on_demand_throughput", err)
 	}
@@ -1393,10 +1413,11 @@ func resourceTableDelete(ctx context.Context, d *schema.ResourceData, meta any)
 
 	if replicas := d.Get("replica").(*schema.Set).List(); len(replicas) > 0 {
 		log.Printf("[DEBUG] Deleting DynamoDB Table replicas: %s", d.Id())
-		if err := deleteReplicas(ctx, conn, d.Id(), replicas, d.Timeout(schema.TimeoutDelete)); err != nil {
+		if err := deleteReplicas(ctx, conn, d.Id(), replicas, expandGlobalTableWitness(d.Get("global_table_witness")), d.Timeout(schema.TimeoutDelete)); err != nil {
 			// ValidationException: Replica specified in the Replica Update or Replica Delete action of the request was not found.
 			// ValidationException: Cannot add, delete, or update the local region through ReplicaUpdates. Use CreateTable, DeleteTable, or UpdateTable as required.
 			if !tfawserr.ErrMessageContains(err, errCodeValidationException, "request was not found") &&
+				!tfawserr.ErrMessageContains(err, errCodeValidationException, "MultiRegionConsistency must be set as STRONG when GlobalTableWitnessUpdates parameter is present") &&
 				!tfawserr.ErrMessageContains(err, errCodeValidationException, "Cannot add, delete, or update the local region through ReplicaUpdates") {
 				return create.AppendDiagError(diags, names.DynamoDB, create.ErrActionDeleting, resNameTable, d.Id(), err)
 			}
@@ -1471,7 +1492,7 @@ func cycleStreamEnabled(ctx context.Context, conn *dynamodb.Client, id string, s
 	return nil
 }
 
-func createReplicas(ctx context.Context, conn *dynamodb.Client, tableName string, tfList []any, create bool, timeout time.Duration) error {
+func createReplicas(ctx context.Context, conn *dynamodb.Client, tableName string, tfList []any, globalTableWitnessRegionName string, create bool, timeout time.Duration) error {
 	// Duplicating this for MRSC Adoption. If using MRSC and CreateReplicationGroupMemberAction list isn't initiated for at least 2 replicas
 	// then the update table action will fail with
 	// "Unsupported table replica count for global tables with MultiRegionConsistency set to STRONG"
@@ -1492,14 +1513,18 @@ func createReplicas(ctx context.Context, conn *dynamodb.Client, tableName string
 	}
 
 	if numReplicasMRSC > 0 {
+		mrscErrorMsg := "creating replicas: Using MultiRegionStrongConsistency requires exactly 2 replicas, or 1 replica and 1 witness region."
 		if numReplicasMRSC > 0 && numReplicasMRSC != numReplicas {
-			return fmt.Errorf("creating replicas: Using MultiRegionStrongConsistency requires all replicas to use 'consistency_mode' set to 'STRONG' ")
+			return errors.New(mrscErrorMsg)
+		}
+		if numReplicasMRSC == 1 && globalTableWitnessRegionName == "" {
+			return fmt.Errorf("%s Only MRSC Replica count of 1 was provided but no Witness region was provided", mrscErrorMsg)
 		}
-		if numReplicasMRSC == 1 {
-			return fmt.Errorf("creating replicas: Using MultiRegionStrongConsistency requires exactly 2 replicas. ")
+		if numReplicasMRSC == 2 && (numReplicasMRSC == numReplicas && globalTableWitnessRegionName != "") {
+			return fmt.Errorf("%s MRSC Replica count of 2 was provided and a Witness region was also provided", mrscErrorMsg)
 		}
 		if numReplicasMRSC > 2 {
-			return fmt.Errorf("creating replicas: Using MultiRegionStrongConsistency supports at most 2 replicas. ")
+			return fmt.Errorf("%s Too many Replicas were provided %d", mrscErrorMsg, numReplicasMRSC)
 		}
 
 		mrscInput = awstypes.MultiRegionConsistencyStrong
@@ -1530,14 +1555,24 @@ func createReplicas(ctx context.Context, conn *dynamodb.Client, tableName string
 			})
 		}
 
-		input := &dynamodb.UpdateTableInput{
-			TableName:              aws.String(tableName),
-			ReplicaUpdates:         replicaCreates,
-			MultiRegionConsistency: mrscInput,
+		var gtgwu []awstypes.GlobalTableWitnessGroupUpdate
+		if globalTableWitnessRegionName != "" {
+			var cgtwgma = awstypes.CreateGlobalTableWitnessGroupMemberAction{
+				RegionName: aws.String(globalTableWitnessRegionName),
+			}
+			gtgwu = append(gtgwu, awstypes.GlobalTableWitnessGroupUpdate{
+				Create: &cgtwgma,
+			})
+		}
+		input := dynamodb.UpdateTableInput{
+			GlobalTableWitnessUpdates: gtgwu,
+			MultiRegionConsistency:    mrscInput,
+			ReplicaUpdates:            replicaCreates,
+			TableName:                 aws.String(tableName),
 		}
 
 		err := tfresource.Retry(ctx, max(replicaUpdateTimeout, timeout), func(ctx context.Context) *tfresource.RetryError {
-			_, err := conn.UpdateTable(ctx, input)
+			_, err := conn.UpdateTable(ctx, &input)
 			if err != nil {
 				if tfawserr.ErrCodeEquals(err, errCodeThrottlingException) {
 					return tfresource.RetryableError(err)
@@ -1655,7 +1690,7 @@ func createReplicas(ctx context.Context, conn *dynamodb.Client, tableName string
 			// ValidationException: One or more parameter values were invalid: KMSMasterKeyId must be specified for each replica.
 
 			if create && tfawserr.ErrMessageContains(err, errCodeValidationException, "already exist") {
-				return createReplicas(ctx, conn, tableName, tfList, false, timeout)
+				return createReplicas(ctx, conn, tableName, tfList, globalTableWitnessRegionName, false, timeout)
 			}
 
 			if err != nil && !tfawserr.ErrMessageContains(err, errCodeValidationException, "no actions specified") {
@@ -1898,20 +1933,22 @@ func updateReplica(ctx context.Context, conn *dynamodb.Client, d *schema.Resourc
 		}
 	}
 
+	globalTableWitnessRegionName := expandGlobalTableWitness(d.Get("global_table_witness"))
+
 	if len(removeFirst) > 0 { // mini ForceNew, recreates replica but doesn't recreate the table
-		if err := deleteReplicas(ctx, conn, d.Id(), removeFirst, d.Timeout(schema.TimeoutUpdate)); err != nil {
+		if err := deleteReplicas(ctx, conn, d.Id(), removeFirst, globalTableWitnessRegionName, d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return fmt.Errorf("updating replicas, while deleting: %w", err)
 		}
 	}
 
 	if len(toRemove) > 0 {
-		if err := deleteReplicas(ctx, conn, d.Id(), toRemove, d.Timeout(schema.TimeoutUpdate)); err != nil {
+		if err := deleteReplicas(ctx, conn, d.Id(), toRemove, globalTableWitnessRegionName, d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return fmt.Errorf("updating replicas, while deleting: %w", err)
 		}
 	}
 
 	if len(toAdd) > 0 {
-		if err := createReplicas(ctx, conn, d.Id(), toAdd, true, d.Timeout(schema.TimeoutCreate)); err != nil {
+		if err := createReplicas(ctx, conn, d.Id(), toAdd, globalTableWitnessRegionName, true, d.Timeout(schema.TimeoutCreate)); err != nil {
 			return fmt.Errorf("updating replicas, while creating: %w", err)
 		}
 	}
@@ -2164,7 +2201,7 @@ func deleteTable(ctx context.Context, conn *dynamodb.Client, tableName string) e
 	return err
 }
 
-func deleteReplicas(ctx context.Context, conn *dynamodb.Client, tableName string, tfList []any, timeout time.Duration) error {
+func deleteReplicas(ctx context.Context, conn *dynamodb.Client, tableName string, tfList []any, globalTableWitnessRegionName string, timeout time.Duration) error {
 	var g multierror.Group
 
 	var replicaDeletes []awstypes.ReplicationGroupUpdate
@@ -2199,12 +2236,22 @@ func deleteReplicas(ctx context.Context, conn *dynamodb.Client, tableName string
 	// We built an array of MultiRegionStrongConsistency replicas that need deletion.
 	// These need to all happen concurrently
 	if len(replicaDeletes) > 0 {
-		input := &dynamodb.UpdateTableInput{
-			TableName:      aws.String(tableName),
-			ReplicaUpdates: replicaDeletes,
+		var witnessDeletes []awstypes.GlobalTableWitnessGroupUpdate
+		if globalTableWitnessRegionName != "" {
+			witnessDeletes = append(witnessDeletes, awstypes.GlobalTableWitnessGroupUpdate{
+				Delete: &awstypes.DeleteGlobalTableWitnessGroupMemberAction{
+					RegionName: aws.String(globalTableWitnessRegionName),
+				},
+			})
+		}
+
+		input := dynamodb.UpdateTableInput{
+			GlobalTableWitnessUpdates: witnessDeletes,
+			ReplicaUpdates:            replicaDeletes,
+			TableName:                 aws.String(tableName),
 		}
 		err := tfresource.Retry(ctx, updateTableTimeout, func(ctx context.Context) *tfresource.RetryError {
-			_, err := conn.UpdateTable(ctx, input)
+			_, err := conn.UpdateTable(ctx, &input)
 			notFoundRetries := 0
 			if err != nil {
 				if tfawserr.ErrCodeEquals(err, errCodeThrottlingException) {
@@ -2694,6 +2741,24 @@ func flattenGSIWarmThroughput(apiObject *awstypes.GlobalSecondaryIndexWarmThroug
 	return []any{m}
 }
 
+func expandGlobalTableWitness(v any) string {
+	if v == nil || len(v.([]any)) == 0 || v.([]any)[0] == nil {
+		return ""
+	}
+
+	return v.([]any)[0].(map[string]any)["region_name"].(string)
+}
+
+func flattenGlobalTableWitnesses(apiObjects []awstypes.GlobalTableWitnessDescription) []any {
+	if len(apiObjects) != 1 {
+		return []any{}
+	}
+
+	return []any{map[string]any{
+		"region_name": aws.ToString(apiObjects[0].RegionName),
+	}}
+}
+
 func flattenReplicaDescription(apiObject *awstypes.ReplicaDescription) map[string]any {
 	if apiObject == nil {
 		return nil