internal/provider: refactor required tag early returns

Previously the check for whether tag policy compliance was enabled and included required tags for the current resource type was nested in the middle of the required tag validation logic. It is now moved to the start to exit as early as possible and prevent unnecessary processing of tag values.

```console
% TF_ACC_REQUIRED_TAG_KEY=Owner make t K=iot T=TestAccIoTBillingGroup_requiredTags
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-tag-policy-interceptor 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/iot/... -v -count 1 -parallel 20 -run='TestAccIoTBillingGroup_requiredTags'  -timeout 360m -vet=off
2025/11/21 10:54:23 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/21 10:54:23 Initializing Terraform AWS Provider (SDKv2-style)...

--- PASS: TestAccIoTBillingGroup_requiredTags_defaultTags (21.24s)
--- PASS: TestAccIoTBillingGroup_requiredTags (21.25s)
--- PASS: TestAccIoTBillingGroup_requiredTags_disabled (35.96s)
--- PASS: TestAccIoTBillingGroup_requiredTags_warning (39.28s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/iot        45.913s
```

```console
% TF_ACC_REQUIRED_TAG_KEY=Owner make t K=logs T=TestAccLogsLogGroup_requiredTags
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-tag-policy-interceptor 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/logs/... -v -count 1 -parallel 20 -run='TestAccLogsLogGroup_requiredTags'  -timeout 360m -vet=off
2025/11/21 10:57:30 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/21 10:57:30 Initializing Terraform AWS Provider (SDKv2-style)...

--- PASS: TestAccLogsLogGroup_requiredTags (19.66s)
--- PASS: TestAccLogsLogGroup_requiredTags_defaultTags (19.75s)
--- PASS: TestAccLogsLogGroup_requiredTags_disabled (35.51s)
--- PASS: TestAccLogsLogGroup_requiredTags_warning (38.56s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/logs       45.089s
```

Author: jar-b

.changelog/45201.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Fix early return logic in the required tag validation interceptor. This addresses a performance regression introduced in [v6.22.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#6220-november-20-2025).
+```

internal/provider/framework/tags_interceptor.go

@@ -278,6 +278,15 @@ func (r resourceValidateRequiredTagsInterceptor) modifyPlan(ctx context.Context,
 		return
 	}
 
+	policy := c.TagPolicyConfig(ctx)
+	if policy == nil {
+		return
+	}
+	reqTags, ok := policy.RequiredTags[typeName]
+	if !ok {
+		return
+	}
+
 	switch request, _, when := opts.request, opts.response, opts.when; when {
 	case Before:
 		// If the entire plan is null, the resource is planned for destruction.
@@ -302,16 +311,6 @@ func (r resourceValidateRequiredTagsInterceptor) modifyPlan(ctx context.Context,
 			return
 		}
 
-		policy := c.TagPolicyConfig(ctx)
-		if policy == nil {
-			return
-		}
-
-		reqTags, ok := policy.RequiredTags[typeName]
-		if !ok {
-			return
-		}
-
 		if allPlanTags.ContainsAllKeys(reqTags) {
 			return
 		}

internal/provider/sdkv2/tags_interceptor.go

@@ -309,6 +309,15 @@ func validateRequiredTags() customizeDiffInterceptor {
 			return nil
 		}
 
+		policy := c.TagPolicyConfig(ctx)
+		if policy == nil {
+			return nil
+		}
+		reqTags, ok := policy.RequiredTags[typeName]
+		if !ok {
+			return nil
+		}
+
 		switch d, when, why := opts.d, opts.when, opts.why; when {
 		case Before:
 			switch why {
@@ -320,16 +329,6 @@ func validateRequiredTags() customizeDiffInterceptor {
 					return nil
 				}
 
-				policy := c.TagPolicyConfig(ctx)
-				if policy == nil {
-					return nil
-				}
-
-				reqTags, ok := policy.RequiredTags[typeName]
-				if !ok {
-					return nil
-				}
-
 				cfgTags := tftags.New(ctx, d.Get(names.AttrTags).(map[string]any))
 				allTags := c.DefaultTagsConfig(ctx).MergeTags(cfgTags)
 				if allTags.ContainsAllKeys(reqTags) {