diff --git a/.changes/v1.12/ENHANCEMENTS-20250320-120304.yaml b/.changes/v1.12/ENHANCEMENTS-20250320-120304.yaml new file mode 100644 index 000000000000..2f052143bfcc --- /dev/null +++ b/.changes/v1.12/ENHANCEMENTS-20250320-120304.yaml @@ -0,0 +1,5 @@ +kind: ENHANCEMENTS +body: Optional skipping of the validation of the KMS key ID in the S3 backends. +time: 2025-03-20T12:03:04.152186-03:00 +custom: + Issue: "36730" diff --git a/internal/backend/remote-state/s3/backend.go b/internal/backend/remote-state/s3/backend.go index f53c22c3d3fd..2b571c7a419c 100644 --- a/internal/backend/remote-state/s3/backend.go +++ b/internal/backend/remote-state/s3/backend.go @@ -49,6 +49,7 @@ type Backend struct { useLockFile bool workspaceKeyPrefix string skipS3Checksum bool + skipKmsKeyIdValidation bool } // ConfigSchema returns a description of the expected configuration @@ -215,6 +216,11 @@ func (b *Backend) ConfigSchema() *configschema.Block { Optional: true, Description: "Do not include checksum when uploading S3 Objects. Useful for some S3-Compatible APIs.", }, + "skip_kms_key_id_validation": { + Type: cty.Bool, + Optional: false, + Description: "Skip the KMS key ID validation.", + }, "sse_customer_key": { Type: cty.String, Optional: true, @@ -660,7 +666,10 @@ func (b *Backend) PrepareConfig(obj cty.Value) (cty.Value, tfdiags.Diagnostics) validateStringKMSKey, }, } - kmsKeyIDValidators.ValidateAttr(val, attrPath, &diags) + + if !b.skipKmsKeyIdValidation { + kmsKeyIDValidators.ValidateAttr(val, attrPath, &diags) + } } attrPath = cty.GetAttrPath("workspace_key_prefix") @@ -837,6 +846,7 @@ func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics { b.ddbTable = stringAttr(obj, "dynamodb_table") b.useLockFile = boolAttr(obj, "use_lockfile") b.skipS3Checksum = boolAttr(obj, "skip_s3_checksum") + b.skipKmsKeyIdValidation = boolAttr(obj, "skip_kms_key_id_validation") if _, ok := stringAttrOk(obj, "kms_key_id"); ok { if customerKey := os.Getenv("AWS_SSE_CUSTOMER_KEY"); customerKey != "" { diff --git a/internal/backend/remote-state/s3/backend_test.go b/internal/backend/remote-state/s3/backend_test.go index 10e00c0e3ee9..283dff709c56 100644 --- a/internal/backend/remote-state/s3/backend_test.go +++ b/internal/backend/remote-state/s3/backend_test.go @@ -2474,6 +2474,14 @@ func TestBackendConfigKmsKeyId(t *testing.T) { ), }, }, + + "skip-validation": { + config: map[string]any{ + "kms_key_id": "not-an-arn", + "skip_kms_key_id_validation" : True, + }, + expectedKeyId: "not-an-arn", + }, } for name, tc := range testCases {