feat: add support for single scram secret association

[dstrates]

Description

The current aws_msk_scram_secret_association resource is not flexible and tightly couples the management of secret associations to MSK clusters. This causes issues when attempting to manage secret associations separately from the cluster creation, as it removes all existing secret associations created out of band.

The proposed change implements @bflad's suggestions in #16832 (review), adding an optional secret_arn argument to the aws_msk_scram_secret_association resource.

Relations

Closes #16791.
Closes #40217.
Relates #16832.

Output from Acceptance Testing

% make testacc TESTS=TestAccXXX PKG=ec2

...

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @dstrates 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[SuSaiGit]

When will this be merged?

[sbrnunes]

Hi everyone.

This is causing serious problems in our case, and considering the upvotes in this issue and in #16791, it appears to be affecting a lot of people.

If this PR fixes it, when can we see it reviewed, merged and released?

[ewbankkit]

LGTM 🚀.

% ACCTEST_TIMEOUT=720m make testacc TESTARGS='-run=TestAccKafkaSCRAMSecretAssociation_\|TestAccKafkaSingleSCRAMSecretAssociation_' PKG=kafka ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/kafka/... -v -count 1 -parallel 3  -run=TestAccKafkaSCRAMSecretAssociation_\|TestAccKafkaSingleSCRAMSecretAssociation_ -timeout 720m
2024/12/11 06:00:54 Initializing Terraform AWS Provider...
=== RUN   TestAccKafkaSCRAMSecretAssociation_basic
=== PAUSE TestAccKafkaSCRAMSecretAssociation_basic
=== RUN   TestAccKafkaSCRAMSecretAssociation_update
=== PAUSE TestAccKafkaSCRAMSecretAssociation_update
=== RUN   TestAccKafkaSCRAMSecretAssociation_disappears
=== PAUSE TestAccKafkaSCRAMSecretAssociation_disappears
=== RUN   TestAccKafkaSCRAMSecretAssociation_Disappears_cluster
=== PAUSE TestAccKafkaSCRAMSecretAssociation_Disappears_cluster
=== RUN   TestAccKafkaSingleSCRAMSecretAssociation_basic
=== PAUSE TestAccKafkaSingleSCRAMSecretAssociation_basic
=== RUN   TestAccKafkaSingleSCRAMSecretAssociation_multiple
=== PAUSE TestAccKafkaSingleSCRAMSecretAssociation_multiple
=== RUN   TestAccKafkaSingleSCRAMSecretAssociation_disappears
=== PAUSE TestAccKafkaSingleSCRAMSecretAssociation_disappears
=== CONT  TestAccKafkaSCRAMSecretAssociation_basic
=== CONT  TestAccKafkaSingleSCRAMSecretAssociation_basic
=== CONT  TestAccKafkaSingleSCRAMSecretAssociation_disappears
--- PASS: TestAccKafkaSCRAMSecretAssociation_basic (676.66s)
=== CONT  TestAccKafkaSCRAMSecretAssociation_disappears
--- PASS: TestAccKafkaSingleSCRAMSecretAssociation_basic (678.48s)
=== CONT  TestAccKafkaSCRAMSecretAssociation_Disappears_cluster
=== CONT  TestAccKafkaSCRAMSecretAssociation_update
--- PASS: TestAccKafkaSingleSCRAMSecretAssociation_disappears (685.36s)
--- PASS: TestAccKafkaSCRAMSecretAssociation_disappears (291.45s)
=== CONT  TestAccKafkaSingleSCRAMSecretAssociation_multiple
--- PASS: TestAccKafkaSCRAMSecretAssociation_Disappears_cluster (300.89s)
--- PASS: TestAccKafkaSCRAMSecretAssociation_update (325.08s)
--- PASS: TestAccKafkaSingleSCRAMSecretAssociation_multiple (325.05s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/kafka	1298.437s

[jar-b]

LGTM 🚀

I think the resource name is reasonable given the misnaming of the original, which should have been an "exclusive" variant had it not predated us publishing a formal definition for those resource types.

[ewbankkit]

@dstrates Thanks for the contribution 🎉 👏.
We decided to implement this single association functionality as a new resource, aws_msk_single_scram_secret_association.

[github-actions]

This functionality has been released in v5.81.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!