Fix aws_ec2_instance_connect_endpoint/fips_dns_name in non-US regions

[arax]

Description

Outside of FIPS-supported regions (us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, ca-west-1, us-gov-east-1, us-gov-west-1) AWS API responses for EICE do not contain the FipsDnsName property. That leaves the resource in an infinite fips_dns_name = (known after apply) loop and results in crashes on apply.

This makes sure fips_dns_name is initialized with an empty string if the FipsDnsName property is missing from the AWS API response.

This does not change the resource's documented behavior or the behavior covered by tests.

Relations

Closes #37920

References

• https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Ec2InstanceConnectEndpoint.html#API_Ec2InstanceConnectEndpoint_Contents
• https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instance-connect-endpoints.html#output
• https://aws.amazon.com/compliance/fips/

TestAcc Output

For us-east-1:

❯ make testacc TESTS=TestAccEC2InstanceConnectEndpoint PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.22.2 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccEC2InstanceConnectEndpoint'  -timeout 360m
=== RUN   TestAccEC2InstanceConnectEndpoint_basic
=== PAUSE TestAccEC2InstanceConnectEndpoint_basic
=== RUN   TestAccEC2InstanceConnectEndpoint_disappears
=== PAUSE TestAccEC2InstanceConnectEndpoint_disappears
=== RUN   TestAccEC2InstanceConnectEndpoint_tags
=== PAUSE TestAccEC2InstanceConnectEndpoint_tags
=== RUN   TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== PAUSE TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== CONT  TestAccEC2InstanceConnectEndpoint_basic
=== CONT  TestAccEC2InstanceConnectEndpoint_tags
=== CONT  TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== CONT  TestAccEC2InstanceConnectEndpoint_disappears
--- PASS: TestAccEC2InstanceConnectEndpoint_basic (388.42s)
--- PASS: TestAccEC2InstanceConnectEndpoint_securityGroupIDs (400.28s)
--- PASS: TestAccEC2InstanceConnectEndpoint_disappears (414.18s)
--- PASS: TestAccEC2InstanceConnectEndpoint_tags (1116.57s)
PASS
ok    [github.com/hashicorp/terraform-provider-aws/internal/service/ec2](http://github.com/hashicorp/terraform-provider-aws/internal/service/ec2)  1124.303s

For eu-west-1:

❯ make testacc TESTS=TestAccEC2InstanceConnectEndpoint PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.22.2 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccEC2InstanceConnectEndpoint'  -timeout 360m
=== RUN   TestAccEC2InstanceConnectEndpoint_basic
=== PAUSE TestAccEC2InstanceConnectEndpoint_basic
=== RUN   TestAccEC2InstanceConnectEndpoint_disappears
=== PAUSE TestAccEC2InstanceConnectEndpoint_disappears
=== RUN   TestAccEC2InstanceConnectEndpoint_tags
=== PAUSE TestAccEC2InstanceConnectEndpoint_tags
=== RUN   TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== PAUSE TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== CONT  TestAccEC2InstanceConnectEndpoint_basic
=== CONT  TestAccEC2InstanceConnectEndpoint_tags
=== CONT  TestAccEC2InstanceConnectEndpoint_securityGroupIDs
=== CONT  TestAccEC2InstanceConnectEndpoint_disappears
=== NAME  TestAccEC2InstanceConnectEndpoint_securityGroupIDs
    ec2_instance_connect_endpoint_test.go:138: Step 1/2 error: Check failed: Check 5/14 error: aws_ec2_instance_connect_endpoint.test: Attribute 'fips_dns_name' expected to be set
=== NAME  TestAccEC2InstanceConnectEndpoint_basic
    ec2_instance_connect_endpoint_test.go:29: Step 1/2 error: Check failed: Check 5/12 error: aws_ec2_instance_connect_endpoint.test: Attribute 'fips_dns_name' expected to be set
--- FAIL: TestAccEC2InstanceConnectEndpoint_securityGroupIDs (372.20s)
--- FAIL: TestAccEC2InstanceConnectEndpoint_basic (373.07s)
--- PASS: TestAccEC2InstanceConnectEndpoint_disappears (379.99s)
--- PASS: TestAccEC2InstanceConnectEndpoint_tags (1098.51s)
FAIL
FAIL  [github.com/hashicorp/terraform-provider-aws/internal/service/ec2](http://github.com/hashicorp/terraform-provider-aws/internal/service/ec2)  1107.920s
FAIL
make: *** [testacc] Error 1

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @arax 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[arax]

Q: I'm wondering how to properly write acc tests for behavior that depends on specific AWS regions being selected for the test. As shown above in the testacc output, us-east-1 still works as it worked before. eu-west-1 is still broken as it was broken before. Should I just relax the test criteria and check for a non-null value?

[ewbankkit]

LGTM 🚀.

% AWS_DEFAULT_REGION=ap-northeast-1 make testacc TESTARGS='-run=TestAccEC2InstanceConnectEndpoint_nonFIPSRegion' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/ec2/... -v -count 1 -parallel 20  -run=TestAccEC2InstanceConnectEndpoint_nonFIPSRegion -timeout 360m
2024/12/27 12:22:16 Initializing Terraform AWS Provider...
=== RUN   TestAccEC2InstanceConnectEndpoint_nonFIPSRegion
=== PAUSE TestAccEC2InstanceConnectEndpoint_nonFIPSRegion
=== CONT  TestAccEC2InstanceConnectEndpoint_nonFIPSRegion
--- PASS: TestAccEC2InstanceConnectEndpoint_nonFIPSRegion (254.53s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	260.294s

% make testacc TESTARGS='-run=TestAccEC2InstanceConnectEndpoint_basic\|TestAccEC2InstanceConnectEndpoint_fipsRegion' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/ec2/... -v -count 1 -parallel 20  -run=TestAccEC2InstanceConnectEndpoint_basic\|TestAccEC2InstanceConnectEndpoint_fipsRegion -timeout 360m
2024/12/27 12:29:16 Initializing Terraform AWS Provider...
=== RUN   TestAccEC2InstanceConnectEndpoint_basic
=== PAUSE TestAccEC2InstanceConnectEndpoint_basic
=== RUN   TestAccEC2InstanceConnectEndpoint_fipsRegion
=== PAUSE TestAccEC2InstanceConnectEndpoint_fipsRegion
=== CONT  TestAccEC2InstanceConnectEndpoint_basic
=== CONT  TestAccEC2InstanceConnectEndpoint_fipsRegion
--- PASS: TestAccEC2InstanceConnectEndpoint_basic (362.31s)
--- PASS: TestAccEC2InstanceConnectEndpoint_fipsRegion (364.85s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	370.237s

[nam054]

LGTM 🚀

[ewbankkit]

@arax Thanks for the contribution 🎉 👏.