Bug26868: fix RAM CSR retrieval

[maxim-anetac]

Description

Given that an alternate account shared an ACM PCA with me,
When I tried to retrieve the ACM PCA resource,
I would encounter an AccessDeniedException as the default permission does not allow retrieval of the PCA's CSR.

Relations

Closes #26868.
Closes #28017.

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @maxim-anetac 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[greg-anetac]

@justinretzolk could you review this PR please?

[justinretzolk]

Hey @greg-anetac 👋 Thanks for checking in here! I can't speak to when this will be prioritized just yet. We base our prioritization on the count of 👍 reactions and a few other considerations (more information: prioritization guide).

[greg-anetac]

Hey @greg-anetac 👋 Thanks for checking in here! I can't speak to when this will be prioritized just yet. We base our prioritization on the count of 👍 reactions and a few other considerations (more information: prioritization guide).

@justinretzolk what's the threshold of 👍 reactions that is needed to make this PR considered for prioritization?

[greg-anetac]

@justinretzolk this PR is now in the top 10 unmerged PRs by number of likes. Any chance of getting it merged? It's costing us $2K/month.

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccACMPCACertificateAuthorityDataSource_' PKG=acmpca ACCTEST_PARALLELISM=2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/acmpca/... -v -count 1 -parallel 2  -run=TestAccACMPCACertificateAuthorityDataSource_ -timeout 360m
2024/12/12 14:15:32 Initializing Terraform AWS Provider...
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags_NullMap
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags_NullMap
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags_EmptyMap
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags_EmptyMap
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags_DefaultTags_nonOverlapping
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags_DefaultTags_nonOverlapping
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_DefaultTag
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_DefaultTag
=== RUN   TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_ResourceTag
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_ResourceTag
=== RUN   TestAccACMPCACertificateAuthorityDataSource_basic
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_basic
=== RUN   TestAccACMPCACertificateAuthorityDataSource_s3ObjectACL
=== PAUSE TestAccACMPCACertificateAuthorityDataSource_s3ObjectACL
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_DefaultTag
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags (14.13s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags_EmptyMap
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_DefaultTag (14.52s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags_DefaultTags_nonOverlapping
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags_DefaultTags_nonOverlapping (12.63s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_basic
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags_EmptyMap (13.04s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_s3ObjectACL
--- PASS: TestAccACMPCACertificateAuthorityDataSource_s3ObjectACL (13.29s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_ResourceTag
--- PASS: TestAccACMPCACertificateAuthorityDataSource_basic (13.80s)
=== CONT  TestAccACMPCACertificateAuthorityDataSource_tags_NullMap
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags_NullMap (12.04s)
--- PASS: TestAccACMPCACertificateAuthorityDataSource_tags_IgnoreTags_Overlap_ResourceTag (13.42s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/acmpca	59.083s

[jar-b]

LGTM 🚀

[ewbankkit]

@maxim-anetac Thanks for the contribution 🎉 👏.

[github-actions]

This functionality has been released in v5.82.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!