provider: Adjust globalaccelerator, route53, and shield service client regions to only configure in appropriate partition

[bflad]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Closes #8999
Reference: https://aws.amazon.com/about-aws/whats-new/2019/05/amazon-route-53-launches-private-dns-and-health-checks-in-the-aws-govcloud-us-west-region/

Previously, the provider service client customizations would hardcode the following region configurations:

• globalaccelerator: us-west-2
• route53: us-east-1
• shield: us-east-1

With the launch of private Route 53 Hosted Zones in AWS GovCloud (US), hardcoding the Route 53 service region to us-east-1 is no longer appropriate in all cases. Instead of fixing just Route 53, the provider initialization logic now uses the inferred AWS partition information to set these each of these service clients to known regions in known partitions.

To also support the launch of Route 53 in AWS GovCloud (US), the provider initialization will configure the endpoint in that partition to the appropriate hostname (route53.us-gov.amazonaws.com), until the AWS Go SDK is updated to include that endpoint information.

Release note for CHANGELOG:

* provider: Properly configure Route 53 service client in AWS GovCloud (US)

Previous output from acceptance testing in AWS GovCloud (US):

--- FAIL: TestAccAwsGlobalAcceleratorAccelerator_basic (4.14s)
    testing.go:568: Step 0 error: errors during apply:

        Error: Error creating Global Accelerator accelerator: UnrecognizedClientException: The security token included in the request is invalid.

--- FAIL: TestAccAWSRoute53Zone_VPC_Single (17.10s)
    testing.go:568: Step 0 error: errors during apply:

        Error: error creating Route53 Hosted Zone: InvalidClientTokenId: The security token included in the request is invalid.

--- FAIL: TestAccAWSRoute53Zone_VPC_Multiple (17.12s)
    testing.go:568: Step 0 error: errors during apply:

        Error: error creating Route53 Hosted Zone: InvalidClientTokenId: The security token included in the request is invalid.

--- FAIL: TestAccAWSRoute53Zone_VPC_Updates (17.35s)
    testing.go:568: Step 0 error: errors during apply:

        Error: error creating Route53 Hosted Zone: InvalidClientTokenId: The security token included in the request is invalid.

--- FAIL: TestAccAWSShieldProtection_ElasticIPAddress (1.53s)
    resource_aws_shield_protection_test.go:225: unexpected PreCheck error: UnrecognizedClientException: The security token included in the request is invalid.

Output from acceptance testing in AWS Commercial:

--- PASS: TestAccAWSProvider_Endpoints_Deprecated (2.45s)
--- PASS: TestAccAWSProvider_Endpoints (2.48s)

--- PASS: TestAccAwsGlobalAcceleratorAccelerator_basic (67.03s)

--- PASS: TestAccAWSRoute53Zone_VPC_Single (65.90s)
--- PASS: TestAccAWSRoute53Zone_VPC_Multiple (110.68s)
--- PASS: TestAccAWSRoute53Zone_VPC_Updates (195.53s)

--- PASS: TestAccAWSShieldProtection_ElasticIPAddress (13.39s)

Output from acceptance testing in AWS GovCloud (US) (handling now correct for partition):

--- FAIL: TestAccAwsGlobalAcceleratorAccelerator_basic (5.42s)
    testing.go:568: Step 0 error: errors during apply:

        Error: Error creating Global Accelerator accelerator: RequestError: send request failed
        caused by: Post https://globalaccelerator.us-gov-west-1.amazonaws.com/: dial tcp: lookup globalaccelerator.us-gov-west-1.amazonaws.com: no such host

--- PASS: TestAccAWSRoute53Zone_VPC_Single (62.37s)
--- PASS: TestAccAWSRoute53Zone_VPC_Multiple (93.66s)
--- PASS: TestAccAWSRoute53Zone_VPC_Updates (164.85s)

--- SKIP: TestAccAWSShieldProtection_ElasticIPAddress (1.48s)
    resource_aws_shield_protection_test.go:221: skipping acceptance testing: RequestError: send request failed
        caused by: Post https://shield.us-gov-west-1.amazonaws.com/: dial tcp: lookup shield.us-gov-west-1.amazonaws.com: no such host

[ericfrederich]

Perfect Timing ! 🥂

I ran into this problem last week. I was unable to create a hosted zone in us-gov-east-1.
After setting log level to trace and grepping for "Host: " I noticed it was going after route53.amazonaws.com instead of route53.us-gov.amazonaws.com

I compiled the provider at this commit and it worked for me. Thanks!

[nywilken]

LGTM 👍 👍

[bflad]

This has been released in version 2.16.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!