Workaround upstream bug: aws_route53domains_delegation_signer_record dropped from state on refresh

[smithrobs]

Summary

Customer reported that aws_route53domains_delegation_signer_record is affected by an upstream Terraform provider bug: hashicorp/terraform-provider-aws#47928.

Symptom: Immediately after a successful Create, the very next refresh/plan removes the resource from state. The following apply then fails with:

unexpected state 'FAILED', wanted target 'SUCCESSFUL'. last error: [Parameters in request are not valid]

because Terraform/Pulumi tries to re-create a DS record the registry already has.

Root cause: Create stores DnssecKey.Id (format DS:keytag-algorithm-digesttype-digest) as returned by AssociateDelegationSignerToDomain, but Read looks the key back up via GetDomainDetail, which does not reliably echo that Id back in the same form. The lookup by Id in findDNSSECKeyByTwoPartKey therefore never matches, and the resource is treated as gone.

Fix

This adds a new upstream patch (patches/0028-...patch) to internal/service/route53domains/delegation_signer_record.go, based on the most complete upstream fix candidate (hashicorp/terraform-provider-aws#48165):

• Key on DnssecKey.Digest instead of Id in Create/Read/Delete/findDNSSECKeyByTwoPartKey. Digest is the value that is stable across AssociateDelegationSignerToDomain and GetDomainDetail.
• Stop overwriting signing_attributes in Read. GetDomainDetail doesn't populate Algorithm/Flags/PublicKey on DnssecKey, so the previous code was zeroing out the configured values and producing a permanent RequiresReplace diff.
• Delete now resolves the internal DnssecKey.Id from the digest before calling DisassociateDelegationSignerFromDomain, since that API still requires the internal Id, not the digest.
• Adds a schema v0→v1 state upgrader that rewrites any existing dnssec_key_id/id values from the old DS:keytag-algorithm-digesttype-digest shape down to the bare digest, so existing Pulumi stacks with state from a previously-broken provider aren't dropped on their first refresh after this fix lands. The upgrader is idempotent and leaves malformed values untouched rather than corrupting them.
• Adds a PlanOnly acceptance test step asserting an empty plan immediately after Create — the exact regression this fixes — plus a unit test for the digest-parsing helper used by the state upgrader.

Testing

• go build ./internal/service/route53domains/... — clean
• go vet ./internal/service/route53domains/... — clean
• go build ./... (full upstream module) — clean
• go test ./internal/service/route53domains/... -v — all unit tests pass (acceptance tests skip without TF_ACC/AWS credentials, as expected)
• Verified ./scripts/upstream.sh init -f re-applies all 28 patches (including the new one) cleanly from a clean checkout.

No SDK/schema regeneration was needed since the resource's public attribute set (dnssec_key_id, domain_name, signing_attributes, id) is unchanged — only the internal Create/Read/Delete implementation and schema version changed.

Fixes #6526

---

Created with Eon

[github-actions]

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

Maintainer note: consult the runbook for dealing with any breaking changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.91%. Comparing base (9967425) to head (008896c).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6524   +/-   ##
=======================================
  Coverage   15.91%   15.91%           
=======================================
  Files         374      374           
  Lines       91465    91465           
=======================================
  Hits        14557    14557           
  Misses      76887    76887           
  Partials       21       21           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[corymhall]

Marking as request changes so it doesn't merge. We are discussing internally.

[choeflake]

Marking as request changes so it doesn't merge. We are discussing internally.

Hi, any progress on this issue?