Implement VPC configuration for AWS Kendra data source

.changelog/42672.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+resource/aws_kendra_data_source: Add support for VPC configuration
+``` 

internal/service/kendra/data_source.go

@@ -348,6 +348,27 @@ func ResourceDataSource() *schema.Resource {
 					},
 				},
 			},
+			names.AttrVPCConfiguration: {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						names.AttrSecurityGroupIDs: {
+							Type:     schema.TypeSet,
+							Required: true,
+							MaxItems: 100,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						names.AttrSubnetIDs: {
+							Type:     schema.TypeSet,
+							Required: true,
+							MaxItems: 100,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
 			"custom_document_enrichment_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -647,6 +668,10 @@ func resourceDataSourceCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.Schedule = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk(names.AttrVPCConfiguration); ok && len(v.([]any)) > 0 && v.([]any)[0] != nil {
+		input.VpcConfiguration = expandVPCConfiguration(v.([]any))
+	}
+
 	outputRaw, err := tfresource.RetryWhen(ctx, propagationTimeout,
 		func() (any, error) {
 			return conn.CreateDataSource(ctx, input)
@@ -738,6 +763,14 @@ func resourceDataSourceRead(ctx context.Context, d *schema.ResourceData, meta an
 		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	if resp.VpcConfiguration != nil {
+		if err := d.Set(names.AttrVPCConfiguration, []any{flattenVPCConfiguration(resp.VpcConfiguration)}); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting vpc_configuration: %s", err)
+		}
+	} else {
+		d.Set(names.AttrVPCConfiguration, nil)
+	}
+
 	return diags
 }
 
@@ -789,6 +822,10 @@ func resourceDataSourceUpdate(ctx context.Context, d *schema.ResourceData, meta
 			input.Schedule = aws.String(d.Get(names.AttrSchedule).(string))
 		}
 
+		if d.HasChange(names.AttrVPCConfiguration) {
+			input.VpcConfiguration = expandVPCConfiguration(d.Get(names.AttrVPCConfiguration).([]any))
+		}
+
 		log.Printf("[DEBUG] Updating Kendra Data Source (%s): %#v", d.Id(), input)
 
 		_, err = tfresource.RetryWhen(ctx, propagationTimeout,
@@ -1755,3 +1792,41 @@ func flattenDocumentAttributeValue(apiObject *types.DocumentAttributeValue) []an
 
 	return []any{tfMap}
 }
+
+func expandVPCConfiguration(vVpcConfiguration []any) *types.DataSourceVpcConfiguration {
+	if len(vVpcConfiguration) == 0 || vVpcConfiguration[0] == nil {
+		return nil
+	}
+
+	vpcConfiguration := &types.DataSourceVpcConfiguration{}
+
+	mVpcConfiguration := vVpcConfiguration[0].(map[string]any)
+
+	if vSecurityGroupIds, ok := mVpcConfiguration[names.AttrSecurityGroupIDs].(*schema.Set); ok && vSecurityGroupIds.Len() > 0 {
+		vpcConfiguration.SecurityGroupIds = flex.ExpandStringValueSet(vSecurityGroupIds)
+	}
+
+	if vSubnetIds, ok := mVpcConfiguration[names.AttrSubnetIDs].(*schema.Set); ok && vSubnetIds.Len() > 0 {
+		vpcConfiguration.SubnetIds = flex.ExpandStringValueSet(vSubnetIds)
+	}
+
+	return vpcConfiguration
+}
+
+func flattenVPCConfiguration(apiObject *types.DataSourceVpcConfiguration) []any {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]any{}
+
+	if v := apiObject.SecurityGroupIds; v != nil {
+		m[names.AttrSecurityGroupIDs] = flex.FlattenStringValueSet(v)
+	}
+
+	if v := apiObject.SubnetIds; v != nil {
+		m[names.AttrSubnetIDs] = flex.FlattenStringValueSet(v)
+	}
+
+	return []any{m}
+}

internal/service/kendra/data_source_test.go

@@ -3485,3 +3485,201 @@ resource "aws_kendra_data_source" "test" {
 }
 `, rName10, rName11, selectLambdaARN))
 }
+
+func TestAccKendraDataSource_VPCConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	rName := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	rName2 := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	rName3 := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	rName4 := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	rName5 := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	rName6 := sdkacctest.RandomWithPrefix("resource-test-terraform")
+	resourceName := "aws_kendra_data_source.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.KendraServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDataSourceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceConfig_vpcConfiguration(rName, rName2, rName3, rName4, rName5, rName6),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataSourceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".#", "1"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSecurityGroupIDs+".#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSecurityGroupIDs+".0", "aws_security_group.test", names.AttrID),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".#", "2"),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".0", "aws_subnet.test.0", names.AttrID),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".1", "aws_subnet.test.1", names.AttrID),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDataSourceConfig_vpcConfigurationUpdated(rName, rName2, rName3, rName4, rName5, rName6),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataSourceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".#", "1"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSecurityGroupIDs+".#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSecurityGroupIDs+".0", "aws_security_group.test2", names.AttrID),
+					resource.TestCheckResourceAttr(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".#", "2"),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".0", "aws_subnet.test2.0", names.AttrID),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrVPCConfiguration+".0."+names.AttrSubnetIDs+".1", "aws_subnet.test2.1", names.AttrID),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceConfig_vpcConfiguration(rName, rName2, rName3, rName4, rName5, rName6 string) string {
+	return acctest.ConfigCompose(
+		testAccDataSourceConfigBase(rName, rName2, rName3),
+		testAccDataSourceConfigS3Base(rName4, rName5),
+		fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  count = 2
+
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_kendra_data_source" "test" {
+  index_id = aws_kendra_index.test.id
+  name     = %[2]q
+  type     = "S3"
+  role_arn = aws_iam_role.test_data_source.arn
+
+  vpc_configuration {
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = aws_subnet.test[*].id
+  }
+
+  configuration {
+    s3_configuration {
+      bucket_name = aws_s3_bucket.test.id
+    }
+  }
+}
+`, rName, rName6))
+}
+
+func testAccDataSourceConfig_vpcConfigurationUpdated(rName, rName2, rName3, rName4, rName5, rName6 string) string {
+	return acctest.ConfigCompose(
+		testAccDataSourceConfigBase(rName, rName2, rName3),
+		testAccDataSourceConfigS3Base(rName4, rName5),
+		fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_vpc" "test2" {
+  cidr_block = "172.16.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  count = 2
+
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test2" {
+  count = 2
+
+  vpc_id            = aws_vpc.test2.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.test2.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "test2" {
+  name   = "%[1]s-2"
+  vpc_id = aws_vpc.test2.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_kendra_data_source" "test" {
+  index_id = aws_kendra_index.test.id
+  name     = %[2]q
+  type     = "S3"
+  role_arn = aws_iam_role.test_data_source.arn
+
+  vpc_configuration {
+    security_group_ids = [aws_security_group.test2.id]
+    subnet_ids         = aws_subnet.test2[*].id
+  }
+
+  configuration {
+    s3_configuration {
+      bucket_name = aws_s3_bucket.test.id
+    }
+  }
+}
+`, rName, rName6))
+}