r/aws_s3_bucket_server_side_encryption_configuration: Fix diffs once SSE-C is disabled by default

[ewbankkit]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Mark fields as Optional and Computed to prevent diffs once SSE-C is disabled by default for all new GP buckets.

Relations

Closes #47320.
Relates #35775.

Output from Acceptance Testing

us-west-2

% make testacc TESTARGS='-run=TestAccS3BucketServerSideEncryptionConfiguration_' PKG=s3 ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-aws_s3_bucket_server_side_encryption_configuration.rule.blocked_encryption_types-drift 🌿...
TF_ACC=1 go1.25.8 test ./internal/service/s3/... -v -count 1 -parallel 4  -run=TestAccS3BucketServerSideEncryptionConfiguration_ -timeout 360m -vet=off
2026/04/08 14:50:31 Creating Terraform AWS Provider (SDKv2-style)...
2026/04/08 14:50:31 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_expectedBucketOwner
    bucket_server_side_encryption_configuration_test.go:655: Change to S3 defaults cause drift in older provider versions
--- SKIP: TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_expectedBucketOwner (0.00s)
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE (24.93s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange (35.52s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket (38.69s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic (39.90s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled (41.14s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange (36.10s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket (28.03s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled (46.11s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN (26.89s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner (63.48s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID (26.90s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner (39.84s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS (24.19s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource (35.49s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm (44.18s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256 (24.03s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_basic (23.87s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes (39.53s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride (20.26s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket (37.97s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_basic (36.29s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner (26.04s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== NAME  TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
    bucket_server_side_encryption_configuration_identity_gen_test.go:322: Step 1/2 error: After applying this test step, the refresh plan was not empty.
        stdout


        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place

        Terraform will perform the following actions:

          # aws_s3_bucket_server_side_encryption_configuration.test will be updated in-place
          ~ resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
                id                    = "tf-acc-test-8102355991605196647"
                # (3 unchanged attributes hidden)

              - rule {
                  - blocked_encryption_types = [
                      - "NONE",
                    ] -> null
                  - bucket_key_enabled       = false -> null

                  - apply_server_side_encryption_by_default {
                      - sse_algorithm     = "AES256" -> null
                        # (1 unchanged attribute hidden)
                    }
                }
              + rule {
                  + blocked_encryption_types = []

                  + apply_server_side_encryption_by_default {
                      + sse_algorithm     = "AES256"
                        # (1 unchanged attribute hidden)
                    }
                }
            }

        Plan: 0 to add, 1 to change, 0 to destroy.
--- FAIL: TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade (60.98s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh (69.76s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride (32.30s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange (58.27s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic (76.23s)
FAIL
FAIL    github.com/hashicorp/terraform-provider-aws/internal/service/s3 286.718s
FAIL
make: *** [testacc] Error 1

us-east-1

% AWS_DEFAULT_REGION=us-east-1 AWS_ALTERNATE_REGION=eu-west-1 make testacc TESTARGS='-run=TestAccS3BucketServerSideEncryptionConfiguration_' PKG=s3 ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-aws_s3_bucket_server_side_encryption_configuration.rule.blocked_encryption_types-drift 🌿...
TF_ACC=1 go1.25.8 test ./internal/service/s3/... -v -count 1 -parallel 4  -run=TestAccS3BucketServerSideEncryptionConfiguration_ -timeout 360m -vet=off
2026/04/08 15:04:21 Creating Terraform AWS Provider (SDKv2-style)...
2026/04/08 15:04:21 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_basic
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_basic
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_expectedBucketOwner
    bucket_server_side_encryption_configuration_test.go:661: Change to S3 defaults cause drift in older provider versions
--- SKIP: TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_expectedBucketOwner (0.00s)
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
=== RUN   TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
=== PAUSE TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_includeResource (18.48s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE (19.38s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS (19.44s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_basic (31.73s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256 (18.52s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_basic (18.75s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_blockedEncryptionTypes (29.88s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_directoryBucket (19.35s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_regionOverride (23.37s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange (25.38s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_expectedBucketOwner (18.57s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_directoryBucket (32.58s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_List_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_expectedBucketOwner (31.04s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_directoryBucket (24.70s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_List_basic (23.38s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_Upgrade_noRefresh (60.36s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_noRefreshNoChange (58.17s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange
=== NAME  TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade
    bucket_server_side_encryption_configuration_identity_gen_test.go:322: Step 1/2 error: After applying this test step, the refresh plan was not empty.
        stdout


        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place

        Terraform will perform the following actions:

          # aws_s3_bucket_server_side_encryption_configuration.test will be updated in-place
          ~ resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
                id                    = "tf-acc-test-8176979663673038203"
                # (3 unchanged attributes hidden)

              - rule {
                  - blocked_encryption_types = [
                      - "SSE-C",
                    ] -> null
                  - bucket_key_enabled       = false -> null

                  - apply_server_side_encryption_by_default {
                      - sse_algorithm     = "AES256" -> null
                        # (1 unchanged attribute hidden)
                    }
                }
              + rule {
                  + blocked_encryption_types = []

                  + apply_server_side_encryption_by_default {
                      + sse_algorithm     = "AES256"
                        # (1 unchanged attribute hidden)
                    }
                }
            }

        Plan: 0 to add, 1 to change, 0 to destroy.
--- FAIL: TestAccS3BucketServerSideEncryptionConfiguration_Identity_upgrade (92.25s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled (33.39s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_basic (92.80s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange (25.46s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyARN (22.32s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKeyEnabled (39.31s)
=== CONT  TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithMasterKeyID (24.53s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_regionOverride (39.38s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSSEAlgorithm (35.67s)
--- PASS: TestAccS3BucketServerSideEncryptionConfiguration_Identity_ExistingResource_expectedBucketOwner (51.93s)
FAIL
FAIL    github.com/hashicorp/terraform-provider-aws/internal/service/s3 268.119s
FAIL
make: *** [testacc] Error 1

Failure is in a generated test with an older version of the provider and is "expected".

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[YakDriver]

One comment but otherwise LGTM 🎉

[YakDriver]

Not a huge fan of this since key's existence => will set, even if it's blank. Could mess with defaults. Would be more reliable but complex using d.GetRawConfig.

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[oycyc]

When is the timeline to release this? As the issue described here is quite pressing #47320

[github-actions]

This functionality has been released in v6.40.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.