bootstrap_cluster_creator_admin_permissions value fix when access_config is not provided at eks cluster creation

.changelog/38295.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_eks_cluster: Set `access_config.bootstrap_cluster_creator_admin_permissions` to `true` on Read for clusters with no `access_config` configured. This allows in-place updates of existing clusters when `access_config` is configured
+```
+
+```release-note:bug
+data-source/aws_eks_cluster: Add `access_config.bootstrap_cluster_creator_admin_permissions` attribute
+```

internal/service/eks/cluster.go

@@ -424,6 +424,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
  }
 
  // bootstrap_cluster_creator_admin_permissions isn't returned from the AWS API.
+ // See https:/aws/containers-roadmap/issues/185#issuecomment-1863025784.
  var bootstrapClusterCreatorAdminPermissions *bool
  if v, ok := d.GetOk("access_config"); ok {
  if apiObject := expandCreateAccessConfigRequest(v.([]interface{})); apiObject != nil {
@@ -1068,6 +1069,9 @@ func flattenAccessConfigResponse(apiObject *types.AccessConfigResponse, bootstra
 
  if bootstrapClusterCreatorAdminPermissions != nil {
  tfMap["bootstrap_cluster_creator_admin_permissions"] = aws.ToBool(bootstrapClusterCreatorAdminPermissions)
+ } else {
+ // Setting default value to true for backward compatibility.
+ tfMap["bootstrap_cluster_creator_admin_permissions"] = true
  }
 
  return []interface{}{tfMap}

internal/service/eks/cluster_data_source.go

@@ -30,6 +30,10 @@ func dataSourceCluster() *schema.Resource {
  Type: schema.TypeString,
  Computed: true,
  },
+ "bootstrap_cluster_creator_admin_permissions": {
+ Type: schema.TypeBool,
+ Computed: true,
+ },
  },
  },
  },

internal/service/eks/cluster_test.go

@@ -159,10 +159,17 @@ func TestAccEKSCluster_AccessConfig_update(t *testing.T) {
  Check: resource.ComposeTestCheckFunc(
  testAccCheckClusterExists(ctx, resourceName, &cluster),
  resource.TestCheckResourceAttr(resourceName, "access_config.#", acctest.Ct1),
+ resource.TestCheckResourceAttr(resourceName, "access_config.0.authentication_mode", string(types.AuthenticationModeConfigMap)),
+ resource.TestCheckResourceAttr(resourceName, "access_config.0.bootstrap_cluster_creator_admin_permissions", acctest.CtTrue),
  ),
  },
  {
  Config: testAccClusterConfig_accessConfig(rName, types.AuthenticationModeConfigMap),
+ ConfigPlanChecks: resource.ConfigPlanChecks{
+ PreApply: []plancheck.PlanCheck{
+ plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionNoop),
+ },
+ },
  Check: resource.ComposeTestCheckFunc(
  testAccCheckClusterExists(ctx, resourceName, &cluster),
  resource.TestCheckResourceAttr(resourceName, "access_config.#", acctest.Ct1),
@@ -172,6 +179,11 @@ func TestAccEKSCluster_AccessConfig_update(t *testing.T) {
  },
  {
  Config: testAccClusterConfig_accessConfig(rName, types.AuthenticationModeApiAndConfigMap),
+ ConfigPlanChecks: resource.ConfigPlanChecks{
+ PreApply: []plancheck.PlanCheck{
+ plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionUpdate),
+ },
+ },
  Check: resource.ComposeTestCheckFunc(
  testAccCheckClusterExists(ctx, resourceName, &cluster),
  resource.TestCheckResourceAttr(resourceName, "access_config.#", acctest.Ct1),

website/docs/r/eks_cluster.html.markdown

@@ -228,7 +228,7 @@ The following arguments are optional:
 The `access_config` configuration block supports the following arguments:
 
 * `authentication_mode` - (Optional) The authentication mode for the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
-* `bootstrap_cluster_creator_admin_permissions` - (Optional) Whether or not to bootstrap the access config values to the cluster. Default is `true`.
+* `bootstrap_cluster_creator_admin_permissions` - (Optional) Whether or not to bootstrap the access config values to the cluster. Default is `false`.
 
 ### encryption_config