### Lint Terraform Configuration in Website Documentation

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/continuous-integration.md

Run this command to lint Terraform configuration examples embedded in the website documentation, identifying potential issues. Ensure necessary tools are installed before running.

```console
make website-tflint
```

--------------------------------

### Basic Usage with Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/actions/transcribe_start_transcription_job.html.markdown

This example demonstrates how to set up an S3 bucket and object, then start a basic Amazon Transcribe job using a specified language code and media file URI.

```terraform
resource "aws_s3_bucket" "example" {
  bucket = "my-transcription-bucket"
}

resource "aws_s3_object" "audio" {
  bucket = aws_s3_bucket.example.bucket
  key    = "audio/meeting.mp3"
  source = "path/to/meeting.mp3"
}

action "aws_transcribe_start_transcription_job" "example" {
  config {
    transcription_job_name = "meeting-transcription-${timestamp()}"
    media_file_uri         = "s3://${aws_s3_bucket.example.bucket}/${aws_s3_object.audio.key}"
    language_code          = "en-US"
  }
}
```

--------------------------------

### Run an AWS Terraform Example

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/examples/README.md

Clone the repository and apply the Terraform configuration for a specific AWS example.

```console
% git clone https://github.com/hashicorp/terraform-provider-aws
% cd terraform-provider-aws/examples/two-tier
% terraform apply
...
```

--------------------------------

### Build and Install Provider Binaries

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/continuous-integration.md

Compile the provider code and install the resulting binary locally. Both targets achieve similar outcomes for building the provider.

```console
make go-build
```

```console
make build
```

--------------------------------

### Create Lightsail Instance with User Data (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/lightsail_instance.html.markdown

This example demonstrates how to configure a Lightsail instance with user data to execute commands upon launch, such as installing Apache and creating an index page. Lightsail user data accepts a single-line string.

```HCL
resource "aws_lightsail_instance" "example" {
  name              = "example"
  availability_zone = "us-east-1b"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_3_0"
  user_data         = "sudo yum install -y httpd && sudo systemctl start httpd && sudo systemctl enable httpd && echo '<h1>Deployed via Terraform</h1>' | sudo tee /var/www/html/index.html"
}
```

--------------------------------

### Install mkdocs-material using Homebrew

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/README.md

Install `mkdocs-material` and its dependencies, including `mkdocs`, using Homebrew.

```console
% brew install mkdocs-material
```

--------------------------------

### Clone SageMaker Example Repository

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/examples/sagemaker/README.md

Clones the AWS SageMaker examples repository and navigates to the specific container directory for the scikit-learn bring-your-own example.

```bash
git clone https://github.com/awslabs/amazon-sagemaker-examples.git
cd amazon-sagemaker-examples/advanced_functionality/scikit_bring_your_own/container/
```

--------------------------------

### Install Skaff for Function Scaffolding

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/add-a-new-function.md

Run this command to install the `skaff` tool, which is used for generating function outlines.

```console
make skaff
```

--------------------------------

### Complete Configuration for AWS VPC Route Server Peer (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/vpc_route_server_peer.html.markdown

This example shows a full setup including the route server, its association with a VPC, an endpoint, propagation, and finally the route server peer with detailed BGP options.

```terraform
resource "aws_vpc_route_server" "test" {
  amazon_side_asn = 4294967294

  tags = {
    Name = "Test"
  }
}

resource "aws_vpc_route_server_association" "test" {
  route_server_id = aws_vpc_route_server.test.route_server_id
  vpc_id          = aws_vpc.test.id
}

resource "aws_vpc_route_server_endpoint" "test" {
  route_server_id = aws_vpc_route_server.test.route_server_id
  subnet_id       = aws_subnet.test.id

  tags = {
    Name = "Test Endpoint"
  }

  depends_on = [aws_vpc_route_server_association.test]
}

resource "aws_vpc_route_server_propagation" "test" {
  route_server_id = aws_vpc_route_server.test.route_server_id
  route_table_id  = aws_route_table.test.id

  depends_on = [aws_vpc_route_server_association.test]
}

resource "aws_vpc_route_server_peer" "test" {
  route_server_endpoint_id = aws_vpc_route_server_endpoint.test.route_server_endpoint_id
  peer_address             = "10.0.1.250"
  bgp_options {
    peer_asn                = 65000
    peer_liveness_detection = "bgp-keepalive"
  }

  tags = {
    Name = "Test Appliance"
  }
}
```

--------------------------------

### Install mkdocs using pip3

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/README.md

Install the `mkdocs` package directly using `pip3`.

```console
% pip3 install mkdocs
```

--------------------------------

### Install mkdocs-material using pip3

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/README.md

Install the `mkdocs-material` package directly using `pip3`.

```console
% pip3 install mkdocs-material
```

--------------------------------

### Install Cachegoat for Go Cache Management (Console)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/development-environment.md

Install the cachegoat tool to help manage and clean the Go build cache, which can grow significantly during active development.

```console
go install github.com/YakDriver/cachegoat@latest
```

--------------------------------

### Lint Terraform Examples with `tflint`

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/continuous-integration.md

Run `tflint` to lint the Terraform examples included with the provider, ensuring their correctness.

```console
make examples-tflint
```

--------------------------------

### Install Development Tools with Make

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/continuous-integration.md

Use the `tools` target to install various development tools required for running CI tests locally.

```console
make tools
```

--------------------------------

### Install golangci-lint Locally

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/continuous-integration.md

Install the `golangci-lint` tool on macOS using Homebrew before running local lint checks.

```console
brew install golangci-lint
```

--------------------------------

### Configure AWS Signer Signing Profile and Permissions

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/signer_signing_profile_permission.html.markdown

This example demonstrates how to create an AWS Signer signing profile and then grant cross-account permissions for actions like starting signing jobs, getting profile details, and revoking signatures.

```terraform
resource "aws_signer_signing_profile" "prod_sp" {
  platform_id = "AWSLambda-SHA384-ECDSA"
  name_prefix = "prod_sp_"

  signature_validity_period {
    value = 5
    type  = "YEARS"
  }

  tags = {
    tag1 = "value1"
    tag2 = "value2"
  }
}

resource "aws_signer_signing_profile_permission" "sp_permission_1" {
  profile_name = aws_signer_signing_profile.prod_sp.name
  action       = "signer:StartSigningJob"
  principal    = var.aws_account
}

resource "aws_signer_signing_profile_permission" "sp_permission_2" {
  profile_name = aws_signer_signing_profile.prod_sp.name
  action       = "signer:GetSigningProfile"
  principal    = var.aws_team_role_arn
  statement_id = "ProdAccountStartSigningJob_StatementId"
}

resource "aws_signer_signing_profile_permission" "sp_permission_3" {
  profile_name        = aws_signer_signing_profile.prod_sp.name
  action              = "signer:RevokeSignature"
  principal           = "123456789012"
  profile_version     = aws_signer_signing_profile.prod_sp.version
  statement_id_prefix = "version-permission-"
}
```

--------------------------------

### Configure CloudWatch Alarm Mute Rule with Start and Expire Dates (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/cloudwatch_alarm_mute_rule.html.markdown

This example demonstrates how to create a CloudWatch alarm and then apply a mute rule with defined start and expiration dates, targeting specific alarms and including tags.

```terraform
resource "aws_cloudwatch_alarm" "example" {
  alarm_name          = "example"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = 120
  statistic           = "Average"
  threshold           = 80
}

resource "aws_cloudwatch_alarm_mute_rule" "example" {
  name        = "example"
  description = "Mute alarms during maintenance window"
  start_date  = "2026-01-01T00:00:00Z"
  expire_date = "2026-12-31T23:59:00Z"

  rule {
    schedule {
      duration   = "PT4H"
      expression = "cron(0 2 * * *)"
      timezone   = "Asia/Tokyo"
    }
  }

  mute_targets {
    alarm_names = [aws_cloudwatch_alarm.example.alarm_name]
  }

  tags = {
    Environment = "production"
  }
}
```

--------------------------------

### Filter Route 53 Records by Name Regex in Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/d/route53_records.html.markdown

This example demonstrates how to filter Route 53 records to return only those whose names start with 'www'.

```terraform
data "aws_route53_zone" "selected" {
  name         = "test.com."
  private_zone = true
}

data "aws_route53_records" "example" {
  zone_id    = data.aws_route53_zone.selected.zone_id
  name_regex = "^www"
}
```

--------------------------------

### Configure QuickSight Account Settings with Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/quicksight_account_settings.html.markdown

This example demonstrates how to set up a QuickSight account subscription and then configure account-level settings, such as termination protection, using Terraform.

```terraform
resource "aws_quicksight_account_subscription" "subscription" {
  account_name          = "quicksight-terraform"
  authentication_method = "IAM_AND_QUICKSIGHT"
  edition               = "ENTERPRISE"
  notification_email    = "notification@email.com"
}

resource "aws_quicksight_account_settings" "example" {
  termination_protection_enabled = false

  depends_on = [aws_quicksight_account_subscription.subscription]
}
```

--------------------------------

### Create AWS Transfer SSH Key with associated resources

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/transfer_ssh_key.html.markdown

This example demonstrates how to provision an `aws_transfer_ssh_key` resource, along with the necessary `aws_transfer_server`, `aws_transfer_user`, and IAM roles/policies for a complete setup.

```terraform
resource "tls_private_key" "example" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_transfer_ssh_key" "example" {
  server_id = aws_transfer_server.example.id
  user_name = aws_transfer_user.example.user_name
  body      = trimspace(tls_private_key.example.public_key_openssh)
}

resource "aws_transfer_server" "example" {
  identity_provider_type = "SERVICE_MANAGED"

  tags = {
    NAME = "tf-acc-test-transfer-server"
  }
}

resource "aws_transfer_user" "example" {
  server_id = aws_transfer_server.example.id
  user_name = "tftestuser"
  role      = aws_iam_role.example.arn

  tags = {
    NAME = "tftestuser"
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["transfer.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "example" {
  name               = "tf-test-transfer-user-iam-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "example" {
  statement {
    sid       = "AllowFullAccesstoS3"
    effect    = "Allow"
    actions   = ["s3:*"]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "example" {
  name   = "tf-test-transfer-user-iam-policy"
  role   = aws_iam_role.example.id
  policy = data.aws_iam_policy_document.example.json
}
```

--------------------------------

### Create WorkSpaces Web Browser Settings with All Arguments

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/workspacesweb_browser_settings.html.markdown

This example demonstrates creating a WorkSpaces Web Browser Settings resource using all available arguments, including a customer-managed KMS key, additional encryption context, and tags.

```terraform
resource "aws_kms_key" "example" {
  description             = "KMS key for WorkSpaces Web Browser Settings"
  deletion_window_in_days = 7
}

resource "aws_workspacesweb_browser_settings" "example" {
  browser_policy = jsonencode({
    chromePolicies = {
      DefaultDownloadDirectory = {
        value = "/home/as2-streaming-user/MyFiles/TemporaryFiles1"
      }
    }
  })
  customer_managed_key = aws_kms_key.example.arn
  additional_encryption_context = {
    Environment = "Production"
  }
  tags = {
    Name = "example-browser-settings"
  }
}
```

--------------------------------

### AWS S3 Bucket Replication Configuration Region Handling

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/guides/enhanced-region-support.html.markdown

These Terraform configurations demonstrate the evolution of S3 bucket replication setup, specifically showing the change in how regions are specified for resources before and after AWS provider version 6.0.0. The 'Before' example uses provider aliases, while the 'After' example uses direct 'region' attributes.

```terraform
provider "aws" {
  region = "eu-west-1"
}

provider "aws" {
  alias  = "central"
  region = "eu-central-1"
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "replication" {
  name               = "tf-iam-role-replication-12345"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "replication" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
    ]

    resources = [aws_s3_bucket.source.arn]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTagging",
    ]

    resources = ["${aws_s3_bucket.source.arn}/*"]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
    ]

    resources = ["${aws_s3_bucket.destination.arn}/*"]
  }
}

resource "aws_iam_policy" "replication" {
  name   = "tf-iam-role-policy-replication-12345"
  policy = data.aws_iam_policy_document.replication.json
}

resource "aws_iam_role_policy_attachment" "replication" {
  role       = aws_iam_role.replication.name
  policy_arn = aws_iam_policy.replication.arn
}

resource "aws_s3_bucket" "destination" {
  bucket = "tf-test-bucket-destination-12345"
}

resource "aws_s3_bucket_versioning" "destination" {
  bucket = aws_s3_bucket.destination.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket" "source" {
  provider = aws.central
  bucket   = "tf-test-bucket-source-12345"
}

resource "aws_s3_bucket_acl" "source_bucket_acl" {
  provider = aws.central

  bucket = aws_s3_bucket.source.id
  acl    = "private"
}

resource "aws_s3_bucket_versioning" "source" {
  provider = aws.central

  bucket = aws_s3_bucket.source.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_replication_configuration" "replication" {
  provider = aws.central
  # Must have bucket versioning enabled first
  depends_on = [aws_s3_bucket_versioning.source]

  role   = aws_iam_role.replication.arn
  bucket = aws_s3_bucket.source.id

  rule {
    id = "examplerule"

    filter {
      prefix = "example"
    }

    status = "Enabled"

    destination {
      bucket        = aws_s3_bucket.destination.arn
      storage_class = "STANDARD"
    }
  }
}
```

```terraform
provider "aws" {
  region = "eu-west-1"
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "replication" {
  name               = "tf-iam-role-replication-12345"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "replication" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetReplicationConfiguration",
      "s3:ListBucket",
    ]

    resources = [aws_s3_bucket.source.arn]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:GetObjectVersionForReplication",
      "s3:GetObjectVersionAcl",
      "s3:GetObjectVersionTagging",
    ]

    resources = ["${aws_s3_bucket.source.arn}/*"]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ReplicateObject",
      "s3:ReplicateDelete",
      "s3:ReplicateTags",
    ]

    resources = ["${aws_s3_bucket.destination.arn}/*"]
  }
}

resource "aws_iam_policy" "replication" {
  name   = "tf-iam-role-policy-replication-12345"
  policy = data.aws_iam_policy_document.replication.json
}

resource "aws_iam_role_policy_attachment" "replication" {
  role       = aws_iam_role.replication.name
  policy_arn = aws_iam_policy.replication.arn
}

resource "aws_s3_bucket" "destination" {
  bucket = "tf-test-bucket-destination-12345"
}

resource "aws_s3_bucket_versioning" "destination" {
  bucket = aws_s3_bucket.destination.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket" "source" {
  region = "eu-central-1"

  bucket = "tf-test-bucket-source-12345"
}

resource "aws_s3_bucket_acl" "source_bucket_acl" {
  region = "eu-central-1"

  bucket = aws_s3_bucket.source.id
  acl    = "private"
}

resource "aws_s3_bucket_versioning" "source" {
  region = "eu-central-1"

  bucket = aws_s3_bucket.source.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_replication_configuration" "replication" {
  region = "eu-central-1"

  # Must have bucket versioning enabled first
  depends_on = [aws_s3_bucket_versioning.source]

```

--------------------------------

### Serve documentation locally with live reload

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/README.md

Serve the documentation from the root directory, enabling live reloading for development.

```console
% mkdocs serve --live-reload
```

--------------------------------

### Create a QuickSight Group

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/quicksight_group.html.markdown

This example demonstrates how to define and create a basic QuickSight group resource with a specified name.

```terraform
resource "aws_quicksight_group" "example" {
  group_name = "tf-example"
}
```

--------------------------------

### Example Output for a Resource Acceptance Test Suite Run

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/running-and-writing-acceptance-tests.md

This output shows the successful execution of multiple acceptance tests within a resource suite, including `gofmt` check, test command, and individual test results.

```text
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/cloudwatch/... -v -count 1 -parallel 20 -run=TestAccCloudWatchDashboard -timeout 180m
=== RUN   TestAccCloudWatchDashboard_basic
=== PAUSE TestAccCloudWatchDashboard_basic
=== RUN   TestAccCloudWatchDashboard_update
=== PAUSE TestAccCloudWatchDashboard_update
=== RUN   TestAccCloudWatchDashboard_updateName
=== PAUSE TestAccCloudWatchDashboard_updateName
=== CONT  TestAccCloudWatchDashboard_basic
=== CONT  TestAccCloudWatchDashboard_updateName
=== CONT  TestAccCloudWatchDashboard_update
--- PASS: TestAccCloudWatchDashboard_basic (15.83s)
--- PASS: TestAccCloudWatchDashboard_updateName (26.69s)
--- PASS: TestAccCloudWatchDashboard_update (27.72s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch	27.783s
```

--------------------------------

### Run Terraform Alexa Example

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/examples/alexa/README.md

Set AWS credentials and execute Terraform commands to initialize the project, preview changes, and apply the configuration to create the Alexa-enabled Lambda function.

```bash
export AWS_ACCESS_KEY_ID=<this is a secret>
export AWS_SECRET_ACCESS_KEY=<this is a secret>
terraform init
terraform plan -out theplan
terraform apply theplan
```

--------------------------------

### Start SFN Execution: Versioned Terraform Execution

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/actions/sfn_start_execution.html.markdown

This example shows how to target a specific version of a Step Functions state machine for execution by appending the version number to the state machine ARN.

```terraform
action "aws_sfn_start_execution" "versioned" {
  config {
    state_machine_arn = "${aws_sfn_state_machine.example.arn}:${aws_sfn_state_machine.example.version_number}"
    input = jsonencode({
      version = "v2"
      config  = var.processing_config
    })
  }
}
```

--------------------------------

### Iterate over VPC IDs to create flow logs

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/d/vpcs.html.markdown

This example shows how to use the `aws_vpcs` data source to get all VPC IDs and then iterate over them using `count` to create an `aws_flow_log` resource for each VPC.

```terraform
data "aws_vpcs" "foo" {}

data "aws_vpc" "foo" {
  count = length(data.aws_vpcs.foo.ids)
  id    = tolist(data.aws_vpcs.foo.ids)[count.index]
}

resource "aws_flow_log" "test_flow_log" {
  count = length(data.aws_vpcs.foo.ids)

  # ...
  vpc_id = data.aws_vpc.foo[count.index].id

  # ...
}

output "foo" {
  value = data.aws_vpcs.foo.ids
}
```

--------------------------------

### Start SFN Execution: Environment-Specific Processing in Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/actions/sfn_start_execution.html.markdown

This example shows how to dynamically configure Step Functions execution parameters based on the deployment environment using Terraform locals and `merge` function for input.

```terraform
locals {
  execution_config = var.environment == "production" ? {
    batch_size    = 1000
    max_retries   = 3
    timeout_hours = 24
    } : {
    batch_size    = 100
    max_retries   = 1
    timeout_hours = 2
  }
}

action "aws_sfn_start_execution" "batch_process" {
  config {
    state_machine_arn = aws_sfn_state_machine.batch_processor.arn
    input = jsonencode(merge(local.execution_config, {
      data_source = var.data_source
      output_path = var.output_path
    }))
  }
}
```

--------------------------------

### Start CodeBuild for Container Image Deployment (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/actions/codebuild_start_build.html.markdown

This example shows how to trigger a CodeBuild project to build and push container images, then use the build's completion as a dependency for an ECS service update.

```terraform
resource "aws_codebuild_project" "container_build" {
  name = "my-container-build"
  # ... configuration to build and push to ECR ...
}

action "aws_codebuild_start_build" "container" {
  config {
    project_name = aws_codebuild_project.container_build.name
    timeout      = 3600
  }
}

resource "terraform_data" "build_trigger" {
  input = filemd5("Dockerfile")

  lifecycle {
    action_trigger {
      events  = [before_create, before_update]
      actions = [action.aws_codebuild_start_build.container]
    }
  }
}

resource "aws_ecs_service" "app" {
  # ... configuration ...
  task_definition = aws_ecs_task_definition.app.arn

  depends_on = [terraform_data.build_trigger]
}

resource "aws_ecs_task_definition" "app" {
  container_definitions = jsonencode([{
    image = "${aws_ecr_repository.app.repository_url}:latest"
    # ... other config ...
  }])
}
```

--------------------------------

### Verify Built Provider Binary (Console)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/development-environment.md

List the contents of the GOPATH/bin directory to confirm the successful creation and location of the compiled provider binary.

```console
ls -la $GOPATH/bin/terraform-provider-aws
```

--------------------------------

### Encrypt S3 object with a KMS key using aws_s3_bucket_object

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/s3_bucket_object.html.markdown

This example shows how to create an S3 object encrypted with a specific AWS KMS key. It includes the setup for the KMS key and the S3 bucket.

```terraform
resource "aws_kms_key" "examplekms" {
  description             = "KMS key 1"
  deletion_window_in_days = 7
}

resource "aws_s3_bucket" "examplebucket" {
  bucket = "examplebuckettftest"
}

resource "aws_s3_bucket_acl" "example" {
  bucket = aws_s3_bucket.examplebucket.id
  acl    = "private"
}

resource "aws_s3_bucket_object" "example" {
  key        = "someobject"
  bucket     = aws_s3_bucket.examplebucket.id
  source     = "index.html"
  kms_key_id = aws_kms_key.examplekms.arn
}
```

--------------------------------

### Run Local Formatting and Linting Commands

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/add-a-new-ephemeral-resource.md

Execute these `make` commands to automatically format your Go code, install all required linters, and then run checks for provider code, general documentation, and website-specific documentation.

```sh
make fmt
make tools        # install linters and dependencies
make lint         # run provider linters
make docs-lint    # run documentation linters
make website-lint # run website documentation linters
```

--------------------------------

### Filter EC2 Transit Gateway Peering Attachments by State (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/d/ec2_transit_gateway_peering_attachments.html.markdown

This example demonstrates how to filter peering attachments by their 'state' attribute, specifically 'pendingAcceptance', and then iterate through the results to get individual attachment details.

```terraform
data "aws_ec2_transit_gateway_peering_attachments" "filtered" {
  filter {
    name   = "state"
    values = ["pendingAcceptance"]
  }
}

data "aws_ec2_transit_gateway_peering_attachment" "unit" {
  count = length(data.aws_ec2_transit_gateway_peering_attachments.filtered.ids)
  id    = data.aws_ec2_transit_gateway_peering_attachments.filtered.ids[count.index]
}
```

--------------------------------

### Create a Basic AWS Verified Access Instance

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/verifiedaccess_instance.html.markdown

This example demonstrates how to create a Verified Access Instance with a description and tags.

```terraform
resource "aws_verifiedaccess_instance" "example" {
  description = "example"

  tags = {
    Name = "example"
  }
}
```

--------------------------------

### Create AppConfig Extension Association (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/appconfig_extension_association.html.markdown

This example demonstrates how to create an AppConfig Extension Association, linking an AppConfig Extension to an AppConfig Application. It includes the necessary setup for SNS, IAM roles, and the AppConfig Extension itself.

```terraform
resource "aws_sns_topic" "test" {
  name = "test"
}

data "aws_iam_policy_document" "test" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["appconfig.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "test" {
  name               = "test"
  assume_role_policy = data.aws_iam_policy_document.test.json
}

resource "aws_appconfig_extension" "test" {
  name        = "test"
  description = "test description"
  action_point {
    point = "ON_DEPLOYMENT_COMPLETE"
    action {
      name     = "test"
      role_arn = aws_iam_role.test.arn
      uri      = aws_sns_topic.test.arn
    }
  }
  tags = {
    Type = "AppConfig Extension"
  }
}

resource "aws_appconfig_application" "test" {
  name = "test"
}

resource "aws_appconfig_extension_association" "test" {
  extension_arn = aws_appconfig_extension.test.arn
  resource_arn  = aws_appconfig_application.test.arn
}
```

--------------------------------

### Create SageMaker Hub Content Reference (Basic)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/sagemaker_hub_content_reference.html.markdown

This example demonstrates how to create a basic SageMaker Hub Content Reference, copying a public JumpStart model into a private hub.

```terraform
resource "aws_sagemaker_hub" "example" {
  hub_name        = "example"
  hub_description = "example"
}

resource "aws_sagemaker_hub_content_reference" "example" {
  hub_name                         = aws_sagemaker_hub.example.hub_name
  hub_content_name                 = "example-llama"
  sagemaker_public_hub_content_arn = "arn:aws:sagemaker:us-east-1:aws:hub-content/SageMakerPublicHub/Model/meta-textgeneration-llama-3-1-8b-instruct"
}
```

--------------------------------

### S3 Bucket with CORS Rule Configuration

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/guides/version-4-upgrade.html.markdown

This Terraform configuration defines an S3 bucket with a `cors_rule` block. It serves as an example for both drift detection behavior and as a starting point for migrating to standalone resources in AWS Provider v4.9.0+.

```terraform
resource "aws_s3_bucket" "example" {
  bucket = "yournamehere"

  # ... other configuration ...
  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["https://s3-website-test.hashicorp.com"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }
}
```

--------------------------------

### Create AWS IPv6 Route with Egress Only Gateway (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/route.html.markdown

This example shows how to configure an IPv6 route in a VPC, directing all IPv6 traffic through an Egress Only Internet Gateway. It includes the necessary VPC and Egress Only Gateway setup.

```terraform
resource "aws_vpc" "vpc" {
  cidr_block                       = "10.1.0.0/16"
  assign_generated_ipv6_cidr_block = true
}

resource "aws_egress_only_internet_gateway" "egress" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_route" "r" {
  route_table_id              = "rtb-4fbb3ac4"
  destination_ipv6_cidr_block = "::/0"
  egress_only_gateway_id      = aws_egress_only_internet_gateway.egress.id
}
```

--------------------------------

### Build Provider Binary

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/add-a-new-list-resource.md

Execute this command to compile the provider's source code into an executable binary.

```sh
make build
```

--------------------------------

### Create AWS DataZone Form Type with IAM Role and Project

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/datazone_form_type.html.markdown

This example demonstrates how to define an AWS DataZone Form Type, including the necessary IAM role, DataZone domain, security group, and project setup.

```terraform
resource "aws_iam_role" "domain_execution_role" {
  name = "example-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = ["sts:AssumeRole", "sts:TagSession"]
        Effect = "Allow"
        Principal = {
          Service = "datazone.amazonaws.com"
        }
      },
      {
        Action = ["sts:AssumeRole", "sts:TagSession"]
        Effect = "Allow"
        Principal = {
          Service = "cloudformation.amazonaws.com"
        }
      },
    ]
  })

  inline_policy {
    name = "example-policy"
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action = [
            "datazone:*",
            "ram:*",
            "sso:*",
            "kms:*",
          ]
          Effect   = "Allow"
          Resource = "*"
        },
      ]
    })
  }
}

resource "aws_datazone_domain" "test" {
  name                  = "example"
  domain_execution_role = aws_iam_role.domain_execution_role.arn
}

resource "aws_security_group" "test" {
  name = "example"
}

resource "aws_datazone_project" "test" {
  domain_identifier   = aws_datazone_domain.test.id
  glossary_terms      = ["2N8w6XJCwZf"]
  name                = "example name"
  description         = "desc"
  skip_deletion_check = true
}

resource "aws_datazone_form_type" "test" {
  description               = "desc"
  name                      = "SageMakerModelFormType"
  domain_identifier         = aws_datazone_domain.test.id
  owning_project_identifier = aws_datazone_project.test.id
  status                    = "DISABLED"
  model {
    smithy = <<EOF
	structure SageMakerModelFormType {
			@required
			@amazon.datazone#searchable
			modelName: String

			@required
			modelArn: String

			@required
			creationTime: String
			}
		EOF
  }
}
```

--------------------------------

### Complex Transit Gateway Peering and Routing Configuration

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/d/ec2_transit_gateway_route_table_routes.html.markdown

This example demonstrates a complex multi-region Transit Gateway mesh setup, routing all traffic to an on-prem VPN, including peering, VPC/VPN attachments, and route table management.

```terraform
resource "aws_ec2_transit_gateway" "this" {
  default_route_table_association = "disable"
  default_route_table_propagation = "disable"
}

resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
  subnet_ids                                      = [for s in aws_subnet.private : s.id]
  transit_gateway_id                              = aws_ec2_transit_gateway.this[0].id
  vpc_id                                          = aws_vpc.this.id
  transit_gateway_default_route_table_association = false
  transit_gateway_default_route_table_propagation = false
  depends_on                                      = [aws_subnet.private, aws_subnet.public]
}

resource "aws_ec2_transit_gateway_route_table" "this" {
  transit_gateway_id = local.my_transit_gateway_id
}

resource "aws_ec2_transit_gateway_route_table_association" "vpc" {
  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.this.id
  transit_gateway_route_table_id = local.my_transit_gateway_id_route_table
}

resource "aws_ec2_transit_gateway_route_table_association" "vpn" {
  transit_gateway_attachment_id  = aws_vpn_connection.this[0].transit_gateway_attachment_id
  transit_gateway_route_table_id = local.my_transit_gateway_id_route_table
}

resource "aws_ec2_transit_gateway_route_table_propagation" "vpc" {
  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.this.id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.this.id
}

resource "aws_ec2_transit_gateway_route_table_propagation" "vpn" {
  transit_gateway_attachment_id  = aws_vpn_connection.this[0].transit_gateway_attachment_id
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.this.id
}

provider "aws" {
  alias  = "eu-central-1"
  region = "eu-central-1"
}

resource "aws_ec2_transit_gateway" "eu-central-1" {
  default_route_table_association = "disable"
  default_route_table_propagation = "disable"
  provider                        = aws.eu-central-1
}

resource "aws_ec2_transit_gateway_peering_attachment" "eu-central-1" {
  peer_region             = "eu-central-1"
  peer_transit_gateway_id = aws_ec2_transit_gateway.eu-central-1.id
  transit_gateway_id      = aws_ec2_transit_gateway.this[0].id

  tags = {
    Name = "TGW mesh from eu-central-1"
  }
}

resource "aws_ec2_transit_gateway_route_table" "eu-central-1" {
  transit_gateway_id = aws_ec2_transit_gateway.eu-central-1.id
  tags               = merge({ Name = "wl-transit-gateway-routetable-eu-central-1" }, local.global_tags)
  provider           = aws.eu-central-1
}

resource "aws_ec2_transit_gateway_peering_attachment_accepter" "eu-central-1" {
  transit_gateway_attachment_id = aws_ec2_transit_gateway_peering_attachment.eu-central-1.id
  provider                      = aws.eu-central-1
  tags = {
    Name = "Accepter TGW peering eu-central-1"
  }
}

data "aws_ec2_transit_gateway_vpc_attachments" "filtered-eu-central-1" {
  provider = aws.eu-central-1
  filter {
    name   = "state"
    values = ["pendingAcceptance", "available"]
  }
}

data "aws_ec2_transit_gateway_vpc_attachment" "unit-eu-central-1" {
  for_each = toset(data.aws_ec2_transit_gateway_vpc_attachments.filtered-eu-central-1.ids)
  id       = each.value
  provider = aws.eu-central-1
}

locals {
  trusted_aws_accounts_ids = {} # add to this list all account ids you trust

  trusted_vpc_attachments_list_eu-central-1 = compact([for k, tva in data.aws_ec2_transit_gateway_vpc_attachment.unit-eu-central-1 : contains(local.trusted_aws_accounts_ids, lookup(tva, "vpc_owner_id", "")) ? tva.id : ""])
  ## create a map with all vpc attachments trusted to be able to use for_each to avoid conflict on plan/apply ##
  trusted_vpc_attachements_eu-central-1 = toset(sort(local.trusted_vpc_attachments_list_eu-central-1))

}

resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "trusted_accounts_eu-central-1_tgw" {
  for_each                                        = local.trusted_vpc_attachements_eu-central-1
  transit_gateway_attachment_id                   = each.value
  transit_gateway_default_route_table_propagation = false
  transit_gateway_default_route_table_association = false
  tags                                            = local.global_tags
  provider                                        = aws.eu-central-1
  lifecycle {
    prevent_destroy = false
    ignore_changes  = [subnet_ids, id, dns_support, security_group_referencing_support, ipv6_support, transit_gateway_id, vpc_id, vpc_owner_id]
  }
}

resource "aws_ec2_transit_gateway_route_table_association" "trusted_accounts_eu-central-1" {
  for_each                       = aws_ec2_transit_gateway_vpc_attachment_accepter.trusted_accounts_eu-central-1_tgw
  transit_gateway_attachment_id  = each.value.transit_gateway_attachment_id
}
```

--------------------------------

### Create QuickSight Dashboard from Source Template (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/quicksight_dashboard.html.markdown

This example demonstrates how to create a QuickSight dashboard by referencing an existing QuickSight template as its source entity.

```terraform
resource "aws_quicksight_dashboard" "example" {
  dashboard_id        = "example-id"
  name                = "example-name"
  version_description = "version"
  source_entity {
    source_template {
      arn = aws_quicksight_template.source.arn
      data_set_references {
        data_set_arn         = aws_quicksight_data_set.dataset.arn
        data_set_placeholder = "1"
      }
    }
  }
}
```

--------------------------------

### Request a Spot Instance with Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/spot_instance_request.html.markdown

This example demonstrates how to request a spot instance with a specified maximum price and instance type, applying a tag for identification.

```terraform
# Request a spot instance at $0.03
resource "aws_spot_instance_request" "cheap_worker" {
  ami           = "ami-1234"
  spot_price    = "0.03"
  instance_type = "c4.xlarge"

  tags = {
    Name = "CheapWorker"
  }
}
```

--------------------------------

### Basic AWS Security Lake Data Lake Configuration (Terraform)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/securitylake_data_lake.html.markdown

This example demonstrates a basic setup for an AWS Security Lake Data Lake, configuring the data lake's region and using S3-managed encryption for its objects.

```terraform
resource "aws_securitylake_data_lake" "example" {
  meta_store_manager_role_arn = aws_iam_role.meta_store_manager.arn

  configuration {
    region = "eu-west-1"

    encryption_configuration {
      kms_key_id = "S3_MANAGED_KEY"
    }
  }
}
```

--------------------------------

### Create a Microsoft Active Directory with Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/directory_service_directory.html.markdown

This example demonstrates how to set up a Managed Microsoft AD directory. Specify the 'edition' and 'type' as 'MicrosoftAD' along with VPC and subnet configurations.

```HCL
resource "aws_directory_service_directory" "bar" {
  name     = "corp.notexample.com"
  password = "SuperSecretPassw0rd"
  edition  = "Standard"
  type     = "MicrosoftAD"

  vpc_settings {
    vpc_id     = aws_vpc.main.id
    subnet_ids = [aws_subnet.foo.id, aws_subnet.bar.id]
  }

  tags = {
    Project = "foo"
  }
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "foo" {
  vpc_id            = aws_vpc.main.id
  availability_zone = "us-west-2a"
  cidr_block        = "10.0.1.0/24"
}

resource "aws_subnet" "bar" {
  vpc_id            = aws_vpc.main.id
  availability_zone = "us-west-2b"
  cidr_block        = "10.0.2.0/24"
}
```

--------------------------------

### Create an AWS CloudHSM v2 Cluster

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/cloudhsm_v2_cluster.html.markdown

This example provisions an AWS CloudHSM v2 cluster within a new VPC and two subnets, specifying the HSM type and applying tags. It demonstrates the basic setup required for a functional cluster.

```terraform
provider "aws" {
  region = var.aws_region
}

data "aws_availability_zones" "available" {}

resource "aws_vpc" "cloudhsm_v2_vpc" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "example-aws_cloudhsm_v2_cluster"
  }
}

resource "aws_subnet" "cloudhsm_v2_subnets" {
  count                   = 2
  vpc_id                  = aws_vpc.cloudhsm_v2_vpc.id
  cidr_block              = element(var.subnets, count.index)
  map_public_ip_on_launch = false
  availability_zone       = element(data.aws_availability_zones.available.names, count.index)

  tags = {
    Name = "example-aws_cloudhsm_v2_cluster"
  }
}

resource "aws_cloudhsm_v2_cluster" "cloudhsm_v2_cluster" {
  hsm_type   = "hsm1.medium"
  subnet_ids = aws_subnet.cloudhsm_v2_subnets[*].id

  tags = {
    Name = "example-aws_cloudhsm_v2_cluster"
  }
}
```

--------------------------------

### Declare ExampleCompany::ExampleService::ExampleResource in CloudFormation (JSON)

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/cloudformation/test-fixtures/examplecompany-exampleservice-exampleresource/docs/memo.md

Use this JSON syntax to define an ExampleCompany::ExampleService::ExampleResource within an AWS CloudFormation template.

```json
{
    "<a href="#heading" title="Heading">Heading</a>" : <i>String</i>,
    "<a href="#body" title="Body">Body</a>" : <i>String</i>
}
```

--------------------------------

### Get LB Listener by Load Balancer ARN and Port in Terraform

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/d/lb_listener.html.markdown

This example demonstrates how to retrieve a Load Balancer Listener by specifying the ARN of its associated Load Balancer and the listener's port. It first fetches the Load Balancer by name.

```terraform
# get listener from load_balancer_arn and port

data "aws_lb" "selected" {
  name = "default-public"
}

data "aws_lb_listener" "selected443" {
  load_balancer_arn = data.aws_lb.selected.arn
  port              = 443
}
```

--------------------------------

### Create QuickSight Account Subscription

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/quicksight_account_subscription.html.markdown

This example demonstrates how to create a basic AWS QuickSight account subscription. It configures the account with IAM and QuickSight authentication and sets the edition to Enterprise.

```terraform
resource "aws_quicksight_account_subscription" "subscription" {
  account_name          = "quicksight-terraform"
  authentication_method = "IAM_AND_QUICKSIGHT"
  edition               = "ENTERPRISE"
  notification_email    = "notification@email.com"
}
```

--------------------------------

### Create an API Gateway Documentation Part

Source: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/api_gateway_documentation_part.html.markdown

This example demonstrates how to define an `aws_api_gateway_documentation_part` resource, specifying its location (method, path) and properties, and associating it with an `aws_api_gateway_rest_api`.

```terraform
resource "aws_api_gateway_documentation_part" "example" {
  location {
    type   = "METHOD"
    method = "GET"
    path   = "/example"
  }

  properties  = "{\"description\":\"Example description\"}"
  rest_api_id = aws_api_gateway_rest_api.example.id
}

resource "aws_api_gateway_rest_api" "example" {
  name = "example_api"
}
```