r/aws_cloudfrontkeyvaluestore_key: Fix value JSON encoding issue

[posquit0]

Fixes #46897

Description

Fixes the bug where string values in aws_cloudfrontkeyvaluestore_key resource were being JSON-encoded, resulting in extra quotes in the stored values.

For example:

• Before: value = "asdf" was stored as "asdf" (with extra quotes) in AWS
• After: value = "asdf" is stored as asdf (plain string) in AWS

Root Cause

The bug was introduced in commit c69a552 when the resource was refactored to use AutoFlEx (fwflex.Expand/fwflex.Flatten).

The problem:

1. Create/Update: fwflex.Expand JSON-encodes the Value field → AWS stores "asdf" instead of asdf
2. Read: fwflex.Flatten JSON-decodes it back → Terraform state shows asdf (correct)
3. Existing tests only checked Terraform state → bug was hidden by symmetrical encode/decode

Changes

internal/service/cloudfrontkeyvaluestore/key.go

1. Create method (line 117): Manually set Value after fwflex.Expand to bypass JSON encoding
2. Update method (line 206): Manually set Value after fwflex.Expand to bypass JSON encoding
3. Read method (line 159-163): Manually set Value after fwflex.Flatten to bypass JSON decoding

internal/service/cloudfrontkeyvaluestore/key_test.go

1. New helper function: testAccCheckKeyHasValue - Directly calls AWS API to verify stored values (not just Terraform state)
2. Enhanced existing tests: Added AWS API validation to TestAccCloudFrontKeyValueStoreKey_basic and TestAccCloudFrontKeyValueStoreKey_value
3. New test case: TestAccCloudFrontKeyValueStoreKey_specialCharacters - Tests values with quotes, braces, and other special characters

Testing

All acceptance tests pass with real AWS resources:

--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (27.33s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (36.08s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_specialCharacters (26.20s)

The new test helper (testAccCheckKeyHasValue) ensures that the actual values stored in AWS match expectations, preventing this type of bug from reoccurring.

References

• AWS CloudFront KeyValueStore PutKey API: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_kvs_PutKey.html
• AWS SDK Go v2: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore

---

Output from acceptance testing:

$ TF_ACC=1 go test -v ./internal/service/cloudfrontkeyvaluestore -run 'TestAccCloudFrontKeyValueStoreKey_(basic|value|specialCharacters)' -timeout 30m

=== RUN   TestAccCloudFrontKeyValueStoreKey_basic
--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (27.33s)
=== RUN   TestAccCloudFrontKeyValueStoreKey_value
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (36.08s)
=== RUN   TestAccCloudFrontKeyValueStoreKey_specialCharacters
--- PASS: TestAccCloudFrontKeyValueStoreKey_specialCharacters (26.20s)
PASS

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[posquit0]

Added changelog entry in commit 338b48f

[YakDriver]

LGTM 🎉

% make t T=TestAccCloudFrontKeyValueStoreKey_ K=cloudfrontkeyvaluestore     
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-cloudfrontkeyvaluestore-key-value-encoding-fix 🌿...
TF_ACC=1 go1.25.8 test ./internal/service/cloudfrontkeyvaluestore/... -v -count 1 -parallel 20 -run='TestAccCloudFrontKeyValueStoreKey_'  -timeout 360m -vet=off
2026/03/17 15:02:08 Creating Terraform AWS Provider (SDKv2-style)...
2026/03/17 15:02:08 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== RUN   TestAccCloudFrontKeyValueStoreKey_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_mutex
=== PAUSE TestAccCloudFrontKeyValueStoreKey_mutex
=== RUN   TestAccCloudFrontKeyValueStoreKey_value
=== PAUSE TestAccCloudFrontKeyValueStoreKey_value
=== RUN   TestAccCloudFrontKeyValueStoreKey_specialCharacters
=== PAUSE TestAccCloudFrontKeyValueStoreKey_specialCharacters
=== RUN   TestAccCloudFrontKeyValueStoreKey_disappears
=== PAUSE TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_mutex
=== CONT  TestAccCloudFrontKeyValueStoreKey_specialCharacters
=== CONT  TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== CONT  TestAccCloudFrontKeyValueStoreKey_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_value
--- PASS: TestAccCloudFrontKeyValueStoreKey_specialCharacters (33.82s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_disappears (34.87s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (42.09s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_basic (43.97s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (44.72s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_mutex (45.88s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange (344.87s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic (345.94s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudfrontkeyvaluestore	352.681s

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v6.37.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!