Fix aws_cloudfrontkeyvaluestore_keys_exclusive value JSON encoding bug

[posquit0]

Fixes #46899

Description

This PR fixes a bug in the aws_cloudfrontkeyvaluestore_keys_exclusive resource where string values were being incorrectly JSON-encoded, resulting in extra quotes being stored in AWS.

Root Cause

When the resource was refactored to use AutoFlEx, the flex.Expand and flex.Flatten functions introduced JSON encoding/decoding of string values. This caused values to be stored in AWS with extra quotes. For example, a configured value of "hello" would be stored in AWS as "\"hello\"" (displayed as "hello" with quotes in the console).

The bug was masked in tests because:

• flex.Expand JSON-encodes values during Create/Update operations
• flex.Flatten JSON-decodes values during Read operations
• This symmetrical encode/decode cycle made the Terraform state appear correct
• Existing tests only verified Terraform state, not the actual values stored in AWS

Changes

Bug Fix

• keys_exclusive.go: Manually set Value fields after flex.Expand calls in syncKeyValuePairs() method to prevent JSON encoding
• keys_exclusive.go: Manually set Value fields after flex.Flatten calls in Read() method to prevent JSON decoding
• Used map-based approach to match keys to values (necessary because Sets are unordered)

Testing Improvements

• keys_exclusive_test.go: Added testAccCheckKeysExclusiveHasValues() helper function that directly calls AWS API to verify stored values
• keys_exclusive_test.go: Added TestAccCloudFrontKeyValueStoreKeysExclusive_specialCharacters test case with special characters (quotes, braces, backslashes)

Testing

Ran acceptance tests with real AWS resources:

• ✅ TestAccCloudFrontKeyValueStoreKeysExclusive_specialCharacters - PASS (26.53s)
• ✅ TestAccCloudFrontKeyValueStoreKeysExclusive_value - PASS (34.83s)

Related Work

This is the same bug that was fixed in the aws_cloudfrontkeyvaluestore_key resource in PR #46898.

Changelog

resource/aws_cloudfrontkeyvaluestore_keys_exclusive: Fix issue where values were incorrectly JSON-encoded, resulting in extra quotes being stored in AWS

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[YakDriver]

LGTM 🎉

% make t T=TestAccCloudFrontKeyValueStoreKey_ K=cloudfrontkeyvaluestore
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-cloudfrontkeyvaluestore-keys-exclusive-value-encoding-fix 🌿...
TF_ACC=1 go1.25.8 test ./internal/service/cloudfrontkeyvaluestore/... -v -count 1 -parallel 20 -run='TestAccCloudFrontKeyValueStoreKey_'  -timeout 360m -vet=off
2026/03/17 16:54:50 Creating Terraform AWS Provider (SDKv2-style)...
2026/03/17 16:54:50 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== PAUSE TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== RUN   TestAccCloudFrontKeyValueStoreKey_basic
=== PAUSE TestAccCloudFrontKeyValueStoreKey_basic
=== RUN   TestAccCloudFrontKeyValueStoreKey_mutex
=== PAUSE TestAccCloudFrontKeyValueStoreKey_mutex
=== RUN   TestAccCloudFrontKeyValueStoreKey_value
=== PAUSE TestAccCloudFrontKeyValueStoreKey_value
=== RUN   TestAccCloudFrontKeyValueStoreKey_disappears
=== PAUSE TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_mutex
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange
=== CONT  TestAccCloudFrontKeyValueStoreKey_basic
=== CONT  TestAccCloudFrontKeyValueStoreKey_disappears
=== CONT  TestAccCloudFrontKeyValueStoreKey_value
=== CONT  TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic
--- PASS: TestAccCloudFrontKeyValueStoreKey_mutex (30.04s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_disappears (35.60s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_basic (46.37s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_basic (46.46s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_value (55.44s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_noRefreshNoChange (297.70s)
--- PASS: TestAccCloudFrontKeyValueStoreKey_Identity_ExistingResource_basic (302.52s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudfrontkeyvaluestore	309.449s

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.