second first commit

compatibility-tests/compat-terraform/test/kms-update-alias-tf/main.tf

@@ -0,0 +1,31 @@
+# Verifies https://github.com/floci-io/floci/issues/2291
+#
+# The Terraform AWS provider treats target_key_id on aws_kms_alias as an
+# in-place update, not a replacement. Flipping which key the alias points at
+# must therefore call UpdateAlias, not CreateAlias/DeleteAlias.
+
+resource "aws_kms_key" "a" {
+  description = "floci-kms-update-alias-test key A"
+}
+
+resource "aws_kms_key" "b" {
+  description = "floci-kms-update-alias-test key B"
+}
+
+variable "use_second_key" {
+  type    = bool
+  default = false
+}
+
+resource "aws_kms_alias" "test" {
+  name          = "alias/floci-kms-update-alias-test"
+  target_key_id = var.use_second_key ? aws_kms_key.b.key_id : aws_kms_key.a.key_id
+}
+
+output "key_a_id" {
+  value = aws_kms_key.a.key_id
+}
+
+output "key_b_id" {
+  value = aws_kms_key.b.key_id
+}

compatibility-tests/compat-terraform/test/kms-update-alias-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    kms = var.endpoint
+  }
+}