second first commit

compatibility-tests/compat-terraform/test/kms-update-alias-tf/main.tf

@@ -0,0 +1,31 @@
+# Verifies https://github.com/floci-io/floci/issues/2291
+#
+# The Terraform AWS provider treats target_key_id on aws_kms_alias as an
+# in-place update, not a replacement. Flipping which key the alias points at
+# must therefore call UpdateAlias, not CreateAlias/DeleteAlias.
+
+resource "aws_kms_key" "a" {
+  description = "floci-kms-update-alias-test key A"
+}
+
+resource "aws_kms_key" "b" {
+  description = "floci-kms-update-alias-test key B"
+}
+
+variable "use_second_key" {
+  type    = bool
+  default = false
+}
+
+resource "aws_kms_alias" "test" {
+  name          = "alias/floci-kms-update-alias-test"
+  target_key_id = var.use_second_key ? aws_kms_key.b.key_id : aws_kms_key.a.key_id
+}
+
+output "key_a_id" {
+  value = aws_kms_key.a.key_id
+}
+
+output "key_b_id" {
+  value = aws_kms_key.b.key_id
+}