[Bug]: setting auth_token_update_strategy to DELETE while adding user_group_ids causes an error

Terraform Core Version

1.5.7

AWS Provider Version

5.69.0

Affected Resource(s)

aws_elasticache_replication_group

Expected Behavior

By setting the auth_token_update_strategy argument to DELETE and adding new user_group_ids, we should be able to migrate from Redis OSS AUTH to RBAC authentication successfully. https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Migrate-From-RBAC-to-Auth

The terraform plan looks like:

  # module.redis.aws_elasticache_replication_group.redis[0] will be updated in-place
  ~ resource "aws_elasticache_replication_group" "redis" {
      - auth_token                 = (sensitive value)
      ~ auth_token_update_strategy = "ROTATE" -> "DELETE"
        id                         = "redis"
      ~ user_group_ids             = [
          + "user-group-id",
        ]
        # (34 unchanged attributes hidden)
    }

Actual Behavior

We receive the following error when calling the ModifyReplicationGroup API: Error: modifying ElastiCache Replication Group (**): operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: **, InvalidParameterCombination: User group can't be associated with auth token enabled. Pass AuthStrategy delete to proceed

Relevant Error/Panic Output Snippet

N/A

Terraform Configuration Files

resource "aws_elasticache_replication_group" "redis" {
  replication_group_id = "redis"
  description          = "description"
  engine               = "redis"
  auth_token                  = null
  user_group_ids              = ["user-group-id"]
  auth_token_update_strategy  = "DELETE"
  at_rest_encryption_enabled  = true
  transit_encryption_enabled  = true
}

Steps to Reproduce

Create an elasticache replication group with auth_token set

resource "aws_elasticache_replication_group" "redis" {
  replication_group_id = "redis"
  description          = "description"
  engine               = "redis"
  auth_token                  = "password12345679"
  user_group_ids              = null
  at_rest_encryption_enabled  = true
  transit_encryption_enabled  = true
}

Update the elasticache replication group to use RBAC:

resource "aws_elasticache_replication_group" "redis" {
replication_group_id = "redis"
description          = "description"
engine               = "redis"
auth_token                  = null
user_group_ids              = ["user-group-id"]
auth_token_update_strategy  = "DELETE"
at_rest_encryption_enabled  = true
transit_encryption_enabled  = true
}

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

hashicorp / terraform-provider-aws