[bugfix] aws_cognito_user_pool_client: Fix "unexpected new value" error when refresh_token_rotation.feature is switched to DISABLED

[tabito-hara]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

This PR fixes an “unexpected new value” error that occurs when refresh_token_rotation.feature is switched to DISABLED.

• When refresh_token_rotation.feature is DISABLED, the AWS API returns refresh_token_rotation.retry_grace_period_seconds = 0.
  This causes an “unexpected new value” error if refresh_token_rotation.retry_grace_period_seconds is not specified in the configuration.
• To suppress this diff, refresh_token_rotation.retry_grace_period_seconds should be ignored when refresh_token_rotation.feature is DISABLED.
• To implement this behavior, the refresh_token_rotation block in the new state is overwritten with values from the configuration or the prior state.
• The acceptance tests also cover the case where refresh_token_rotation.feature is DISABLED and refresh_token_rotation.retry_grace_period_seconds is explicitly specified.

Relations

Closes #45646

Output from Acceptance Testing

Resource

$ AWS_PROFILE=admin make testacc TESTS='TestAccCognitoIDPUserPoolClient_' PKG=cognitoidp
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-aws_cognito_user_pool_client-fix_inconsistent_unexpected_value_in_disabling_refresh_token_rotation 🌿...
TF_ACC=1 go1.24.11 test ./internal/service/cognitoidp/... -v -count 1 -parallel 20 -run='TestAccCognitoIDPUserPoolClient_'  -timeout 360m -vet=off
2025/12/18 23:29:55 Creating Terraform AWS Provider (SDKv2-style)...
2025/12/18 23:29:55 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCognitoIDPUserPoolClient_basic
=== PAUSE TestAccCognitoIDPUserPoolClient_basic
=== RUN   TestAccCognitoIDPUserPoolClient_enableRevocation
=== PAUSE TestAccCognitoIDPUserPoolClient_enableRevocation
=== RUN   TestAccCognitoIDPUserPoolClient_accessTokenValidity
=== PAUSE TestAccCognitoIDPUserPoolClient_accessTokenValidity
=== RUN   TestAccCognitoIDPUserPoolClient_accessTokenValidity_error
=== PAUSE TestAccCognitoIDPUserPoolClient_accessTokenValidity_error
=== RUN   TestAccCognitoIDPUserPoolClient_idTokenValidity
=== PAUSE TestAccCognitoIDPUserPoolClient_idTokenValidity
=== RUN   TestAccCognitoIDPUserPoolClient_idTokenValidity_error
=== PAUSE TestAccCognitoIDPUserPoolClient_idTokenValidity_error
=== RUN   TestAccCognitoIDPUserPoolClient_refreshTokenValidity
=== PAUSE TestAccCognitoIDPUserPoolClient_refreshTokenValidity
=== RUN   TestAccCognitoIDPUserPoolClient_refreshTokenValidity_error
=== PAUSE TestAccCognitoIDPUserPoolClient_refreshTokenValidity_error
=== RUN   TestAccCognitoIDPUserPoolClient_tokenValidityUnits
=== PAUSE TestAccCognitoIDPUserPoolClient_tokenValidityUnits
=== RUN   TestAccCognitoIDPUserPoolClient_tokenValidityUnits_explicitDefaults
=== PAUSE TestAccCognitoIDPUserPoolClient_tokenValidityUnits_explicitDefaults
=== RUN   TestAccCognitoIDPUserPoolClient_tokenValidityUnits_AccessToken
=== PAUSE TestAccCognitoIDPUserPoolClient_tokenValidityUnits_AccessToken
=== RUN   TestAccCognitoIDPUserPoolClient_tokenValidityUnitsWTokenValidity
=== PAUSE TestAccCognitoIDPUserPoolClient_tokenValidityUnitsWTokenValidity
=== RUN   TestAccCognitoIDPUserPoolClient_name
=== PAUSE TestAccCognitoIDPUserPoolClient_name
=== RUN   TestAccCognitoIDPUserPoolClient_allFields
=== PAUSE TestAccCognitoIDPUserPoolClient_allFields
=== RUN   TestAccCognitoIDPUserPoolClient_allFieldsUpdatingOneField
=== PAUSE TestAccCognitoIDPUserPoolClient_allFieldsUpdatingOneField
=== RUN   TestAccCognitoIDPUserPoolClient_analyticsApplicationID
=== PAUSE TestAccCognitoIDPUserPoolClient_analyticsApplicationID
=== RUN   TestAccCognitoIDPUserPoolClient_analyticsWithARN
=== PAUSE TestAccCognitoIDPUserPoolClient_analyticsWithARN
=== RUN   TestAccCognitoIDPUserPoolClient_authSessionValidity
=== PAUSE TestAccCognitoIDPUserPoolClient_authSessionValidity
=== RUN   TestAccCognitoIDPUserPoolClient_disappears
=== PAUSE TestAccCognitoIDPUserPoolClient_disappears
=== RUN   TestAccCognitoIDPUserPoolClient_Disappears_userPool
=== PAUSE TestAccCognitoIDPUserPoolClient_Disappears_userPool
=== RUN   TestAccCognitoIDPUserPoolClient_emptySets
=== PAUSE TestAccCognitoIDPUserPoolClient_emptySets
=== RUN   TestAccCognitoIDPUserPoolClient_nulls
=== PAUSE TestAccCognitoIDPUserPoolClient_nulls
=== RUN   TestAccCognitoIDPUserPoolClient_frameworkMigration_nulls
=== PAUSE TestAccCognitoIDPUserPoolClient_frameworkMigration_nulls
=== RUN   TestAccCognitoIDPUserPoolClient_frameworkMigration_basic
=== PAUSE TestAccCognitoIDPUserPoolClient_frameworkMigration_basic
=== RUN   TestAccCognitoIDPUserPoolClient_frameworkMigration_emptySet
=== PAUSE TestAccCognitoIDPUserPoolClient_frameworkMigration_emptySet
=== RUN   TestAccCognitoIDPUserPoolClient_supportedIdentityProviders_utf8
=== PAUSE TestAccCognitoIDPUserPoolClient_supportedIdentityProviders_utf8
=== RUN   TestAccCognitoIDPUserPoolClient_urls_utf8
=== PAUSE TestAccCognitoIDPUserPoolClient_urls_utf8
=== RUN   TestAccCognitoIDPUserPoolClient_refreshTokenRotation
=== PAUSE TestAccCognitoIDPUserPoolClient_refreshTokenRotation
=== RUN   TestAccCognitoIDPUserPoolClient_upgradeFromV5
=== PAUSE TestAccCognitoIDPUserPoolClient_upgradeFromV5
=== RUN   TestAccCognitoIDPUserPoolClient_upgradeFromV5AndUpdate
=== PAUSE TestAccCognitoIDPUserPoolClient_upgradeFromV5AndUpdate
=== CONT  TestAccCognitoIDPUserPoolClient_basic
=== CONT  TestAccCognitoIDPUserPoolClient_frameworkMigration_basic
=== CONT  TestAccCognitoIDPUserPoolClient_analyticsApplicationID
=== CONT  TestAccCognitoIDPUserPoolClient_frameworkMigration_nulls
=== CONT  TestAccCognitoIDPUserPoolClient_urls_utf8
=== CONT  TestAccCognitoIDPUserPoolClient_upgradeFromV5AndUpdate
=== CONT  TestAccCognitoIDPUserPoolClient_tokenValidityUnits
=== CONT  TestAccCognitoIDPUserPoolClient_idTokenValidity
=== CONT  TestAccCognitoIDPUserPoolClient_nulls
=== CONT  TestAccCognitoIDPUserPoolClient_refreshTokenValidity_error
=== CONT  TestAccCognitoIDPUserPoolClient_refreshTokenRotation
=== CONT  TestAccCognitoIDPUserPoolClient_Disappears_userPool
=== CONT  TestAccCognitoIDPUserPoolClient_refreshTokenValidity
=== CONT  TestAccCognitoIDPUserPoolClient_disappears
=== CONT  TestAccCognitoIDPUserPoolClient_authSessionValidity
=== CONT  TestAccCognitoIDPUserPoolClient_emptySets
=== CONT  TestAccCognitoIDPUserPoolClient_supportedIdentityProviders_utf8
=== CONT  TestAccCognitoIDPUserPoolClient_upgradeFromV5
=== CONT  TestAccCognitoIDPUserPoolClient_frameworkMigration_emptySet
=== CONT  TestAccCognitoIDPUserPoolClient_analyticsWithARN
--- PASS: TestAccCognitoIDPUserPoolClient_refreshTokenValidity_error (11.55s)
=== CONT  TestAccCognitoIDPUserPoolClient_name
--- PASS: TestAccCognitoIDPUserPoolClient_Disappears_userPool (90.92s)
=== CONT  TestAccCognitoIDPUserPoolClient_allFieldsUpdatingOneField
--- PASS: TestAccCognitoIDPUserPoolClient_basic (91.14s)
=== CONT  TestAccCognitoIDPUserPoolClient_allFields
--- PASS: TestAccCognitoIDPUserPoolClient_urls_utf8 (91.25s)
=== CONT  TestAccCognitoIDPUserPoolClient_idTokenValidity_error
--- PASS: TestAccCognitoIDPUserPoolClient_supportedIdentityProviders_utf8 (91.49s)
=== CONT  TestAccCognitoIDPUserPoolClient_tokenValidityUnits_AccessToken
--- PASS: TestAccCognitoIDPUserPoolClient_disappears (91.74s)
=== CONT  TestAccCognitoIDPUserPoolClient_tokenValidityUnitsWTokenValidity
--- PASS: TestAccCognitoIDPUserPoolClient_idTokenValidity_error (5.71s)
=== CONT  TestAccCognitoIDPUserPoolClient_tokenValidityUnits_explicitDefaults
--- PASS: TestAccCognitoIDPUserPoolClient_frameworkMigration_emptySet (107.82s)
=== CONT  TestAccCognitoIDPUserPoolClient_accessTokenValidity
--- PASS: TestAccCognitoIDPUserPoolClient_emptySets (136.52s)
=== CONT  TestAccCognitoIDPUserPoolClient_accessTokenValidity_error
--- PASS: TestAccCognitoIDPUserPoolClient_nulls (137.19s)
=== CONT  TestAccCognitoIDPUserPoolClient_enableRevocation
--- PASS: TestAccCognitoIDPUserPoolClient_accessTokenValidity_error (6.18s)
--- PASS: TestAccCognitoIDPUserPoolClient_name (135.54s)
--- PASS: TestAccCognitoIDPUserPoolClient_frameworkMigration_basic (147.84s)
--- PASS: TestAccCognitoIDPUserPoolClient_tokenValidityUnits_explicitDefaults (54.17s)
--- PASS: TestAccCognitoIDPUserPoolClient_idTokenValidity (155.02s)
--- PASS: TestAccCognitoIDPUserPoolClient_frameworkMigration_nulls (155.84s)
--- PASS: TestAccCognitoIDPUserPoolClient_refreshTokenValidity (156.07s)
--- PASS: TestAccCognitoIDPUserPoolClient_authSessionValidity (156.11s)
--- PASS: TestAccCognitoIDPUserPoolClient_analyticsWithARN (156.91s)
--- PASS: TestAccCognitoIDPUserPoolClient_upgradeFromV5 (160.83s)
--- PASS: TestAccCognitoIDPUserPoolClient_allFields (71.60s)
--- PASS: TestAccCognitoIDPUserPoolClient_upgradeFromV5AndUpdate (164.54s)
--- PASS: TestAccCognitoIDPUserPoolClient_allFieldsUpdatingOneField (86.02s)
--- PASS: TestAccCognitoIDPUserPoolClient_tokenValidityUnits (181.73s)
--- PASS: TestAccCognitoIDPUserPoolClient_analyticsApplicationID (182.38s)
--- PASS: TestAccCognitoIDPUserPoolClient_accessTokenValidity (77.21s)
--- PASS: TestAccCognitoIDPUserPoolClient_tokenValidityUnitsWTokenValidity (93.52s)
--- PASS: TestAccCognitoIDPUserPoolClient_tokenValidityUnits_AccessToken (94.27s)
--- PASS: TestAccCognitoIDPUserPoolClient_enableRevocation (54.93s)
--- PASS: TestAccCognitoIDPUserPoolClient_refreshTokenRotation (192.91s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp 197.357s

Data Source

$ make testacc TESTS='TestAccCognitoIDPUserPoolClientDataSource_' PKG=cognitoidp
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-aws_cognito_user_pool_client-fix_inconsistent_unexpected_value_in_disabling_refresh_token_rotation 🌿...
TF_ACC=1 go1.24.11 test ./internal/service/cognitoidp/... -v -count 1 -parallel 20 -run='TestAccCognitoIDPUserPoolClientDataSource_'  -timeout 360m -vet=off
2025/12/18 23:38:26 Creating Terraform AWS Provider (SDKv2-style)...
2025/12/18 23:38:26 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCognitoIDPUserPoolClientDataSource_basic
=== PAUSE TestAccCognitoIDPUserPoolClientDataSource_basic
=== RUN   TestAccCognitoIDPUserPoolClientDataSource_refreshTokenRotation
=== PAUSE TestAccCognitoIDPUserPoolClientDataSource_refreshTokenRotation
=== CONT  TestAccCognitoIDPUserPoolClientDataSource_basic
=== CONT  TestAccCognitoIDPUserPoolClientDataSource_refreshTokenRotation
--- PASS: TestAccCognitoIDPUserPoolClientDataSource_refreshTokenRotation (23.48s)
--- PASS: TestAccCognitoIDPUserPoolClientDataSource_basic (25.46s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp 29.986s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.