Fix persistent diffs in aws_controltower_landing_zone manifest_json

[cariandrum22]

Rollback Plan

In case of any issues, users can rollback to the previous version of the provider. The changes are isolated to the aws_controltower_landing_zone resource's diff suppression logic.

Changes to Security Controls

No changes to security controls. This PR only affects diff suppression and state normalization for the manifest_json attribute.

Description

Fixes #35763

This PR resolves persistent diffs in the aws_controltower_landing_zone resource's manifest_json attribute caused by:

1. Array ordering differences: AWS API may return governedRegions in a different order than specified in configuration
2. Type inconsistencies: AWS API returns retentionDays as strings, but users may specify them as numbers

The fix implements a two-part solution:

1. Custom diff suppression function (suppressEquivalentLandingZoneManifestDiffs) that normalizes and compares manifests semantically
2. State normalization during read to ensure consistent representation in state

Implementation details:

• Added normalizeManifestJSON() function to:
  • Sort governedRegions array alphabetically for order-independent comparison
  • Convert retentionDays string values to numbers in loggingBucket and accessLoggingBucket configurations
• Added unit tests covering 7 scenarios including edge cases
• Applied normalization in both Read function (state refresh) and diff suppression

Testing:

Unit tests verify the normalization handles:

• Identical manifests (should suppress diff)
• retentionDays as number vs string (should suppress diff)
• governedRegions in different order (should suppress diff)
• Different governedRegions values (should NOT suppress diff)
• Different retentionDays values (should NOT suppress diff)
• Empty manifest edge cases

Relations

N/A

References

• Closes [Bug]: Control Tower Landing Zone reports changes when no material changes present #35763

Output from Acceptance Testing

N/A - Unit tests only at this stage. The affected resource requires AWS Organizations management account which is not available in standard acceptance testing.

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.