Add AlsoRequiresWhenEquals validator

[ewbankkit]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Adds the AlsoRequiresWhenEquals string attribute validator which checks that each path.Expression has a non-null configuration value when the string(y) attribute being validated has the known, specified value.

The generic internals can be re-used by tfboolvalidator.AlsoRequiresWhenTrue.
This fixes some bugs to do with unknowns in that validator.

Plus ConflictsWithWhenEquals and ConflictsWithWhenNotEquals string attribute validators required for aws_bedrockagentcore_memory_strategy.

Relations

Closes #48700.

Output from Acceptance Testing

% make testacc TESTARGS='-run=TestAccBedrockAgentCoreRegistry_' PKG=bedrockagentcore ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Validating schemas
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/sdkv2     5.642s
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/framework 5.716s
make: Running acceptance tests on branch: 🌿 f-AlsoRequiresWhenEquals-stringvalidator 🌿...
TF_ACC=1 go1.26.4 test ./internal/service/bedrockagentcore/... -v -count 1 -parallel 3  -run=TestAccBedrockAgentCoreRegistry_ -timeout 360m -vet=off -buildvcs=false
2026/07/10 10:14:25 Creating Terraform AWS Provider (SDKv2-style)...
2026/07/10 10:14:25 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccBedrockAgentCoreRegistry_Identity_basic
=== PAUSE TestAccBedrockAgentCoreRegistry_Identity_basic
=== RUN   TestAccBedrockAgentCoreRegistry_Identity_regionOverride
=== PAUSE TestAccBedrockAgentCoreRegistry_Identity_regionOverride
=== RUN   TestAccBedrockAgentCoreRegistry_List_basic
=== PAUSE TestAccBedrockAgentCoreRegistry_List_basic
=== RUN   TestAccBedrockAgentCoreRegistry_List_includeResource
=== PAUSE TestAccBedrockAgentCoreRegistry_List_includeResource
=== RUN   TestAccBedrockAgentCoreRegistry_List_regionOverride
=== PAUSE TestAccBedrockAgentCoreRegistry_List_regionOverride
=== RUN   TestAccBedrockAgentCoreRegistry_basic
=== PAUSE TestAccBedrockAgentCoreRegistry_basic
=== RUN   TestAccBedrockAgentCoreRegistry_disappears
=== PAUSE TestAccBedrockAgentCoreRegistry_disappears
=== RUN   TestAccBedrockAgentCoreRegistry_description
=== PAUSE TestAccBedrockAgentCoreRegistry_description
=== RUN   TestAccBedrockAgentCoreRegistry_approvalConfiguration
=== PAUSE TestAccBedrockAgentCoreRegistry_approvalConfiguration
=== RUN   TestAccBedrockAgentCoreRegistry_authorizerConfiguration
=== PAUSE TestAccBedrockAgentCoreRegistry_authorizerConfiguration
=== CONT  TestAccBedrockAgentCoreRegistry_Identity_basic
=== CONT  TestAccBedrockAgentCoreRegistry_basic
=== CONT  TestAccBedrockAgentCoreRegistry_approvalConfiguration
--- PASS: TestAccBedrockAgentCoreRegistry_basic (117.35s)
=== CONT  TestAccBedrockAgentCoreRegistry_authorizerConfiguration
--- PASS: TestAccBedrockAgentCoreRegistry_Identity_basic (118.76s)
=== CONT  TestAccBedrockAgentCoreRegistry_List_includeResource
--- PASS: TestAccBedrockAgentCoreRegistry_approvalConfiguration (129.44s)
=== CONT  TestAccBedrockAgentCoreRegistry_List_regionOverride
--- PASS: TestAccBedrockAgentCoreRegistry_List_includeResource (106.44s)
=== CONT  TestAccBedrockAgentCoreRegistry_List_basic
--- PASS: TestAccBedrockAgentCoreRegistry_List_regionOverride (111.04s)
=== CONT  TestAccBedrockAgentCoreRegistry_Identity_regionOverride
--- PASS: TestAccBedrockAgentCoreRegistry_authorizerConfiguration (123.68s)
=== CONT  TestAccBedrockAgentCoreRegistry_description
--- PASS: TestAccBedrockAgentCoreRegistry_List_basic (113.16s)
=== CONT  TestAccBedrockAgentCoreRegistry_disappears
--- PASS: TestAccBedrockAgentCoreRegistry_Identity_regionOverride (120.88s)
--- PASS: TestAccBedrockAgentCoreRegistry_description (137.77s)
--- PASS: TestAccBedrockAgentCoreRegistry_disappears (113.49s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   457.718s

% make testacc TESTARGS='-run=TestAccBedrockAgentCoreGateway_' PKG=bedrockagentcore ACCTEST_PARALLELISM=3 make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Validating schemas
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/sdkv2     5.943s
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/framework 6.097s
make: Running acceptance tests on branch: 🌿 f-AlsoRequiresWhenEquals-stringvalidator 🌿...
TF_ACC=1 go1.26.4 test ./internal/service/bedrockagentcore/... -v -count 1 -parallel 3  -run=TestAccBedrockAgentCoreGateway_ -timeout 360m -vet=off -buildvcs=false
2026/07/10 10:36:52 Creating Terraform AWS Provider (SDKv2-style)...
2026/07/10 10:36:52 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccBedrockAgentCoreGateway_basic
=== PAUSE TestAccBedrockAgentCoreGateway_basic
=== RUN   TestAccBedrockAgentCoreGateway_xrayDelivery
=== PAUSE TestAccBedrockAgentCoreGateway_xrayDelivery
=== RUN   TestAccBedrockAgentCoreGateway_disappears
=== PAUSE TestAccBedrockAgentCoreGateway_disappears
=== RUN   TestAccBedrockAgentCoreGateway_tags
=== PAUSE TestAccBedrockAgentCoreGateway_tags
=== RUN   TestAccBedrockAgentCoreGateway_interceptorConfigurations
=== PAUSE TestAccBedrockAgentCoreGateway_interceptorConfigurations
=== RUN   TestAccBedrockAgentCoreGateway_description
=== PAUSE TestAccBedrockAgentCoreGateway_description
=== RUN   TestAccBedrockAgentCoreGateway_IAMAuthorizer
=== PAUSE TestAccBedrockAgentCoreGateway_IAMAuthorizer
=== RUN   TestAccBedrockAgentCoreGateway_kmsKey
    gateway_test.go:367: KMS key returns HTTP 500
--- SKIP: TestAccBedrockAgentCoreGateway_kmsKey (0.00s)
=== RUN   TestAccBedrockAgentCoreGateway_protocolConfiguration
=== PAUSE TestAccBedrockAgentCoreGateway_protocolConfiguration
=== RUN   TestAccBedrockAgentCoreGateway_protocolConfigurationWithSessionAndStreamingConfiguration
=== PAUSE TestAccBedrockAgentCoreGateway_protocolConfigurationWithSessionAndStreamingConfiguration
=== RUN   TestAccBedrockAgentCoreGateway_noProtocolType
=== PAUSE TestAccBedrockAgentCoreGateway_noProtocolType
=== RUN   TestAccBedrockAgentCoreGateway_customJWTAuthorizer
=== PAUSE TestAccBedrockAgentCoreGateway_customJWTAuthorizer
=== RUN   TestAccBedrockAgentCoreGateway_customJWTAuthorizerCustomClaim
=== PAUSE TestAccBedrockAgentCoreGateway_customJWTAuthorizerCustomClaim
=== RUN   TestAccBedrockAgentCoreGateway_policyEngineConfiguration
=== PAUSE TestAccBedrockAgentCoreGateway_policyEngineConfiguration
=== CONT  TestAccBedrockAgentCoreGateway_basic
=== CONT  TestAccBedrockAgentCoreGateway_protocolConfiguration
=== CONT  TestAccBedrockAgentCoreGateway_interceptorConfigurations
--- PASS: TestAccBedrockAgentCoreGateway_basic (23.10s)
=== CONT  TestAccBedrockAgentCoreGateway_IAMAuthorizer
--- PASS: TestAccBedrockAgentCoreGateway_protocolConfiguration (35.37s)
=== CONT  TestAccBedrockAgentCoreGateway_description
--- PASS: TestAccBedrockAgentCoreGateway_interceptorConfigurations (42.81s)
=== CONT  TestAccBedrockAgentCoreGateway_customJWTAuthorizer
--- PASS: TestAccBedrockAgentCoreGateway_IAMAuthorizer (37.26s)
=== CONT  TestAccBedrockAgentCoreGateway_policyEngineConfiguration
--- PASS: TestAccBedrockAgentCoreGateway_description (37.03s)
=== CONT  TestAccBedrockAgentCoreGateway_customJWTAuthorizerCustomClaim
--- PASS: TestAccBedrockAgentCoreGateway_customJWTAuthorizer (37.40s)
=== CONT  TestAccBedrockAgentCoreGateway_noProtocolType
--- PASS: TestAccBedrockAgentCoreGateway_noProtocolType (22.52s)
=== CONT  TestAccBedrockAgentCoreGateway_disappears
--- PASS: TestAccBedrockAgentCoreGateway_policyEngineConfiguration (47.03s)
=== CONT  TestAccBedrockAgentCoreGateway_tags
--- PASS: TestAccBedrockAgentCoreGateway_disappears (18.50s)
=== CONT  TestAccBedrockAgentCoreGateway_xrayDelivery
--- PASS: TestAccBedrockAgentCoreGateway_customJWTAuthorizerCustomClaim (53.63s)
=== CONT  TestAccBedrockAgentCoreGateway_protocolConfigurationWithSessionAndStreamingConfiguration
=== NAME  TestAccBedrockAgentCoreGateway_xrayDelivery
    acctest.go:1743: skipping test for aws/us-west-2: Error running apply: exit status 1

        Error: creating CloudWatch Logs Delivery

          with aws_cloudwatch_log_delivery.test,
          on terraform_plugin_test.tf line 61, in resource "aws_cloudwatch_log_delivery" "test":
          61: resource "aws_cloudwatch_log_delivery" "test" {

        operation error CloudWatch Logs: CreateDelivery, https response error
        StatusCode: 400, RequestID: bad6de08-d8ab-42a8-b8a8-769e8cea665d,
        ValidationException: X-Ray Delivery Destination is supported with CloudWatch
        Logs as a Trace Segment Destination. Please enable the CloudWatch Logs
        destination for your traces using the UpdateTraceSegmentDestination API
        (https://docs.aws.amazon.com/xray/latest/api/API_UpdateTraceSegmentDestination.html)
--- SKIP: TestAccBedrockAgentCoreGateway_xrayDelivery (12.38s)
--- PASS: TestAccBedrockAgentCoreGateway_tags (46.13s)
--- PASS: TestAccBedrockAgentCoreGateway_protocolConfigurationWithSessionAndStreamingConfiguration (47.02s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   179.077s

% make testacc TESTARGS='-run=TestAccBedrockAgentCoreMemoryStrategy_' PKG=bedrockagentcore ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Validating schemas
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/sdkv2     (cached)
ok      github.com/hashicorp/terraform-provider-aws/internal/provider/framework (cached)
make: Running acceptance tests on branch: 🌿 f-AlsoRequiresWhenEquals-stringvalidator 🌿...
TF_ACC=1 go1.26.4 test ./internal/service/bedrockagentcore/... -v -count 1 -parallel 3  -run=TestAccBedrockAgentCoreMemoryStrategy_ -timeout 360m -vet=off -buildvcs=false
2026/07/10 16:11:43 Creating Terraform AWS Provider (SDKv2-style)...
2026/07/10 16:11:43 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccBedrockAgentCoreMemoryStrategy_standard
=== PAUSE TestAccBedrockAgentCoreMemoryStrategy_standard
=== RUN   TestAccBedrockAgentCoreMemoryStrategy_custom
=== PAUSE TestAccBedrockAgentCoreMemoryStrategy_custom
=== RUN   TestAccBedrockAgentCoreMemoryStrategy_disappears
=== PAUSE TestAccBedrockAgentCoreMemoryStrategy_disappears
=== CONT  TestAccBedrockAgentCoreMemoryStrategy_standard
=== CONT  TestAccBedrockAgentCoreMemoryStrategy_disappears
=== CONT  TestAccBedrockAgentCoreMemoryStrategy_custom
--- PASS: TestAccBedrockAgentCoreMemoryStrategy_disappears (218.19s)
--- PASS: TestAccBedrockAgentCoreMemoryStrategy_custom (277.57s)
--- PASS: TestAccBedrockAgentCoreMemoryStrategy_standard (282.78s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   288.761s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[Copilot]

Pull request overview

This PR adds new Terraform Plugin Framework string validators to enforce conditional “also requires” and “conflicts with” relationships based on a string/enum attribute value, then adopts these validators in Bedrock Agent Core resources (replacing bespoke ValidateConfig checks). It also refactors the bool AlsoRequiresWhenTrue validator to reuse shared internal logic and renames/moves a list plan modifier into a more specific listplanmodifier package.

Changes:

• Add tfstringvalidator.AlsoRequiresWhenEquals, ConflictsWithWhenEquals, and ConflictsWithWhenNotEquals (with shared internal validator implementations and unit tests).
• Replace resource-level ValidateConfig logic in Bedrock Agent Core resources with schema validators (and adjust acceptance tests accordingly).
• Rename the list default-from-path plan modifier into internal/framework/planmodifiers/listplanmodifier and update its usages/tests.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/service/route53domains/domain.go	Updates import/usage to the renamed listplanmodifier.DefaultValueFromPath.
internal/service/bedrockagentcore/registry.go	Uses AlsoRequiresWhenEquals on authorizer_type and removes custom ValidateConfig.
internal/service/bedrockagentcore/memory_strategy.go	Replaces ValidateConfig with conditional string validators for type and nested config.
internal/service/bedrockagentcore/memory_strategy_test.go	Updates expected diagnostics text and refreshes test model IDs; removes some scenario steps from the custom test.
internal/service/bedrockagentcore/gateway.go	Adds AlsoRequiresWhenEquals for authorizer config presence (but currently uses the wrong enum constant; see comment).
internal/service/bedrockagentcore/agent_runtime.go	Adds ExactlyOneOfChildren object validator to authorizer configuration nested object.
internal/framework/validators/stringvalidator/also_requires_when_equals.go	New validator: require other attributes when a string equals a target value.
internal/framework/validators/stringvalidator/also_requires_when_equals_test.go	Unit coverage for AlsoRequiresWhenEquals.
internal/framework/validators/stringvalidator/conflicts_with_when_equals.go	New validator: forbid other attributes when a string equals a target value.
internal/framework/validators/stringvalidator/conflicts_with_when_equals_test.go	Unit coverage for ConflictsWithWhenEquals.
internal/framework/validators/stringvalidator/conflicts_with_when_not_equals.go	New validator: forbid other attributes when a string does not equal a target value.
internal/framework/validators/stringvalidator/conflicts_with_when_not_equals_test.go	Unit coverage for ConflictsWithWhenNotEquals.
internal/framework/validators/internal/also_requires_when.go	Shared internal implementation backing string/bool “also requires when …” validators.
internal/framework/validators/internal/conflicts_with_when.go	Shared internal implementation backing string “conflicts with when …” validators.
internal/framework/validators/internal/exactly_one_of.go	Renames shared request/response structs used by object validators (ValidatorRequest/ValidatorResponse).
internal/framework/validators/objectvalidator/*.go	Updates object validators to use the shared internal request/response types.
internal/framework/validators/boolvalidator/also_requires_when_true.go	Refactors to reuse the shared internal “also requires when …” implementation.
internal/framework/validators/boolvalidator/also_requires_when_true_test.go	Expands test matrix to cover additional multi-target cases and unknown handling.
internal/framework/planmodifiers/listplanmodifier/default_value_from_path.go	Renames package and exported symbol to listplanmodifier.DefaultValueFromPath.
internal/framework/planmodifiers/listplanmodifier/default_value_from_path_test.go	Updates tests for the new package/name and uses t.Context() instead of context.Background().

[YakDriver]

I really like this. The single direction reads very nicely and replaces a bunch of badness. The multi-direction concerns me a little (easily half specified when iff is meant) but not committed to it. Either way, it's a great improvement.

[YakDriver]

What about adding another so that we don't need Requires and Conflicts in this situation? I fought a while with names and these are the two best I came up with. Map would be handy if there are multiple arms that need selecting.

• tfstringvalidator.Discriminates(map[value, path]) - accurate, used in OpenAPI, JSON schema but maybe less well known?
• tfstringvalidator.RequiredIffValue(map[value, path]) - "Iff" is a little jargony and might be misread as "If"