Support secondary email in aws_connect_user resource

.changelog/40931.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_connect_user: Add support for secondary email
+```

internal/service/connect/user.go

@@ -76,6 +76,10 @@ func resourceUser() *schema.Resource {
 							Optional:     true,
 							ValidateFunc: validation.StringLenBetween(1, 100),
 						},
+						"secondary_email": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
 					},
 				},
 			},
@@ -434,6 +438,10 @@ func expandUserIdentityInfo(tfList []interface{}) *awstypes.UserIdentityInfo {
 		apiObject.LastName = aws.String(v)
 	}
 
+	if v, ok := tfMap["secondary_email"].(string); ok && v != "" {
+		apiObject.SecondaryEmail = aws.String(v)
+	}
+
 	return apiObject
 }
 
@@ -485,6 +493,10 @@ func flattenUserIdentityInfo(apiObject *awstypes.UserIdentityInfo) []interface{}
 		tfMap["last_name"] = aws.ToString(v)
 	}
 
+	if v := apiObject.SecondaryEmail; v != nil {
+		tfMap["secondary_email"] = aws.ToString(v)
+	}
+
 	return []interface{}{tfMap}
 }
 

internal/service/connect/user_data_source.go

@@ -58,6 +58,10 @@ func DataSourceUser() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"secondary_email": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
 					},
 				},
 			},

internal/service/connect/user_data_source_test.go

@@ -40,6 +40,7 @@ func testAccUserDataSource_userID(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.email", resourceName, "identity_info.0.email"),
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.first_name", resourceName, "identity_info.0.first_name"),
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.last_name", resourceName, "identity_info.0.last_name"),
+					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.secondary_email", resourceName, "identity_info.0.secondary_email"),
 					resource.TestCheckResourceAttrPair(datasourceName, names.AttrInstanceID, resourceName, names.AttrInstanceID),
 					resource.TestCheckResourceAttrPair(datasourceName, names.AttrName, resourceName, names.AttrName),
 					resource.TestCheckResourceAttrPair(datasourceName, "phone_config.#", resourceName, "phone_config.#"),
@@ -87,6 +88,7 @@ func testAccUserDataSource_name(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.email", resourceName, "identity_info.0.email"),
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.first_name", resourceName, "identity_info.0.first_name"),
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.last_name", resourceName, "identity_info.0.last_name"),
+					resource.TestCheckResourceAttrPair(datasourceName, "identity_info.0.secondary_email", resourceName, "identity_info.0.secondary_email"),
 					resource.TestCheckResourceAttrPair(datasourceName, names.AttrInstanceID, resourceName, names.AttrInstanceID),
 					resource.TestCheckResourceAttrPair(datasourceName, names.AttrName, resourceName, names.AttrName),
 					resource.TestCheckResourceAttrPair(datasourceName, "phone_config.#", resourceName, "phone_config.#"),
@@ -124,9 +126,10 @@ resource "aws_connect_user" "test" {
   ]
 
   identity_info {
-    email      = %[2]q
-    first_name = "example"
-    last_name  = "example2"
+    email           = %[2]q
+    first_name      = "example"
+    last_name       = "example2"
+    secondary_email = "[email protected]"
   }
 
   phone_config {

internal/service/connect/user_test.go

@@ -117,9 +117,11 @@ func testAccUser_updateIdentityInfo(t *testing.T) {
 	emailOriginal := acctest.RandomEmailAddress(domain)
 	firstNameOriginal := "example-first-name-original"
 	lastNameOriginal := "example-last-name-original"
+	secondaryEmailOriginal := acctest.RandomEmailAddress(domain)
 	emailUpdated := acctest.RandomEmailAddress(domain)
 	firstNameUpdated := "example-first-name-updated"
 	lastNameUpdated := "example-last-name-updated"
+	secondaryEmailUpdated := acctest.RandomEmailAddress(domain)
 
 	resourceName := "aws_connect_user.test"
 
@@ -130,13 +132,14 @@ func testAccUser_updateIdentityInfo(t *testing.T) {
 		CheckDestroy:             testAccCheckUserDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, emailOriginal, firstNameOriginal, lastNameOriginal),
+				Config: testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, emailOriginal, firstNameOriginal, lastNameOriginal, secondaryEmailOriginal),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.email", emailOriginal),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.first_name", firstNameOriginal),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.last_name", lastNameOriginal),
+					resource.TestCheckResourceAttr(resourceName, "identity_info.0.secondary_email", secondaryEmailOriginal),
 				),
 			},
 			{
@@ -146,13 +149,14 @@ func testAccUser_updateIdentityInfo(t *testing.T) {
 				ImportStateVerifyIgnore: []string{names.AttrPassword},
 			},
 			{
-				Config: testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, emailUpdated, firstNameUpdated, lastNameUpdated),
+				Config: testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, emailUpdated, firstNameUpdated, lastNameUpdated, secondaryEmailUpdated),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.email", emailUpdated),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.first_name", firstNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "identity_info.0.last_name", lastNameUpdated),
+					resource.TestCheckResourceAttr(resourceName, "identity_info.0.secondary_email", secondaryEmailUpdated),
 				),
 			},
 		},
@@ -607,7 +611,7 @@ resource "aws_connect_user" "test" {
 `, rName5, selectHierarchyGroupId))
 }
 
-func testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, email, first_name, last_name string) string {
+func testAccUserConfig_identityInfo(rName, rName2, rName3, rName4, rName5, email, first_name, last_name, secondary_email string) string {
 	return acctest.ConfigCompose(
 		testAccUserConfig_base(rName, rName2, rName3, rName4),
 		fmt.Sprintf(`
@@ -622,17 +626,18 @@ resource "aws_connect_user" "test" {
   ]
 
   identity_info {
-    email      = %[2]q
-    first_name = %[3]q
-    last_name  = %[4]q
+    email           = %[2]q
+    first_name      = %[3]q
+    last_name       = %[4]q
+    secondary_email = %[5]q
   }
 
   phone_config {
     after_contact_work_time_limit = 0
     phone_type                    = "SOFT_PHONE"
   }
 }
-`, rName5, email, first_name, last_name))
+`, rName5, email, first_name, last_name, secondary_email))
 }
 
 func testAccUserConfig_phoneDeskPhone(rName, rName2, rName3, rName4, rName5 string, after_contact_work_time_limit int, auto_accept bool, desk_phone_number string) string {

website/docs/d/connect_user.html.markdown

@@ -62,6 +62,7 @@ An `identity_info` block supports the following attributes:
 * `email` - The email address.
 * `first_name` - The first name.
 * `last_name` - The last name.
+* `secondary_email` - The secondary email address. If present, email notifications will be sent to this email address instead of the primary one.
 
 ### `phone_config`
 

website/docs/r/connect_user.html.markdown

@@ -78,9 +78,10 @@ resource "aws_connect_user" "example" {
   ]
 
   identity_info {
-    email      = "[email protected]"
-    first_name = "example"
-    last_name  = "example2"
+    email           = "[email protected]"
+    first_name      = "example"
+    last_name       = "example2"
+    secondary_email = "[email protected]"
   }
 
   phone_config {
@@ -154,6 +155,7 @@ A `identity_info` block supports the following arguments:
 * `email` - (Optional) The email address. If you are using SAML for identity management and include this parameter, an error is returned. Note that updates to the `email` is supported. From the [UpdateUserIdentityInfo API documentation](https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserIdentityInfo.html) it is strongly recommended to limit who has the ability to invoke `UpdateUserIdentityInfo`. Someone with that ability can change the login credentials of other users by changing their email address. This poses a security risk to your organization. They can change the email address of a user to the attacker's email address, and then reset the password through email. For more information, see [Best Practices for Security Profiles](https://docs.aws.amazon.com/connect/latest/adminguide/security-profile-best-practices.html) in the Amazon Connect Administrator Guide.
 * `first_name` - (Optional) The first name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
 * `last_name` - (Optional) The last name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
+* `secondary_email` - (Optional) The secondary email address. If present, email notifications will be sent to this email address instead of the primary one.
 
 A `phone_config` block supports the following arguments: