fix appconfig configuration version drift on each run

.changelog/44847.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appconfig_hosted_configuration_version: Fix persistent drift detection caused by AWS-injected metadata fields (`_createdAt`, `_updatedAt`) in feature flag configurations
+```

internal/service/appconfig/hosted_configuration_version.go

@@ -5,6 +5,7 @@ package appconfig
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log"
 	"strings"
@@ -16,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
@@ -131,7 +133,18 @@ func resourceHostedConfigurationVersionRead(ctx context.Context, d *schema.Resou
 	d.Set(names.AttrApplicationID, output.ApplicationId)
 	d.Set(names.AttrARN, hostedConfigurationVersionARN(ctx, meta.(*conns.AWSClient), applicationID, configurationProfileID, versionNumber))
 	d.Set("configuration_profile_id", output.ConfigurationProfileId)
-	d.Set(names.AttrContent, string(output.Content))
+
+	cleanedContent, err := stripInjectedMetadata(output.Content)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "cleaning content metadata: %s", err)
+	}
+
+	normalizedContent, err := structure.NormalizeJsonString(string(cleanedContent))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "normalizing content: %s", err)
+	}
+
+	d.Set(names.AttrContent, normalizedContent)
 	d.Set(names.AttrContentType, output.ContentType)
 	d.Set(names.AttrDescription, output.Description)
 	d.Set("version_number", output.VersionNumber)
@@ -220,3 +233,34 @@ func findHostedConfigurationVersion(ctx context.Context, conn *appconfig.Client,
 func hostedConfigurationVersionARN(ctx context.Context, c *conns.AWSClient, applicationID, configurationProfileID string, versionNumber int32) string {
 	return c.RegionalARN(ctx, "appconfig", "application/"+applicationID+"/configurationprofile/"+configurationProfileID+"/hostedconfigurationversion/"+flex.Int32ValueToStringValue(versionNumber))
 }
+
+// stripInjectedMetadata removes AWS-injected metadata fields (_createdAt, _updatedAt)
+// from flags.* and values.* objects in hosted configuration content.
+func stripInjectedMetadata(content []byte) ([]byte, error) {
+	var data map[string]any
+	if err := json.Unmarshal(content, &data); err != nil {
+		return nil, err
+	}
+
+	// Remove _createdAt and _updatedAt from flags.* objects
+	if flags, ok := data["flags"].(map[string]any); ok {
+		for _, flag := range flags {
+			if flagMap, ok := flag.(map[string]any); ok {
+				delete(flagMap, "_createdAt")
+				delete(flagMap, "_updatedAt")
+			}
+		}
+	}
+
+	// Remove _createdAt and _updatedAt from values.* objects
+	if values, ok := data[names.AttrValues].(map[string]any); ok {
+		for _, value := range values {
+			if valueMap, ok := value.(map[string]any); ok {
+				delete(valueMap, "_createdAt")
+				delete(valueMap, "_updatedAt")
+			}
+		}
+	}
+
+	return json.Marshal(data)
+}

internal/service/appconfig/hosted_configuration_version_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -76,6 +77,49 @@ func TestAccAppConfigHostedConfigurationVersion_disappears(t *testing.T) {
 	})
 }
 
+func TestAccAppConfigHostedConfigurationVersion_featureFlagsNoDrift(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_appconfig_hosted_configuration_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.AppConfigServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckHostedConfigurationVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccHostedConfigurationVersionConfig_featureFlags(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckHostedConfigurationVersionExists(ctx, resourceName),
+					acctest.MatchResourceAttrRegionalARN(ctx, resourceName, names.AttrARN, "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}/configurationprofile/[0-9a-z]{4,7}/hostedconfigurationversion/[0-9]+`)),
+					resource.TestCheckResourceAttrPair(resourceName, names.AttrApplicationID, "aws_appconfig_application.test", names.AttrID),
+					resource.TestCheckResourceAttrPair(resourceName, "configuration_profile_id", "aws_appconfig_configuration_profile.test", "configuration_profile_id"),
+					resource.TestCheckResourceAttr(resourceName, names.AttrContentType, "application/json"),
+					resource.TestCheckResourceAttr(resourceName, "version_number", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Second apply to verify no drift is detected
+			{
+				Config: testAccHostedConfigurationVersionConfig_featureFlags(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckHostedConfigurationVersionExists(ctx, resourceName),
+				),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},
+			},
+		},
+	})
+}
+
 func testAccCheckHostedConfigurationVersionDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).AppConfigClient(ctx)
@@ -134,3 +178,41 @@ resource "aws_appconfig_hosted_configuration_version" "test" {
 }
 `, rName))
 }
+
+func testAccHostedConfigurationVersionConfig_featureFlags(rName string) string {
+	return acctest.ConfigCompose(
+		testAccConfigurationProfileConfig_name(rName),
+		fmt.Sprintf(`
+resource "aws_appconfig_hosted_configuration_version" "test" {
+  application_id           = aws_appconfig_application.test.id
+  configuration_profile_id = aws_appconfig_configuration_profile.test.configuration_profile_id
+  content_type             = "application/json"
+
+  content = jsonencode({
+    flags = {
+      testflag = {
+        name = "testFlag"
+      }
+    }
+    values = {
+      testflag = {
+        _variants = [
+          {
+            enabled = true
+            name    = "variant1"
+            rule    = "(eq $context \"variant1\")"
+          },
+          {
+            enabled = false
+            name    = "Default"
+          }
+        ]
+      }
+    }
+    version = "1"
+  })
+
+  description = %q
+}
+`, rName))
+}