generic: path-aware attribute name mapping for duplicate CloudFormation property names

[arditti]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request
• The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Relates #2311

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls.

Description

Fixes the duplicate attribute name mapping for CloudFormation property Id startup error that currently forces suppress_resource_generation on 9 resources, and un-suppresses two of them: awscc_cloudfront_distribution and awscc_cloudfront_anycast_ip_list.

Root cause

The generator renames a top-level CloudFormation Id property to <type>_id (e.g. distribution_id) because Terraform reserves id. When the same schema also has a nested property named Id (e.g. AWS::CloudFront::Distribution has top-level Id plus DistributionConfig/Origins/*/Id), the generated flat tfToCfNameMap contains both distribution_id → Id and id → Id. Inverting that map in internal/generic/resource.go / data_source.go then fails, because the reverse lookup is path-insensitive while the collision only exists across different JSON paths.

Fix

invertAttributeNameMap (new, in internal/generic/translate.go) splits the mapping into:

• cfToTfNameMap — the naming-convention reverse map (Id → id), used at nested paths as before;
• rootCfToTfNameMap — top-level overrides (Id → distribution_id), consulted only when translating properties at the document root;
• rootTfToCfNameMap — the TF→CFN top-level override, so the synthetic top-level id (the Cloud Control identifier, Computed-only) can never leak into DesiredState/patch documents as the resource's own Id property.

Consumers are made root-aware at the three places with path context: toTerraform.valueFromRaw, toCloudControl.rawFromValue, and propertyPathToAttributePath. Resources without a top-level/nested collision produce empty override maps and behave exactly as before; irreconcilable duplicates (two same-named properties at the same level) still error exactly as before.

Scope

Only aws_cloudfront_distribution and aws_cloudfront_anycast_ip_list are un-suppressed here to keep the review surface small. The same fix unlocks the other 7 resources suppressed for this reason (aws_amazonmq_broker, aws_eks_nodegroup, aws_emrcontainers_security_configuration, aws_emrcontainers_virtual_cluster, aws_mediapackage_channel, aws_mediapackage_origin_endpoint, aws_vpclattice_target_group); happy to follow up.

Test evidence

• go build ./..., gofmt, go vet, golangci-lint run (pinned version): clean.
• New unit tests in internal/generic/translate_test.go: TestInvertAttributeNameMap and TestTranslateRoundTripWithDuplicateId prove full round-trip translation (state → Cloud Control document → state) with a colliding nested Id.
• go test ./internal/generic/... ./internal/aws/cloudfront/... ./internal/provider/... — all pass, including a factory smoke test instantiating every registered resource/data source schema.
• Acceptance: generated _NonExistent acctests for awscc_cloudfront_distribution pass. End-to-end against a real AWS account: created a disabled CloudFront distribution via Cloud Control, terraform import + refresh through this provider round-tripped correctly (distribution_id = distribution ID, synthetic id = Cloud Control identifier, nested origins[0].id preserved); the singular data source returns the same. AnycastIpList acceptance was skipped (the resource carries real cost); maintainers run acceptance tests pre-merge.

Known pre-existing issue (not introduced here)

The current CloudFront Distribution schema declares default: "" on several optional strings (e.g. RealtimeLogConfigArn), which the emitter turns into stringdefault.StaticString(""); CloudFront rejects the empty string on create. Verified via direct Cloud Control calls that this is independent of the name-mapping change (import/read/update are unaffected). Worth tracking separately as a schema-defaults issue.

[arditti]

Pushed a comment-only follow-up commit: the seven resources that stay suppressed for the duplicate-Id collision now document the mechanism and link #2311 in all_schemas.hcl, and note they remain suppressed only pending regeneration + validation — the previous one-line comment would have read as an unfixed generator error once this PR lands. No code changes.