Repository: hashicorp/terraform-provider-aws
Pull request #42269: Add aws_workspaces_directory.certificate_based_auth_properties
Author: login: kevingunn-wk
Labels: name: enhancement
description: Requests to existing resources that expand the functionality or scope.
name: documentation
description: Introduces or discusses updates to documentation.
name: size/XL
description: Managed by automation to categorize the size of a PR.
name: tests
description: PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure.
name: service/workspaces
description: Issues and PRs that pertain to the workspaces service.
Created: 2025-04-16T20:25:40Z | Merged: 2025-05-01T16:05:11Z

<!---
See what makes a good Pull Request at: https://hashicorp.github.io/terraform-provider-aws/raising-a-pull-request/
--->
### Description
<!---
Please provide a helpful description of what change this pull request will introduce.
--->

Adds the `certificate_based_auth_properties` structure within the `aws_workspaces_directory` resource and datasource to allow Terraform to manage the configuration of Certificate-based authentication (CBA) within AWS Workspaces.

### Relations
<!---
If your pull request fully resolves and should automatically close the linked issue, use Closes. Otherwise, use Relates.

For Example:

Relates #0000
or 
Closes #0000
--->

n/a

### References
<!---
Optionally, provide any helpful references that may help the reviewer(s).
--->

[Certificate-based authentication](https://docs.aws.amazon.com/workspaces/latest/adminguide/certificate-based-authentication.html)

### Output from Acceptance Testing
<!--
Replace TestAccXXX with a pattern that matches the tests affected by this PR.

Replace ec2 with the service package corresponding to your tests.

For more information on the `-run` flag, see the `go test` documentation at https://tip.golang.org/cmd/go/#hdr-Testing_flags.
-->

```console
% make testacc TESTS=TestAccWorkSpacesDataSource_serial/Directory PKG=workspaces
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.8 test ./internal/service/workspaces/... -v -count 1 -parallel 20 -run='TestAccWorkSpacesDataSource_serial/Directory'  -timeout 360m -vet=off
2025/04/16 15:01:44 Initializing Terraform AWS Provider...
=== RUN   TestAccWorkSpacesDataSource_serial
=== PAUSE TestAccWorkSpacesDataSource_serial
=== CONT  TestAccWorkSpacesDataSource_serial
=== RUN   TestAccWorkSpacesDataSource_serial/Directory
=== RUN   TestAccWorkSpacesDataSource_serial/Directory/basic
--- PASS: TestAccWorkSpacesDataSource_serial (740.62s)
    --- PASS: TestAccWorkSpacesDataSource_serial/Directory (740.62s)
        --- PASS: TestAccWorkSpacesDataSource_serial/Directory/basic (740.62s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/workspaces	753.648s
% make testacc TESTS=TestAccWorkSpaces_serial/Directory/basic PKG=workspaces
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.8 test ./internal/service/workspaces/... -v -count 1 -parallel 20 -run='TestAccWorkSpaces_serial/Directory/basic'  -timeout 360m -vet=off
2025/04/16 15:15:40 Initializing Terraform AWS Provider...
=== RUN   TestAccWorkSpaces_serial
=== PAUSE TestAccWorkSpaces_serial
=== CONT  TestAccWorkSpaces_serial
=== RUN   TestAccWorkSpaces_serial/Directory
=== RUN   TestAccWorkSpaces_serial/Directory/basic
--- PASS: TestAccWorkSpaces_serial (631.45s)
    --- PASS: TestAccWorkSpaces_serial/Directory (631.45s)
        --- PASS: TestAccWorkSpaces_serial/Directory/basic (631.45s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/workspaces	642.920s
% make testacc TESTS=TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties PKG=workspaces
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.8 test ./internal/service/workspaces/... -v -count 1 -parallel 20 -run='TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties'  -timeout 360m -vet=off
2025/04/16 15:27:24 Initializing Terraform AWS Provider...
=== RUN   TestAccWorkSpaces_serial
=== PAUSE TestAccWorkSpaces_serial
=== CONT  TestAccWorkSpaces_serial
=== RUN   TestAccWorkSpaces_serial/Directory
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties
--- PASS: TestAccWorkSpaces_serial (769.42s)
    --- PASS: TestAccWorkSpaces_serial/Directory (769.42s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties (769.42s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/workspaces	782.652s
```


Linked issue #0: 

Diff:
diff --git a/.changelog/42269.txt b/.changelog/42269.txt
new file mode 100644
index 000000000000..bd0c610e54ff
--- /dev/null
+++ b/.changelog/42269.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_workspaces_directory: Add `certificate_based_auth_properties` attribute
+```
+
+```release-note:enhancement
+resource/aws_workspaces_directory: Add `certificate_based_auth_properties` configuration block
+```
diff --git a/internal/service/workspaces/directory.go b/internal/service/workspaces/directory.go
index cfabf8e97891..c8e2b0afe0a9 100644
--- a/internal/service/workspaces/directory.go
+++ b/internal/service/workspaces/directory.go
@@ -23,6 +23,7 @@ import (
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	itypes "github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -44,6 +45,27 @@ func resourceDirectory() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"certificate_based_auth_properties": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"certificate_authority_arn": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						names.AttrStatus: {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateDiagFunc: enum.Validate[types.CertificateBasedAuthStatusEnum](),
+						},
+					},
+				},
+			},
 			"customer_user_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -245,7 +267,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	directoryID := d.Get("directory_id").(string)
-	input := &workspaces.RegisterWorkspaceDirectoryInput{
+	input := workspaces.RegisterWorkspaceDirectoryInput{
 		DirectoryId:       aws.String(directoryID),
 		EnableSelfService: aws.Bool(false), // this is handled separately below
 		EnableWorkDocs:    aws.Bool(false),
@@ -262,7 +284,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	)
 	_, err := tfresource.RetryWhenIsA[*types.InvalidResourceStateException](ctx, timeout,
 		func() (any, error) {
-			return conn.RegisterWorkspaceDirectory(ctx, input)
+			return conn.RegisterWorkspaceDirectory(ctx, &input)
 		})
 
 	if err != nil {
@@ -276,25 +298,39 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if v, ok := d.GetOk("saml_properties"); ok {
-		input := &workspaces.ModifySamlPropertiesInput{
+		input := workspaces.ModifySamlPropertiesInput{
 			ResourceId:     aws.String(d.Id()),
 			SamlProperties: expandSAMLProperties(v.([]any)),
 		}
 
-		_, err := conn.ModifySamlProperties(ctx, input)
+		_, err := conn.ModifySamlProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting WorkSpaces Directory (%s) SAML properties: %s", d.Id(), err)
 		}
 	}
 
+	// SAML needs to be enabled for directory before enabling certificate based authentication.
+	if v, ok := d.GetOk("certificate_based_auth_properties"); ok {
+		input := workspaces.ModifyCertificateBasedAuthPropertiesInput{
+			CertificateBasedAuthProperties: expandCertificateBasedAuthProperties(v.([]any)),
+			ResourceId:                     aws.String(d.Id()),
+		}
+
+		_, err := conn.ModifyCertificateBasedAuthProperties(ctx, &input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting WorkSpaces Directory (%s) certificate-based authentication properties: %s", d.Id(), err)
+		}
+	}
+
 	if v, ok := d.GetOk("self_service_permissions"); ok {
-		input := &workspaces.ModifySelfservicePermissionsInput{
+		input := workspaces.ModifySelfservicePermissionsInput{
 			ResourceId:             aws.String(d.Id()),
 			SelfservicePermissions: expandSelfservicePermissions(v.([]any)),
 		}
 
-		_, err := conn.ModifySelfservicePermissions(ctx, input)
+		_, err := conn.ModifySelfservicePermissions(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting WorkSpaces Directory (%s) self-service permissions: %s", d.Id(), err)
@@ -302,12 +338,12 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if v, ok := d.GetOk("workspace_access_properties"); ok {
-		input := &workspaces.ModifyWorkspaceAccessPropertiesInput{
+		input := workspaces.ModifyWorkspaceAccessPropertiesInput{
 			ResourceId:                aws.String(d.Id()),
 			WorkspaceAccessProperties: expandWorkspaceAccessProperties(v.([]any)),
 		}
 
-		_, err := conn.ModifyWorkspaceAccessProperties(ctx, input)
+		_, err := conn.ModifyWorkspaceAccessProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting WorkSpaces Directory (%s) access properties: %s", d.Id(), err)
@@ -315,12 +351,12 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if v, ok := d.GetOk("workspace_creation_properties"); ok {
-		input := &workspaces.ModifyWorkspaceCreationPropertiesInput{
+		input := workspaces.ModifyWorkspaceCreationPropertiesInput{
 			ResourceId:                  aws.String(d.Id()),
 			WorkspaceCreationProperties: expandWorkspaceCreationProperties(v.([]any)),
 		}
 
-		_, err := conn.ModifyWorkspaceCreationProperties(ctx, input)
+		_, err := conn.ModifyWorkspaceCreationProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting WorkSpaces Directory (%s) creation properties: %s", d.Id(), err)
@@ -328,12 +364,12 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if v, ok := d.GetOk("ip_group_ids"); ok && v.(*schema.Set).Len() > 0 {
-		input := &workspaces.AssociateIpGroupsInput{
+		input := workspaces.AssociateIpGroupsInput{
 			DirectoryId: aws.String(d.Id()),
 			GroupIds:    flex.ExpandStringValueSet(v.(*schema.Set)),
 		}
 
-		_, err := conn.AssociateIpGroups(ctx, input)
+		_, err := conn.AssociateIpGroups(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "asassociating WorkSpaces Directory (%s) IP Groups: %s", d.Id(), err)
@@ -360,6 +396,9 @@ func resourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta any
 	}
 
 	d.Set(names.AttrAlias, directory.Alias)
+	if err := d.Set("certificate_based_auth_properties", flattenCertificateBasedAuthProperties(directory.CertificateBasedAuthProperties)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting certificate_based_auth_properties: %s", err)
+	}
 	d.Set("directory_id", directory.DirectoryId)
 	d.Set("directory_name", directory.DirectoryName)
 	d.Set("directory_type", directory.DirectoryType)
@@ -390,8 +429,8 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	if d.HasChange("saml_properties") {
-		tfListSAMLProperties := d.Get("saml_properties").([]any)
-		tfMap := tfListSAMLProperties[0].(map[string]any)
+		tfList := d.Get("saml_properties").([]any)
+		tfMap := tfList[0].(map[string]any)
 
 		var dels []types.DeletableSamlProperty
 		if tfMap["relay_state_parameter_name"].(string) == "" {
@@ -401,26 +440,49 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 			dels = append(dels, types.DeletableSamlPropertySamlPropertiesUserAccessUrl)
 		}
 
-		input := &workspaces.ModifySamlPropertiesInput{
+		input := workspaces.ModifySamlPropertiesInput{
 			PropertiesToDelete: dels,
 			ResourceId:         aws.String(d.Id()),
-			SamlProperties:     expandSAMLProperties(tfListSAMLProperties),
+			SamlProperties:     expandSAMLProperties(tfList),
 		}
 
-		_, err := conn.ModifySamlProperties(ctx, input)
+		_, err := conn.ModifySamlProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating WorkSpaces Directory (%s) SAML properties: %s", d.Id(), err)
 		}
 	}
 
+	// SAML needs to be enabled for directory before enabling certificate based authentication
+	if d.HasChange("certificate_based_auth_properties") {
+		tfList := d.Get("certificate_based_auth_properties").([]any)
+		tfMap := tfList[0].(map[string]any)
+
+		var dels []types.DeletableCertificateBasedAuthProperty
+		if tfMap["certificate_authority_arn"].(string) == "" {
+			dels = append(dels, types.DeletableCertificateBasedAuthPropertyCertificateBasedAuthPropertiesCertificateAuthorityArn)
+		}
+
+		input := &workspaces.ModifyCertificateBasedAuthPropertiesInput{
+			CertificateBasedAuthProperties: expandCertificateBasedAuthProperties(tfList),
+			PropertiesToDelete:             dels,
+			ResourceId:                     aws.String(d.Id()),
+		}
+
+		_, err := conn.ModifyCertificateBasedAuthProperties(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating WorkSpaces Directory (%s) certificate-based authentication properties: %s", d.Id(), err)
+		}
+	}
+
 	if d.HasChange("self_service_permissions") {
-		input := &workspaces.ModifySelfservicePermissionsInput{
+		input := workspaces.ModifySelfservicePermissionsInput{
 			ResourceId:             aws.String(d.Id()),
 			SelfservicePermissions: expandSelfservicePermissions(d.Get("self_service_permissions").([]any)),
 		}
 
-		_, err := conn.ModifySelfservicePermissions(ctx, input)
+		_, err := conn.ModifySelfservicePermissions(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating WorkSpaces Directory (%s) self-service permissions: %s", d.Id(), err)
@@ -428,12 +490,12 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if d.HasChange("workspace_access_properties") {
-		input := &workspaces.ModifyWorkspaceAccessPropertiesInput{
+		input := workspaces.ModifyWorkspaceAccessPropertiesInput{
 			ResourceId:                aws.String(d.Id()),
 			WorkspaceAccessProperties: expandWorkspaceAccessProperties(d.Get("workspace_access_properties").([]any)),
 		}
 
-		_, err := conn.ModifyWorkspaceAccessProperties(ctx, input)
+		_, err := conn.ModifyWorkspaceAccessProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating WorkSpaces Directory (%s) access properties: %s", d.Id(), err)
@@ -441,12 +503,12 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 	}
 
 	if d.HasChange("workspace_creation_properties") {
-		input := &workspaces.ModifyWorkspaceCreationPropertiesInput{
+		input := workspaces.ModifyWorkspaceCreationPropertiesInput{
 			ResourceId:                  aws.String(d.Id()),
 			WorkspaceCreationProperties: expandWorkspaceCreationProperties(d.Get("workspace_creation_properties").([]any)),
 		}
 
-		_, err := conn.ModifyWorkspaceCreationProperties(ctx, input)
+		_, err := conn.ModifyWorkspaceCreationProperties(ctx, &input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating WorkSpaces Directory (%s) creation properties: %s", d.Id(), err)
@@ -459,12 +521,12 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 		add, del := ns.Difference(os), os.Difference(ns)
 
 		if add.Len() > 0 {
-			input := &workspaces.AssociateIpGroupsInput{
+			input := workspaces.AssociateIpGroupsInput{
 				DirectoryId: aws.String(d.Id()),
 				GroupIds:    flex.ExpandStringValueSet(add),
 			}
 
-			_, err := conn.AssociateIpGroups(ctx, input)
+			_, err := conn.AssociateIpGroups(ctx, &input)
 
 			if err != nil {
 				return sdkdiag.AppendErrorf(diags, "associating WorkSpaces Directory (%s) IP Groups: %s", d.Id(), err)
@@ -472,12 +534,12 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta a
 		}
 
 		if del.Len() > 0 {
-			input := &workspaces.DisassociateIpGroupsInput{
+			input := workspaces.DisassociateIpGroupsInput{
 				DirectoryId: aws.String(d.Id()),
 				GroupIds:    flex.ExpandStringValueSet(del),
 			}
 
-			_, err := conn.DisassociateIpGroups(ctx, input)
+			_, err := conn.DisassociateIpGroups(ctx, &input)
 
 			if err != nil {
 				return sdkdiag.AppendErrorf(diags, "disassociating WorkSpaces Directory (%s) IP Groups: %s", d.Id(), err)
@@ -493,14 +555,15 @@ func resourceDirectoryDelete(ctx context.Context, d *schema.ResourceData, meta a
 	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	log.Printf("[DEBUG] Deleting WorkSpaces Directory: %s", d.Id())
+	input := workspaces.DeregisterWorkspaceDirectoryInput{
+		DirectoryId: aws.String(d.Id()),
+	}
 	const (
 		timeout = 2 * time.Minute
 	)
 	_, err := tfresource.RetryWhenIsA[*types.InvalidResourceStateException](ctx, timeout,
 		func() (any, error) {
-			return conn.DeregisterWorkspaceDirectory(ctx, &workspaces.DeregisterWorkspaceDirectoryInput{
-				DirectoryId: aws.String(d.Id()),
-			})
+			return conn.DeregisterWorkspaceDirectory(ctx, &input)
 		})
 
 	if errs.IsA[*types.ResourceNotFoundException](err) {
@@ -519,11 +582,11 @@ func resourceDirectoryDelete(ctx context.Context, d *schema.ResourceData, meta a
 }
 
 func findDirectoryByID(ctx context.Context, conn *workspaces.Client, id string) (*types.WorkspaceDirectory, error) {
-	input := &workspaces.DescribeWorkspaceDirectoriesInput{
+	input := workspaces.DescribeWorkspaceDirectoriesInput{
 		DirectoryIds: []string{id},
 	}
 
-	output, err := findDirectory(ctx, conn, input)
+	output, err := findDirectory(ctx, conn, &input)
 
 	if err != nil {
 		return nil, err
@@ -677,6 +740,25 @@ func expandWorkspaceAccessProperties(tfList []any) *types.WorkspaceAccessPropert
 	return apiObject
 }
 
+func expandCertificateBasedAuthProperties(tfList []any) *types.CertificateBasedAuthProperties {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	apiObject := &types.CertificateBasedAuthProperties{}
+	tfMap := tfList[0].(map[string]any)
+
+	if tfMap["certificate_authority_arn"].(string) != "" {
+		apiObject.CertificateAuthorityArn = aws.String(tfMap["certificate_authority_arn"].(string))
+	}
+
+	if tfMap[names.AttrStatus].(string) != "" {
+		apiObject.Status = types.CertificateBasedAuthStatusEnum(tfMap[names.AttrStatus].(string))
+	}
+
+	return apiObject
+}
+
 func expandSAMLProperties(tfList []any) *types.SamlProperties {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
@@ -783,6 +865,19 @@ func flattenWorkspaceAccessProperties(apiObject *types.WorkspaceAccessProperties
 	}
 }
 
+func flattenCertificateBasedAuthProperties(apiObject *types.CertificateBasedAuthProperties) []any {
+	if apiObject == nil {
+		return []any{}
+	}
+
+	return []any{
+		map[string]any{
+			"certificate_authority_arn": aws.ToString(apiObject.CertificateAuthorityArn),
+			names.AttrStatus:            apiObject.Status,
+		},
+	}
+}
+
 func flattenSAMLProperties(apiObject *types.SamlProperties) []any {
 	if apiObject == nil {
 		return []any{}
diff --git a/internal/service/workspaces/directory_data_source.go b/internal/service/workspaces/directory_data_source.go
index af057413688e..e2521a9fea3e 100644
--- a/internal/service/workspaces/directory_data_source.go
+++ b/internal/service/workspaces/directory_data_source.go
@@ -25,6 +25,22 @@ func dataSourceDirectory() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"certificate_based_auth_properties": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"certificate_authority_arn": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						names.AttrStatus: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"customer_user_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -202,6 +218,9 @@ func dataSourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta a
 
 	d.SetId(directoryID)
 	d.Set(names.AttrAlias, directory.Alias)
+	if err := d.Set("certificate_based_auth_properties", flattenCertificateBasedAuthProperties(directory.CertificateBasedAuthProperties)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting certificate_based_auth_properties: %s", err)
+	}
 	d.Set("directory_id", directory.DirectoryId)
 	d.Set("directory_name", directory.DirectoryName)
 	d.Set("directory_type", directory.DirectoryType)
diff --git a/internal/service/workspaces/directory_data_source_test.go b/internal/service/workspaces/directory_data_source_test.go
index a472e0b41956..43a777a1c4e2 100644
--- a/internal/service/workspaces/directory_data_source_test.go
+++ b/internal/service/workspaces/directory_data_source_test.go
@@ -44,6 +44,9 @@ func testAccDirectoryDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "iam_role_id", resourceName, "iam_role_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "ip_group_ids", resourceName, "ip_group_ids"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "registration_code", resourceName, "registration_code"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "certificate_based_auth_properties.#", resourceName, "certificate_based_auth_properties.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "certificate_based_auth_properties.0.status", resourceName, "certificate_based_auth_properties.0.status"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "certificate_based_auth_properties.0.certificate_authority_arn", resourceName, "certificate_based_auth_properties.0.certificate_authority_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "saml_properties.#", resourceName, "saml_properties.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "saml_properties.0.relay_state_parameter_name", resourceName, "saml_properties.0.relay_state_parameter_name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "saml_properties.0.status", resourceName, "saml_properties.0.status"),
@@ -94,6 +97,11 @@ resource "aws_security_group" "test" {
 resource "aws_workspaces_directory" "test" {
   directory_id = aws_directory_service_directory.main.id
 
+  certificate_based_auth_properties {
+    status                    = "ENABLED"
+    certificate_authority_arn = "arn:${data.aws_partition.current.partition}:acm-pca:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:certificate-authority/12345678-1234-1234-1234-123456789012"
+  }
+
   saml_properties {
     relay_state_parameter_name = "LinkMode"
     status                     = "ENABLED"
diff --git a/internal/service/workspaces/directory_test.go b/internal/service/workspaces/directory_test.go
index 766c71b677b3..4272949ff6f8 100644
--- a/internal/service/workspaces/directory_test.go
+++ b/internal/service/workspaces/directory_test.go
@@ -55,6 +55,8 @@ func testAccDirectory_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_id", iamRoleDataSourceName, names.AttrARN),
 					resource.TestCheckResourceAttr(resourceName, "ip_group_ids.#", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "registration_code"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.status", "DISABLED"),
 					resource.TestCheckResourceAttr(resourceName, "saml_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "saml_properties.0.relay_state_parameter_name", "RelayState"),
 					resource.TestCheckResourceAttr(resourceName, "saml_properties.0.status", "DISABLED"),
@@ -294,6 +296,68 @@ func testAccDirectory_SamlProperties(t *testing.T) {
 	})
 }
 
+func testAccDirectory_CertificateBasedAuthProperties(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.WorkspaceDirectory
+	rName := sdkacctest.RandString(8)
+
+	resourceName := "aws_workspaces_directory.main"
+
+	domain := acctest.RandomDomainName()
+
+	certificateAuthorityID := "12345678-1234-1234-1234-123456789012"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDirectory(ctx, t)
+			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
+			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDirectoryConfig_certificateBasedAuthPropertiesEnabled(rName, domain, certificateAuthorityID),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDirectoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.status", "ENABLED"),
+					acctest.CheckResourceAttrRegionalARN(ctx, resourceName, "certificate_based_auth_properties.0.certificate_authority_arn", "acm-pca", fmt.Sprintf("certificate-authority/%s", certificateAuthorityID)),
+				),
+			},
+			{
+				Config: testAccDirectoryConfig_certificateBasedAuthPropertiesDisabled(rName, domain),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDirectoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.status", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.certificate_authority_arn", ""),
+				),
+			},
+			{
+				Config: testAccDirectoryConfig_certificateBasedAuthPropertiesDisabledARN(rName, domain, certificateAuthorityID),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDirectoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.status", "DISABLED"),
+					acctest.CheckResourceAttrRegionalARN(ctx, resourceName, "certificate_based_auth_properties.0.certificate_authority_arn", "acm-pca", fmt.Sprintf("certificate-authority/%s", certificateAuthorityID)),
+				),
+			},
+			{
+				Config: testAccDirectoryConfig_certificateBasedAuthPropertiesEmpty(rName, domain),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDirectoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.status", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "certificate_based_auth_properties.0.certificate_authority_arn", ""),
+				),
+			},
+		},
+	})
+}
+
 func testAccDirectory_selfServicePermissions(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v types.WorkspaceDirectory
@@ -575,6 +639,10 @@ func testAccDirectoryConfig_Prerequisites(rName, domain string) string {
 		fmt.Sprintf(`
 data "aws_region" "current" {}
 
+data "aws_caller_identity" "current" {}
+
+data "aws_partition" "current" {}
+
 locals {
   region_workspaces_az_ids = {
     "us-east-1" = formatlist("use1-az%%d", [2, 4, 6])
@@ -720,6 +788,106 @@ resource "aws_workspaces_directory" "main" {
 `, rName))
 }
 
+func testAccDirectoryConfig_certificateBasedAuthPropertiesEnabled(rName, domain, certificateAuthorityID string) string {
+	return acctest.ConfigCompose(
+		testAccDirectoryConfig_Prerequisites(rName, domain),
+		fmt.Sprintf(`
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  certificate_based_auth_properties {
+    status                    = "ENABLED"
+    certificate_authority_arn = "arn:${data.aws_partition.current.partition}:acm-pca:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:certificate-authority/%[3]s"
+  }
+
+  saml_properties {
+    relay_state_parameter_name = "RelayState"
+    user_access_url            = "https://sso.%[2]s/"
+    status                     = "ENABLED"
+  }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+
+data "aws_iam_role" "workspaces-default" {
+  name = "workspaces_DefaultRole"
+}
+`, rName, domain, certificateAuthorityID))
+}
+
+func testAccDirectoryConfig_certificateBasedAuthPropertiesDisabled(rName, domain string) string {
+	return acctest.ConfigCompose(
+		testAccDirectoryConfig_Prerequisites(rName, domain),
+		fmt.Sprintf(`
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  certificate_based_auth_properties {
+    status                    = "DISABLED"
+    certificate_authority_arn = ""
+  }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+
+data "aws_iam_role" "workspaces-default" {
+  name = "workspaces_DefaultRole"
+}
+`, rName))
+}
+
+func testAccDirectoryConfig_certificateBasedAuthPropertiesDisabledARN(rName, domain, certificateAuthorityID string) string {
+	return acctest.ConfigCompose(
+		testAccDirectoryConfig_Prerequisites(rName, domain),
+		fmt.Sprintf(`
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  certificate_based_auth_properties {
+    status                    = "DISABLED"
+    certificate_authority_arn = "arn:${data.aws_partition.current.partition}:acm-pca:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:certificate-authority/%[3]s"
+  }
+
+  saml_properties {
+    relay_state_parameter_name = "RelayState"
+    user_access_url            = "https://sso.%[2]s/"
+    status                     = "ENABLED"
+  }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+data "aws_iam_role" "workspaces-default" {
+  name = "workspaces_DefaultRole"
+}
+`, rName, domain, certificateAuthorityID))
+}
+
+func testAccDirectoryConfig_certificateBasedAuthPropertiesEmpty(rName, domain string) string {
+	return acctest.ConfigCompose(
+		testAccDirectoryConfig_Prerequisites(rName, domain),
+		fmt.Sprintf(`
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  certificate_based_auth_properties {}
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+
+data "aws_iam_role" "workspaces-default" {
+  name = "workspaces_DefaultRole"
+}
+`, rName))
+}
+
 func testAccDirectoryConfig_selfServicePermissions(rName, domain string) string {
 	return acctest.ConfigCompose(
 		testAccDirectoryConfig_Prerequisites(rName, domain),
diff --git a/internal/service/workspaces/workspaces_test.go b/internal/service/workspaces/workspaces_test.go
index baf13436dd68..4604b9fe138a 100644
--- a/internal/service/workspaces/workspaces_test.go
+++ b/internal/service/workspaces/workspaces_test.go
@@ -23,6 +23,7 @@ func TestAccWorkSpaces_serial(t *testing.T) {
 			"workspaceAccessProperties":   testAccDirectory_workspaceAccessProperties,
 			"workspaceCreationProperties": testAccDirectory_workspaceCreationProperties,
 			"workspaceCreationProperties_customSecurityGroupId_defaultOu": testAccDirectory_workspaceCreationProperties_customSecurityGroupId_defaultOu,
+			"workspaceCertificateBasedAuthProperties":                     testAccDirectory_CertificateBasedAuthProperties,
 			"workspaceSamlProperties":                                     testAccDirectory_SamlProperties,
 		},
 		"IpGroup": {
diff --git a/website/docs/r/workspaces_directory.html.markdown b/website/docs/r/workspaces_directory.html.markdown
index b29ffff28f4c..1a0c2ffbcef0 100644
--- a/website/docs/r/workspaces_directory.html.markdown
+++ b/website/docs/r/workspaces_directory.html.markdown
@@ -26,6 +26,11 @@ resource "aws_workspaces_directory" "example" {
     Example = true
   }
 
+  certificate_based_auth_properties {
+    certificate_authority_arn = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
+    status                    = "ENABLED"
+  }
+
   saml_properties {
     user_access_url = "https://sso.example.com/"
     status          = "ENABLED"
@@ -156,11 +161,17 @@ This resource supports the following arguments:
 * `subnet_ids` - (Optional) The identifiers of the subnets where the directory resides.
 * `ip_group_ids` – (Optional) The identifiers of the IP access control groups associated with the directory.
 * `tags` – (Optional) A map of tags assigned to the WorkSpaces directory. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `certificate_based_auth_properties` - (Optional) Configuration of certificate-based authentication (CBA) integration. Requires SAML authentication to be enabled. Defined below.
 * `saml_properties` – (Optional) Configuration of SAML authentication integration. Defined below.
 * `self_service_permissions` – (Optional) Permissions to enable or disable self-service capabilities. Defined below.
 * `workspace_access_properties` – (Optional) Specifies which devices and operating systems users can use to access their WorkSpaces. Defined below.
 * `workspace_creation_properties` – (Optional) Default properties that are used for creating WorkSpaces. Defined below.
 
+### certificate_based_auth_properties
+
+* `certificate_authority_arn` - (Optional) The Amazon Resource Name (ARN) of the certificate manager private certificate authority (ACM-PCA) that is used for certificate-based authentication.
+* `status` - (Optional) Status of certificate-based authentication. Default `DISABLED`.
+
 ### saml_properties
 
 * `relay_state_parameter_name` - (Optional) The relay state parameter name supported by the SAML 2.0 identity provider (IdP). Default `RelayState`.


Reviews:
user: login: ewbankkit
body: LGTM :rocket:.

```console
% ACCTEST_TIMEOUT=720m make testacc TESTARGS='-run=TestAccWorkSpaces_serial/^Directory$$\|TestAccWorkSpacesDataSource_serial/^Directory$$' PKG=workspaces
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.8 test ./internal/service/workspaces/... -v -count 1 -parallel 20  -run=TestAccWorkSpaces_serial/^Directory$\|TestAccWorkSpacesDataSource_serial/^Directory$ -timeout 720m -vet=off
2025/04/30 16:00:16 Initializing Terraform AWS Provider...
=== RUN   TestAccWorkSpacesDataSource_serial
=== PAUSE TestAccWorkSpacesDataSource_serial
=== RUN   TestAccWorkSpaces_serial
=== PAUSE TestAccWorkSpaces_serial
=== CONT  TestAccWorkSpacesDataSource_serial
=== CONT  TestAccWorkSpaces_serial
=== RUN   TestAccWorkSpacesDataSource_serial/Directory
=== RUN   TestAccWorkSpacesDataSource_serial/Directory/basic
=== RUN   TestAccWorkSpaces_serial/Directory
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceSamlProperties
--- PASS: TestAccWorkSpacesDataSource_serial (730.55s)
    --- PASS: TestAccWorkSpacesDataSource_serial/Directory (730.54s)
        --- PASS: TestAccWorkSpacesDataSource_serial/Directory/basic (730.54s)
=== RUN   TestAccWorkSpaces_serial/Directory/basic
=== RUN   TestAccWorkSpaces_serial/Directory/disappears
=== RUN   TestAccWorkSpaces_serial/Directory/ipGroupIds
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceAccessProperties
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties
=== RUN   TestAccWorkSpaces_serial/Directory/selfServicePermissions
=== RUN   TestAccWorkSpaces_serial/Directory/subnetIDs
=== RUN   TestAccWorkSpaces_serial/Directory/tags
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceCreationProperties
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceCreationProperties_customSecurityGroupId_defaultOu
--- PASS: TestAccWorkSpaces_serial (6494.22s)
    --- PASS: TestAccWorkSpaces_serial/Directory (6494.22s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceSamlProperties (884.21s)
        --- PASS: TestAccWorkSpaces_serial/Directory/basic (685.73s)
        --- PASS: TestAccWorkSpaces_serial/Directory/disappears (600.22s)
        --- PASS: TestAccWorkSpaces_serial/Directory/ipGroupIds (602.61s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceAccessProperties (516.40s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties (620.03s)
        --- PASS: TestAccWorkSpaces_serial/Directory/selfServicePermissions (631.96s)
        --- PASS: TestAccWorkSpaces_serial/Directory/subnetIDs (571.74s)
        --- PASS: TestAccWorkSpaces_serial/Directory/tags (656.94s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceCreationProperties (174.83s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceCreationProperties_customSecurityGroupId_defaultOu (352.94s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/workspaces	6498.885s
```
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T01:02:26Z
user: login: jar-b
body: LGTM 🚀
state: DISMISSED
author_association: MEMBER
submitted_at: 2025-05-01T13:19:07Z
user: login: ewbankkit
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T14:59:56Z
user: login: jar-b
body: LGTM 🚀
state: APPROVED
author_association: MEMBER
submitted_at: 2025-05-01T16:03:10Z

Review comments:
diff_hunk: @@ -44,6 +45,27 @@ func resourceDirectory() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"certificate_based_auth_properties": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"certificate_authority_arn": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						names.AttrStatus: {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Default:          types.CertificateBasedAuthStatusEnumDisabled,
path: internal/service/workspaces/directory.go
user: login: jar-b
body: Not a blocker, just a question - could this be optional/computed to allow the AWS default value to propagate through? Or does there need to be a provider side default?
created_at: 2025-05-01T13:18:57Z
author_association: MEMBER
diff_hunk: @@ -44,6 +45,27 @@ func resourceDirectory() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"certificate_based_auth_properties": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"certificate_authority_arn": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						names.AttrStatus: {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Default:          types.CertificateBasedAuthStatusEnumDisabled,
path: internal/service/workspaces/directory.go
user: login: ewbankkit
body: Yes, that works:

```console
% make testacc TESTARGS='-run=TestAccWorkSpaces_serial/^Directory$$/basic\|TestAccWorkSpaces_serial/^Directory$$/workspaceCertificateBasedAuthProperties' PKG=workspaces
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.8 test ./internal/service/workspaces/... -v -count 1 -parallel 20  -run=TestAccWorkSpaces_serial/^Directory$/basic\|TestAccWorkSpaces_serial/^Directory$/workspaceCertificateBasedAuthProperties -timeout 360m -vet=off
2025/05/01 10:34:04 Initializing Terraform AWS Provider...
=== RUN   TestAccWorkSpaces_serial
=== PAUSE TestAccWorkSpaces_serial
=== CONT  TestAccWorkSpaces_serial
=== RUN   TestAccWorkSpaces_serial/Directory
=== RUN   TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties
=== RUN   TestAccWorkSpaces_serial/Directory/basic
--- PASS: TestAccWorkSpaces_serial (1235.72s)
    --- PASS: TestAccWorkSpaces_serial/Directory (1235.71s)
        --- PASS: TestAccWorkSpaces_serial/Directory/workspaceCertificateBasedAuthProperties (644.48s)
        --- PASS: TestAccWorkSpaces_serial/Directory/basic (591.24s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/workspaces	1240.410s
```
created_at: 2025-05-01T14:59:55Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-04-16T20:25:54Z
body: ### Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! :rocket:

#### Voting for Prioritization

* Please vote on this Pull Request by adding a :+1: [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize it.
* Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for additional information on how the maintainers handle prioritization.
* Please **do not** leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

### Pull Request Authors

* Review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/) relating to the type of change you are making to ensure all of the necessary steps have been taken.
* Whether or not the branch has been rebased will **not** impact prioritization, but doing so is always a welcome surprise.


author_association: CONTRIBUTOR
user: login: ewbankkit
created_at: 2025-05-01T16:05:07Z
body: @kevingunn-wk Thanks for the contribution :tada: :clap:.
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-01T16:05:28Z
body: > [!WARNING]
> This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.
>
> Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the [AWS Provider forum](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33), is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-01T19:05:37Z
body: This functionality has been released in [v5.97.0 of the Terraform AWS Provider](https://github.com/hashicorp/terraform-provider-aws/blob/v5.97.0/CHANGELOG.md).  Please see the [Terraform documentation on provider versioning](https://www.terraform.io/docs/configuration/providers.html#provider-versions) or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a [new GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/new/choose) following the template. Thank you!
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-06-01T02:38:43Z
body: I'm going to lock this pull request because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
author_association: CONTRIBUTOR