fix: acm certificate export defaults to ENABLED when options block is omitted

[kantajpn]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

This fix changes the default value of export in options from ENABLED to DISABLED, which reduces the attack surface by preventing unintended certificate exports. No other security controls are affected.

Description

When the options block is omitted from aws_acm_certificate, the export attribute incorrectly defaults to ENABLED instead of DISABLED.

The root cause is that certificate_transparency_logging_preference has Default: ENABLED, which causes the options object to always be sent to the AWS API even when the block is omitted. When AWS receives an Options object without an explicit Export value, it sets Export to ENABLED. In contrast, when no Options object is sent at all (e.g., via AWS CLI), AWS defaults to DISABLED.

This fix explicitly sets Export: DISABLED in expandCertificateOptions when no value is provided, matching the behavior of the AWS CLI and Console.

Relations

Closes #46498

References

• https://docs.aws.amazon.com/acm/latest/APIReference/API_CertificateOptions.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html

Output from Acceptance Testing

I was unable to run acceptance tests due to the cost of AWS Private CA. The existing TestAccACMCertificate_emailValidation test covers this fix by verifying that options.0.export defaults to DISABLED when the options block is omitted.

% make testacc TESTS=TestAccACMCertificate_emailValidation PKG=acm

...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.