r/aws_rds_integration: add data_filter argument (#40816)

This argument is optional and computed, as AWS sets a default value of `include: *.*` when omitted.

```console
% make testacc PKG=rds TESTS=TestAccRDSIntegration_
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/rds/... -v -count 1 -parallel 20 -run='TestAccRDSIntegration_'  -timeout 360m
2025/01/07 11:18:46 Initializing Terraform AWS Provider...

--- PASS: TestAccRDSIntegration_basic (1775.26s)
--- PASS: TestAccRDSIntegration_disappears (1807.05s)
--- PASS: TestAccRDSIntegration_optional (2079.73s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/rds        2085.031s
```

.changelog/40816.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_rds_integration: Add `data_filter` argument
+```

internal/service/rds/integration.go

@@ -77,7 +77,15 @@ func (r *integrationResource) Schema(ctx context.Context, request resource.Schem
 				},
 			},
 			names.AttrARN: framework.ARNAttributeComputedOnly(),
-			names.AttrID:  framework.IDAttribute(),
+			"data_filter": schema.StringAttribute{
+				Optional: true,
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			names.AttrID: framework.IDAttribute(),
 			"integration_name": schema.StringAttribute{
 				Required: true,
 				PlanModifiers: []planmodifier.String{
@@ -160,6 +168,7 @@ func (r *integrationResource) Create(ctx context.Context, request resource.Creat
 
 	// Set values for unknowns.
 	data.KMSKeyID = fwflex.StringToFramework(ctx, integration.KMSKeyId)
+	data.DataFilter = fwflex.StringToFramework(ctx, integration.DataFilter)
 
 	response.Diagnostics.Append(response.State.Set(ctx, data)...)
 }
@@ -352,6 +361,7 @@ func integrationError(v awstypes.IntegrationError) error {
 
 type integrationResourceModel struct {
 	AdditionalEncryptionContext fwtypes.MapValueOf[types.String] `tfsdk:"additional_encryption_context"`
+	DataFilter                  types.String                     `tfsdk:"data_filter"`
 	ID                          types.String                     `tfsdk:"id"`
 	IntegrationARN              types.String                     `tfsdk:"arn"`
 	IntegrationName             types.String                     `tfsdk:"integration_name"`

internal/service/rds/integration_test.go

@@ -47,6 +47,7 @@ func TestAccRDSIntegration_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckIntegrationExists(ctx, resourceName, &integration),
 					resource.TestCheckResourceAttr(resourceName, "integration_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "data_filter", "include: *.*"),
 					resource.TestCheckResourceAttrPair(resourceName, "source_arn", "aws_rds_cluster.test", names.AttrARN),
 					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, "0"),
 					resource.TestCheckResourceAttrPair(resourceName, names.AttrTargetARN, "aws_redshiftserverless_namespace.test", names.AttrARN),
@@ -123,6 +124,7 @@ func TestAccRDSIntegration_optional(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckIntegrationExists(ctx, resourceName, &integration),
 					resource.TestCheckResourceAttr(resourceName, "integration_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "data_filter", "include: test.mytable"),
 					resource.TestCheckResourceAttrPair(resourceName, names.AttrKMSKeyID, "aws_kms_key.test", names.AttrARN),
 					resource.TestCheckResourceAttrPair(resourceName, "source_arn", "aws_rds_cluster.test", names.AttrARN),
 					resource.TestCheckResourceAttrPair(resourceName, names.AttrTargetARN, "aws_redshiftserverless_namespace.test", names.AttrARN),
@@ -453,6 +455,8 @@ resource "aws_rds_integration" "test" {
     "department" : "test",
   }
 
+  data_filter = "include: test.mytable"
+
   tags = {
     Name = %[1]q
   }

website/docs/r/rds_integration.html.markdown

@@ -95,17 +95,22 @@ For more detailed documentation about each argument, refer to the [AWS official
 The following arguments are required:
 
 * `integration_name` - (Required, Forces new resources) Name of the integration.
-
 * `source_arn` - (Required, Forces new resources) ARN of the database to use as the source for replication.
-
 * `target_arn` - (Required, Forces new resources) ARN of the Redshift data warehouse to use as the target for replication.
 
 The following arguments are optional:
 
-* `kms_key_id` - (Optional, Forces new resources) KMS key identifier for the key to use to encrypt the integration. If you don't specify an encryption key, RDS uses a default AWS owned key. If you use the default AWS owned key, you should ignore `kms_key_id` parameter by using [`lifecycle` parameter](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes) to avoid unintended change after the first creation.
-
-* `additional_encryption_context` - (Optional, Forces new resources) Set of non-secret key–value pairs that contains additional contextual information about the data. For more information, see the [User Guide](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context). You can only include this parameter if you specify the `kms_key_id` parameter.
-
+* `additional_encryption_context` - (Optional, Forces new resources) Set of non-secret key–value pairs that contains additional contextual information about the data.
+For more information, see the [User Guide](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context).
+You can only include this parameter if you specify the `kms_key_id` parameter.
+* `data_filter` - (Optional, Forces new resources) Data filters for the integration.
+These filters determine which tables from the source database are sent to the target Amazon Redshift data warehouse.
+The value should match the syntax from the AWS CLI which includes an `include:` or `exclude:` prefix before a filter expression.
+Multiple expressions are separated by a comma.
+See the [Amazon RDS data filtering guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/zero-etl.filtering.html) for additional details.
+* `kms_key_id` - (Optional, Forces new resources) KMS key identifier for the key to use to encrypt the integration.
+If you don't specify an encryption key, RDS uses a default AWS owned key.
+If you use the default AWS owned key, you should ignore `kms_key_id` parameter by using [`lifecycle` parameter](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes) to avoid unintended change after the first creation.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ## Attribute Reference