New data source: r/aws_cloudfront_connection_group: Added new connection group data source as part of Cloudfront's SaaS Manager feature

[codyzhao2770]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

N/A

Description

IMPORTANT: This PR is part of a set of PRs for AWS Cloudfront SaaS Manager support and implements the data source for #44184. Please merge #44184 before this PR.

This PR introduces support for AWS Cloudfront's latest SaaS Manager feature with a data source for the new Connection Group resource.

Takes the ID of an existing connection group to retrieve its:

• anycast_ip_list_id
• arn
• enabled
• etag
• ipv6_enabled
• is_default
• last_modified_time
• name
• routing_endpoint
• status
• tags

data "aws_cloudfront_connection_group" "test" {
	id = aws_cloudfront_connection_group.resource.id
}

Testing with Anycast IP Lists: There is currently no Terraform resource or data source for Cloudfront Anycast IP Lists, running TestAccCloudFrontConnectionGroupDataSource_anycast requires first manually creating an Anycast IP List and adding the list ID to the test config.

Relations

Relates #42409

Requires #44184

References

Connection Group CDK Docs
General SaaS information
SaaS unsupported features

Output from Acceptance Testing

% make testacc TESTS=TestAccCloudFrontConnectionGroupDataSource PKG=cloudfront
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.24.6 test ./internal/service/cloudfront/... -v -count 1 -parallel 20 -run='TestAccCloudFrontConnectionGroupDataSource'  -timeout 360m -vet=off
2025/09/15 04:46:34 Creating Terraform AWS Provider (SDKv2-style)...
2025/09/15 04:46:34 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccCloudFrontConnectionGroupDataSource_basic
=== PAUSE TestAccCloudFrontConnectionGroupDataSource_basic
=== RUN   TestAccCloudFrontConnectionGroupDataSource_anycast
=== PAUSE TestAccCloudFrontConnectionGroupDataSource_anycast
=== CONT  TestAccCloudFrontConnectionGroupDataSource_basic
=== CONT  TestAccCloudFrontConnectionGroupDataSource_anycast
--- PASS: TestAccCloudFrontConnectionGroupDataSource_anycast (646.97s)
--- PASS: TestAccCloudFrontConnectionGroupDataSource_basic (647.14s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront 647.305s

...

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[codyzhao2770]

Checks failing since this PR relies on code from #44184, should I merge that branch into this?