resource/aws_api_gateway_rest_api: Add disable_execute_api_endpoint argument (#16198)

Output from acceptance testing:

```
--- PASS: TestAccAWSAPIGatewayRestApi_api_key_source (49.76s)
--- PASS: TestAccAWSAPIGatewayRestApi_basic (733.13s)
--- PASS: TestAccAWSAPIGatewayRestApi_disable_execute_api_endpoint (29.79s)
--- PASS: TestAccAWSAPIGatewayRestApi_disappears (30.64s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration (237.77s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private (9.10s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint (222.18s)
--- PASS: TestAccAWSAPIGatewayRestApi_openapi (17.50s)
--- PASS: TestAccAWSAPIGatewayRestApi_Parameters (38.95s)
--- PASS: TestAccAWSAPIGatewayRestApi_policy (437.20s)
--- PASS: TestAccAWSAPIGatewayRestApi_tags (20.53s)
```

Author: philnichol

aws/resource_aws_api_gateway_rest_api.go

@@ -65,6 +65,12 @@ func resourceAwsApiGatewayRestApi() *schema.Resource {
 				Optional: true,
 			},
 
+			"disable_execute_api_endpoint": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+
 			"parameters": {
 				Type:     schema.TypeMap,
 				Optional: true,
@@ -156,6 +162,10 @@ func resourceAwsApiGatewayRestApiCreate(d *schema.ResourceData, meta interface{}
 		params.ApiKeySource = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("disable_execute_api_endpoint"); ok {
+		params.DisableExecuteApiEndpoint = aws.Bool(v.(bool))
+	}
+
 	if v, ok := d.GetOk("policy"); ok {
 		params.Policy = aws.String(v.(string))
 	}
@@ -241,6 +251,7 @@ func resourceAwsApiGatewayRestApiRead(d *schema.ResourceData, meta interface{})
 	d.Set("name", api.Name)
 	d.Set("description", api.Description)
 	d.Set("api_key_source", api.ApiKeySource)
+	d.Set("disable_execute_api_endpoint", api.DisableExecuteApiEndpoint)
 
 	// The API returns policy as an escaped JSON string
 	// {\\\"Version\\\":\\\"2012-10-17\\\",...}
@@ -324,6 +335,15 @@ func resourceAwsApiGatewayRestApiUpdateOperations(d *schema.ResourceData) []*api
 		})
 	}
 
+	if d.HasChange("disable_execute_api_endpoint") {
+		value := strconv.FormatBool(d.Get("disable_execute_api_endpoint").(bool))
+		operations = append(operations, &apigateway.PatchOperation{
+			Op:    aws.String(apigateway.OpReplace),
+			Path:  aws.String("/disableExecuteApiEndpoint"),
+			Value: aws.String(value),
+		})
+	}
+
 	if d.HasChange("policy") {
 		operations = append(operations, &apigateway.PatchOperation{
 			Op:    aws.String(apigateway.OpReplace),

aws/resource_aws_api_gateway_rest_api_test.go

@@ -84,6 +84,7 @@ func TestAccAWSAPIGatewayRestApi_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "api_key_source", "HEADER"),
+					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", `false`),
 					resource.TestCheckResourceAttr(resourceName, "minimum_compression_size", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_arn"),
@@ -106,6 +107,7 @@ func TestAccAWSAPIGatewayRestApi_basic(t *testing.T) {
 					testAccCheckAWSAPIGatewayRestAPIMinimumCompressionSizeAttribute(&conf, 10485760),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
+					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", `false`),
 					resource.TestCheckResourceAttr(resourceName, "minimum_compression_size", "10485760"),
 					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_arn"),
@@ -437,6 +439,42 @@ func TestAccAWSAPIGatewayRestApi_api_key_source(t *testing.T) {
 	})
 }
 
+func TestAccAWSAPIGatewayRestApi_disable_execute_api_endpoint(t *testing.T) {
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_api_gateway_rest_api.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccAPIGatewayTypeEDGEPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSAPIGatewayRestAPIDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSAPIGatewayRestAPIConfig_DisableExecuteApiEndpoint(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", `false`),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccAWSAPIGatewayRestAPIConfig_DisableExecuteApiEndpoint(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", `true`),
+				),
+			},
+			{
+				Config: testAccAWSAPIGatewayRestAPIConfig_DisableExecuteApiEndpoint(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", `false`),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSAPIGatewayRestApi_policy(t *testing.T) {
 	resourceName := "aws_api_gateway_rest_api.test"
 	expectedPolicyText := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"execute-api:Invoke","Resource":"*","Condition":{"IpAddress":{"aws:SourceIp":"123.123.123.123/32"}}}]}`
@@ -704,6 +742,15 @@ resource "aws_api_gateway_rest_api" "test" {
 `, rName, endpointType)
 }
 
+func testAccAWSAPIGatewayRestAPIConfig_DisableExecuteApiEndpoint(rName string, disabled bool) string {
+	return fmt.Sprintf(`
+resource "aws_api_gateway_rest_api" "test" {
+  name                         = "%s"
+  disable_execute_api_endpoint = %t
+}
+`, rName, disabled)
+}
+
 func testAccAWSAPIGatewayRestAPIConfig_Name(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_api_gateway_rest_api" "test" {

website/docs/r/api_gateway_rest_api.html.markdown

@@ -48,6 +48,7 @@ The following arguments are supported:
 * `parameters` - (Optional) Map of customizations for importing the specification in the `body` argument. For example, to exclude DocumentationParts from an imported API, set `ignore` equal to `documentation`. Additional documentation, including other parameters such as `basepath`, can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html).
 * `policy` - (Optional) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Terraform will only perform drift detection of its value when present in a configuration. It is recommended to use the [`aws_api_gateway_rest_api_policy` resource](/docs/providers/aws/r/api_gateway_rest_api_policy.html) instead.
 * `api_key_source` - (Optional) The source of the API key for requests. Valid values are HEADER (default) and AUTHORIZER.
+* `disable_execute_api_endpoint` - (Optional) Specifies whether clients can invoke your API by using the default execute-api endpoint. By default, clients can invoke your API with the default https://{api_id}.execute-api.{region}.amazonaws.com endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. Defaults to `false`.
 * `tags` - (Optional) Key-value map of resource tags
 
 __Note__: If the `body` argument is provided, the OpenAPI specification will be used to configure the resources, methods and integrations for the Rest API. If this argument is provided, the following resources should not be managed as separate ones, as updates may cause manual resource updates to be overwritten: