resource/aws_ssm_parameter: Enable to change type from SecureString t…

…o String (#9843) (#10819)

Output from acceptance testing:

```
--- PASS: TestAccAWSSSMParameter_disappears (14.20s)
--- PASS: TestAccAWSSSMParameter_fullPath (20.62s)
--- PASS: TestAccAWSSSMParameter_secure (21.53s)
--- PASS: TestAccAWSSSMParameter_basic (21.98s)
--- PASS: TestAccAWSSSMParameter_updateDescription (34.06s)
--- PASS: TestAccAWSSSMParameter_changeNameForcesNew (34.44s)
--- PASS: TestAccAWSSSMParameter_updateType (35.23s)
--- PASS: TestAccAWSSSMParameter_overwrite (36.26s)
--- PASS: TestAccAWSSSMParameter_Tier (46.00s)
--- PASS: TestAccAWSSSMParameter_tags (48.53s)
--- PASS: TestAccAWSSSMParameter_secure_with_key (51.77s)
--- PASS: TestAccAWSSSMParameter_secure_keyUpdate (69.76s)
```

aws/resource_aws_ssm_parameter.go

@@ -214,7 +214,7 @@ func resourceAwsSsmParameterPut(d *schema.ResourceData, meta interface{}) error
 		paramInput.Description = aws.String(n.(string))
 	}
 
-	if keyID, ok := d.GetOk("key_id"); ok {
+	if keyID, ok := d.GetOk("key_id"); d.Get("type") == "SecureString" && ok {
 		log.Printf("[DEBUG] Setting key_id for SSM Parameter %v: %s", d.Get("name"), keyID)
 		paramInput.SetKeyId(keyID.(string))
 	}

aws/resource_aws_ssm_parameter_test.go

@@ -182,6 +182,36 @@ func TestAccAWSSSMParameter_tags(t *testing.T) {
 	})
 }
 
+func TestAccAWSSSMParameter_updateType(t *testing.T) {
+	var param ssm.Parameter
+	name := fmt.Sprintf("%s_%s", t.Name(), acctest.RandString(10))
+	resourceName := "aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSSSMParameterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSSMParameterBasicConfig(name, "SecureString", "test2"),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"overwrite"},
+			},
+			{
+				Config: testAccAWSSSMParameterBasicConfigTypeUpdated(name, "String", "test2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSSSMParameterExists(resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSSSMParameter_updateDescription(t *testing.T) {
 	var param ssm.Parameter
 	name := fmt.Sprintf("%s_%s", t.Name(), acctest.RandString(10))
@@ -508,6 +538,20 @@ resource "aws_ssm_parameter" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
+func testAccAWSSSMParameterBasicConfigTypeUpdated(rName, pType, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name  = "%s"
+  type  = "%s"
+  value = "%s"
+
+  tags = {
+    Name = "My Parameter"
+  }
+}
+`, rName, pType, value)
+}
+
 func testAccAWSSSMParameterBasicConfigOverwrite(rName, pType, value string) string {
 	return fmt.Sprintf(`
 resource "aws_ssm_parameter" "test" {