clean up construction of tf string

vault/resource_aws_auth_backend_sts_role_test.go

@@ -6,6 +6,7 @@ package vault
 import (
 	"fmt"
 	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
@@ -165,30 +166,27 @@ func testAccAWSAuthBackendSTSRoleCheck_attrs(backend, accountID, stsRole string)
 }
 
 func testAccAWSAuthBackendSTSRoleConfig_basic(backend, accountID, stsRole, externalID string) string {
-	roleResource := fmt.Sprintf(`
-resource "vault_aws_auth_backend_sts_role" "role" {
-	backend = vault_auth_backend.aws.path
-	account_id = "%s"
-	sts_role = "%s"
-}
-`, accountID, stsRole)
+	backendResource := fmt.Sprintf(`
+resource "vault_auth_backend" "aws" {
+	type = "aws"
+	path = "%s"
+}`, backend)
 
+	roleResourceOptionalFields := ""
 	if externalID != "" {
-		roleResource = fmt.Sprintf(`
+		roleResourceOptionalFields += fmt.Sprintf(`
+	external_id = "%s"`, externalID)
+	}
+
+	roleResource := fmt.Sprintf(`
 resource "vault_aws_auth_backend_sts_role" "role" {
 	backend = vault_auth_backend.aws.path
 	account_id = "%s"
-	sts_role = "%s"
-	external_id = "%s"
+	sts_role = "%s"%s
 }
-`, accountID, stsRole, externalID)
-	}
+`, accountID, stsRole, roleResourceOptionalFields)
 
-	return fmt.Sprintf(`
-resource "vault_auth_backend" "aws" {
-  type = "aws"
-  path = "%s"
-}
-%s
-`, backend, roleResource)
+	resources := []string{backendResource, roleResource}
+
+	return strings.Join(resources, "\n")
 }