cloudposse / terraform-aws-ssm-parameter-store

Terraform module to populate AWS Systems Manager (SSM) Parameter Store with values from Terraform. Works great with Chamber.
https://cloudposse.com/accelerate
Apache License 2.0
109 stars 60 forks source link

`ignore_value_changes` doesn't ignore external value changes #47

Closed mkozjak closed 1 year ago

mkozjak commented 1 year ago

Describe the Bug

ignore_value_changes doesn't seem to work. It still wants to change an externally-modified SSM parameter.

Expected Behavior

To ignore external value changes.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Add this code:

    module "gameserver_config" {
    source  = "cloudposse/ssm-parameter-store/aws"
    version = "0.10.0"
    
    parameter_write = [
    {
      name = "SOME_API_KEY"
      value = "1"
      type = "SecureString"
      ignore_value_changes = true
    }
    ]
    }
  2. Run terraform apply.
  3. Go to AWS SSM Parameter Store and change the value of SOME_API_KEY.
  4. Run terraform plan.

Logs

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.gameserver_config.aws_ssm_parameter.default["SOME_API_KEY"] will be updated in-place
  ~ resource "aws_ssm_parameter" "default" {
        id             = "SOME_API_KEY"
      + insecure_value = (known after apply)
        name           = "SOME_API_KEY"
        tags           = {}
      ~ value          = (sensitive value)
      ~ version        = 2 -> (known after apply)
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Environment (please complete the following information):

adam-goodall commented 1 year ago

I think your code is wrong. I suspect it should be:

module "gameserver_config" {
  source  = "cloudposse/ssm-parameter-store/aws"
  version = "0.10.0"

  parameter_write = [
    {
      name = "SOME_API_KEY"
      value = "1"
      type = "SecureString"
    }
  ]
  ignore_value_changes = true
}