aws_backup_region_settings: Element present in resource type opt in preference has invalid values

ohmer commented 2 years ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I have a module which contains the following:

variable "resource_type_opt_in_preference" {
  type = map(bool)

  default = {
    "Aurora"          = true
    "DocumentDB"      = true
    "DynamoDB"        = true
    "EBS"             = true
    "EC2"             = true
    "EFS"             = true
    "FSx"             = false
    "Neptune"         = false
    "RDS"             = true
    "Storage Gateway" = false
  }
}

resource "aws_backup_region_settings" "this" {
  resource_type_opt_in_preference = var.resource_type_opt_in_preference
}

It is part of a baseline and I would like it to apply to any region. It fails to apply in us-west-1 with the error message below:

│ Error: error setting Backup Region Settings (us-west-1): InvalidParameterValueException: Element present in resource type opt in preference has invalid values. Please use describeRegionSettings API to know the supported resource types
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "<REDACTED>"
│   },
│   Code_: "ERROR_41007",
│   Message_: "Element present in resource type opt in preference has invalid values. Please use describeRegionSettings API to know the supported resource types"
│ }

I believe the root cause is the list of service differs by region:

$ aws backup describe-region-settings --region us-west-1
{
    "ResourceTypeOptInPreference": {
        "Aurora": true,
        "DynamoDB": true,
        "EBS": true,
        "EC2": true,
        "EFS": true,
        "FSx": true,
        "Neptune": false,
        "RDS": true,
        "Storage Gateway": true
    }
}

DocumentDB is not in us-west-1 but is in us-east-1

$ aws backup describe-region-settings --region us-east-1
{
    "ResourceTypeOptInPreference": {
        "Aurora": false,
        "DocumentDB": false,
        "DynamoDB": true,
        "EBS": true,
        "EC2": true,
        "EFS": true,
        "FSx": false,
        "Neptune": false,
        "RDS": true,
        "Storage Gateway": true
    }
}

New or Affected Resource(s)

aws_backup_region_settings

Potential Terraform Configuration

Not tested but probably something like that:

variable "resource_type_opt_in_preference" {
  type = map(bool)

  default = {
    "Aurora"          = true
    "DocumentDB"      = true
    "DynamoDB"        = true
    "EBS"             = true
    "EC2"             = true
    "EFS"             = true
    "FSx"             = false
    "Neptune"         = false
    "RDS"             = true
    "Storage Gateway" = false
  }
}

data "aws_backup_region_settings" "this" {}

resource "aws_backup_region_settings" "this" {
  resource_type_opt_in_preference = matchkeys(
      values(var.resource_type_opt_in_preference),
      keys(var.resource_type_opt_in_preference),
      keys(data.aws_backup_region_settings.this.resource_type_opt_in_preference)
    )
  }
}

References

13449

justinretzolk commented 2 years ago

Hey @ohmer 👋 Thank you for taking the time to file this issue. In looking into it, it seems this is an error message coming back from the AWS API itself, rather than a bug within the provider (I suspect you've already deduced this). Based on the "potential Terraform configuration" section, it looks like you're interested in a new data source that uses the describeRegionSettings API to determine the supported settings; is that accurate?

ohmer commented 2 years ago

Hey @justinretzolk ,

New data source, yes it is a suggestion. I thought that silently handling this inside the resource would be less ideal. What do you think?

snmason commented 1 year ago

Bumping as I am hitting the same issue. Has a work around been found?

lpiob commented 1 year ago

It seems that the available settings are different for different regions. For example Timestream at this moment can be set for eu-west-1 but not for eu-west-3.

Skipping this setting causes perpetual change to be displayed in eu-west-1. Including this setting causes an error on apply in eu-west-3.

or-shachar commented 1 year ago

I've started working on this feature that might at least answer the perpetual change issue. https://github.com/hashicorp/terraform-provider-aws/pull/33993

Unfortunately I'm not at capacity to get into the acceptance testing framework. If anyone would like to give me direction of missing pieces - would really appreciate it ✌️

hashicorp / terraform-provider-aws