Open daytonpa opened 2 years ago
Hey @daytonpa π Thank you for taking the time to raise this! Would it be possible to supply (redacted as needed) debug logs as well? You mentioned some of the data cannot be shared, so if it is not possible, I understand.
Sure I'll see what I can populate for you
I encountered similar issue while using "aws_config_organization_conformance_pack" . Did anyone able to use this resource to create the conformance packs at org level?
I was able to get it working by using template_body instead of template_s3_uri. I guess I am doing something wrong with the way I am passing parameters to the template and pushing it to s3. I will review and repost here if I run into any additional issues. Thank you and sorry for any inconvenience.
I'm also encountering this error, even when using template_body
and not template_s3_uri
.
The CFT stack associated with the Conformance Pack has status CREATE_COMPLETE, but the terraform client continues to wait for completion.
Behavior is pretty inconsistent but it's a huge pain.
I am also getting an error Error: error waiting for Config Organization Conformance Pack (FedRAMP-conformance-pack) to be created: unexpected state 'UPDATE_IN_PROGRESS', wanted target 'CREATE_SUCCESSFUL'. last error: %!s(
Ive also run into this issue and given there is no way in the console to upload organization packs its means i have manual upload on an account\region basis.
Same issue here, organization_conformance_pack
creation is failing du to timeout:
waiting for ConfigService Organization Conformance Pack (meraj) create: timeout while waiting for state to become 'CREATE_SUCCESSFUL' (last state: 'CREATE_IN_PROGRESS', timeout: 10m0s)
I tried awscc provider and have a same result. https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/config_organization_conformance_pack
Community Note
Terraform CLI and Terraform AWS Provider Version
AND
Affected Resource(s)
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
** AWS CONFIG PACKS **
resource "aws_config_organization_conformance_pack" "cis" { name = "cis-conformance-pack" template_body = data.local_file.cis.content timeouts { create = "30m" update = "30m" delete = "10m" } } resource "aws_config_organization_conformance_pack" "operational" { name = "operational-best-practices-pack" template_body = data.local_file.operational.content timeouts { create = "30m" update = "30m" delete = "10m" } } resource "aws_config_organization_conformance_pack" "security" { name = "security-best-practices-pack" template_body = data.local_file.security.content timeouts { create = "30m" update = "30m" delete = "10m" } }
Expected Behavior
terraform apply
should complete when Conformance Packs are both CREATE_COMPLETE within the CloudFormation Console or API call, and when the AWS Config Console or API call shows a Conformance Pack as Deployment Successful.Actual Behavior
Terraform times out waiting for resource completion despite Terraform-managed resources actually completing. Terraform ran for 30 minutes awaiting a response, yet the corresponding CloudFormation Stack showing "CREATE_COMPLETE" within 7 minutes in the Cloudformation Console, and the Conformance Pack showing "Deployment Successful" in the AWS Config console.
As a result, Terraform considers the created resources tainted, and attempts to redeploy the Conformance Packs every
apply
.Steps to Reproduce
terraform apply
Important Factoids
The actual Conformance Pack YAMLs being used within the
data "local_file"
blocks are client-owned and cannot be shared.References
Food for Thought
Terraform is timing out awaiting a
"CREATE_SUCCESSFUL"
from the AWS Conformance Package CloudFormation Stack, but the finished message from CloudFormation is"CREATE_COMPLETE"
. What's the possibility that Terraform is looking for the wrong string?