search

hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.83k stars 9.17k forks source link

[Bug]: Cannot create or modify KMS key with tf 1.3.6 and provider 4.46.0 #28390

Open ghost opened 1 year ago

ghost commented 1 year ago

Terraform Core Version

1.3.6

AWS Provider Version

4.46.0

Affected Resource(s)

 Error: error waiting for KMS Key (79003f4d-xxxxxxxxx7) policy propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 5m0s)
│

Expected Behavior

Create the key

Actual Behavior

Errors, but I see the key created in the console.

Relevant Error/Panic Output Snippet

see https://github.com/hashicorp/terraform-provider-aws/issues/27641

Terraform Configuration Files

See https://github.com/hashicorp/terraform-provider-aws/issues/27641

Steps to Reproduce

see https://github.com/hashicorp/terraform-provider-aws/issues/27641

Debug Output

see https://github.com/hashicorp/terraform-provider-aws/issues/27641

Panic Output

No response

Important Factoids

This is a huge blocker for us

References

No response

Would you like to implement a fix?

None

github-actions[bot] commented 1 year ago

Community Note

Voting for Prioritization

Volunteering to Work on This Issue

rajattrikha commented 1 year ago

I am facing the same issue with terraform version 1.3.7 and AWS Provider version 4.5

mjryan253 commented 1 year ago

Also having this same issue with terraform 1.3.6 and AWS provider 4.50.0

joeybenamy commented 1 year ago

Same issue. Terraform 1.3.9, AWS provider 4.48.0

dr-yd commented 1 year ago

Same, with 1.3.9 and provider 4.55.0. Strangely, it's just for one key, and we have a lot of them across a lot of projects, all deployed via the same module. Granted, though, it's a fairly complicated key policy because it manages access to our central Terraform state bucket CMK (of all things)...

In the console, the individual elements of the policy switch places over and over while Terraform is deploying, so it seems to have to do with sorting - although that might just be a normal behavior that usually doesn't matter and is ignored because it has no effect.

The policy is updated in the end, but Terraform never considers the deployment finished and attempts to update it again on the next run. Removing and reimporting the key does not help - Terraform attempts to update it again immediately after importing.

dr-yd commented 1 year ago

For me, the issue is solved. An arn:aws:sts::<account>:role/role-name ARN instead of arn:aws:iam:: had slipped into there - AWS apparently accepts these as equivalent and converts them to arn:aws:iam:: ARNs. Not sure if that's well-defined behavior and if the provider should take it into account.

marcofranssen commented 1 year ago

Facing same issue.

We are using the https://github.com/terraform-aws-modules/terraform-aws-eks module.

This module in turn uses the https://github.com/terraform-aws-modules/terraform-aws-kms module.

In the console of my AWS account I see the KMS key is there and the key also has the policy applied as defined by the terraform module.

Still terraform fails with every single apply. Also for us this is a big blocker as all our CI/CD pipelines are failing.

See here how we use the module

  kms_key_deletion_window_in_days = 7
  kms_key_owners                  = var.kms_key_owners
  kms_key_administrators          = var.kms_key_administrators

Both variables are used with roles.

marcofranssen commented 1 year ago

Facing same issue.

We are using the https://github.com/terraform-aws-modules/terraform-aws-eks module.

This module in turn uses the https://github.com/terraform-aws-modules/terraform-aws-kms module.

In the console of my AWS account I see the KMS key is there and the key also has the policy applied as defined by the terraform module.

Still terraform fails with every single apply. Also for us this is a big blocker as all our CI/CD pipelines are failing.

See here how we use the module

  kms_key_deletion_window_in_days = 7
  kms_key_owners                  = var.kms_key_owners
  kms_key_administrators          = var.kms_key_administrators

Both variables are used with roles.

marcofranssen commented 1 year ago

Facing same issue.

We are using the https://github.com/terraform-aws-modules/terraform-aws-eks module.

This module in turn uses the https://github.com/terraform-aws-modules/terraform-aws-kms module.

In the console of my AWS account I see the KMS key is there and the key also has the policy applied as defined by the terraform module.

Still terraform fails with every single apply. Also for us this is a big blocker as all our CI/CD pipelines are failing.

See here how we use the module

  kms_key_deletion_window_in_days = 7
  kms_key_owners                  = var.kms_key_owners
  kms_key_administrators          = var.kms_key_administrators

Both variables are used with roles.