search

hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.84k stars 9.19k forks source link

[Bug]: aws_dynamodb_table server_side_encryption disabled with replicas causing ValidationException #31153

Closed joshmyers closed 2 months ago

joshmyers commented 1 year ago

Terraform Core Version

1.3.2

AWS Provider Version

4.62.0

Affected Resource(s)

aws_dynamodb_table

Expected Behavior

Changing from the default alias/aws/dynamodb SSE config by changing the below attribute to enabled = false should remove the AWS managed key encryption and instead end up with the default Managed by DynamoDB encryption setting[1]

server_side_encryption {
  enabled     = true
  kms_key_arn = null
}

[1] image

Actual Behavior

The table failed to update and throws a validation exception.

Relevant Error/Panic Output Snippet

│ Error: updating DynamoDB Table (BADGERS) SSE: ValidationException: 4 validation errors detected: Value '' at 'replicaUpdates.1.member.update.kMSMasterKeyId' failed to satisfy constraint: Member must have length greater than or equal to 1; Value '' at 'replicaUpdates.2.member.update.kMSMasterKeyId' failed to satisfy constraint: Member must have length greater than or equal to 1; Value '' at 'replicaUpdates.3.member.update.kMSMasterKeyId' failed to satisfy constraint: Member must have length greater than or equal to 1; Value '' at 'replicaUpdates.4.member.update.kMSMasterKeyId' failed to satisfy constraint: Member must have length greater than or equal to 1

Terraform Configuration Files

resource "aws_dynamodb_table" "default" {
  name         = "badgers"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  replica {
    region_name            = "us-east-2"
    propagate_tags         = true
    point_in_time_recovery = false
  }

  replica {
    region_name            = "us-west-2"
    propagate_tags         = true
    point_in_time_recovery = false
  }

  attribute {
    name = "id"
    type = "S"
  }

  attribute {
    name = "badgerToId"
    type = "S"
  }

  server_side_encryption {
    enabled     = true
    kms_key_arn = null
  }
}

Steps to Reproduce

Debug Output

2023-05-04T13:12:57.070+0100 [DEBUG] provider.terraform-provider-aws_v4.62.0_x5: HTTP Request Sent: aws.service=DynamoDB @caller=github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2@v2.0.0-beta.26/logger.go:90 tf_rpc=ApplyResourceChange tf_provider_addr=registry.terraform.io/hashicorp/aws http.request.header.authorization="AWS4-HMAC-SHA256 Credential=ASIA************IRZJ/20230504/us-east-1/dynamodb/aws4_request, SignedHeaders=accept-encoding;content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=*****" tf_req_id=3beddffc-1844-b730-bbf5-25cc4b510b66 http.method=POST aws.sdk=aws-sdk-go http.request.header.x_amz_target=DynamoDB_20120810.UpdateTable http.request.header.x_amz_date=20230504T121257Z http.url=https://dynamodb.us-east-1.amazonaws.com/ net.peer.name=dynamodb.us-east-1.amazonaws.com @module=aws aws.region=us-east-1 http.request.body={"ReplicaUpdates":[{"Update":{"KMSMasterKeyId":"","RegionName":"eu-west-1"}},{"Update":{"KMSMasterKeyId":"","RegionName":"us-east-2"}},{"Update":{"KMSMasterKeyId":"","RegionName":"eu-central-1"}},{"Update":{"KMSMasterKeyId":"","RegionName":"us-west-2"}},{"Update":{"RegionName":"us-east-1"}}],"TableName":"badgers"} tf_resource_type=aws_dynamodb_table http.request.header.accept_encoding=identity http.request.header.content_type=application/x-amz-json-1.0 http.request_content_length=341 tf_mux_provider=*schema.GRPCProviderServer http.flavor=1.1 http.request.header.x_amz_security_token=***** http.user_agent="APN/1.0 HashiCorp/1.0 Terraform/1.3.2 (+https://www.terraform.io) terraform-provider-aws/4.62.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.237 (go1.19.7; linux; amd64)" aws.operation=UpdateTable timestamp=2023-05-04T13:12:57.070+0100

Panic Output

No response

Important Factoids

No response

References

https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/dynamodb/table.go#L929-L932

It looks to me that an unneeded (in my case at least) update is pushed to the replicas, which fails because KMS key is empty as can be seen in the debug output.

Would you like to implement a fix?

https://github.com/hashicorp/terraform-provider-aws/pull/31284

github-actions[bot] commented 1 year ago

Community Note

Voting for Prioritization

Volunteering to Work on This Issue

github-actions[bot] commented 2 months ago

[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

github-actions[bot] commented 2 months ago

[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

github-actions[bot] commented 1 month ago

This functionality has been released in v5.68.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions[bot] commented 3 weeks ago

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.