Open joshlang opened 7 months ago
Voting for Prioritization
Volunteering to Work on This Issue
Hey @joshlang 👋 Thank you for taking the time to raise this. I took a quick look and noted that this resource hasn't changed (at least directly) in a while. You mentioned that this didn't happen with previous versions. If you test with 5.32.0, do you see the same behavior now?
I noticed in the logs that you provided that the recreation is happening due to a change in username_configuration.case_sensitive
, but that you're not defining that block in the same configuration you provided. Is there a possibility that the case_sensitive
setting is being changed outside of Terraform?
If you're able to supply them, debug logging may help whoever ultimately picks up this issue to investigate it further.
Hello,
We are noticing the exact same behaviour on the 4.25.0 version. We didn't do any change on our side. In our case, it's only happening in the ca-central-1 region. us-east-1 and ap-southeast-2 are not affected, for the exact same configuration.
I’m away from computer but can assure you no changes are made outside terraform and the issue did not occur on any previous provider version
From: Justin Retzolk @.> Sent: Friday, January 19, 2024 9:52:51 AM To: hashicorp/terraform-provider-aws @.> Cc: Josh Lang @.>; Mention @.> Subject: Re: [hashicorp/terraform-provider-aws] [Bug]: Cognito user pools recreated (ie: nuked) after using aws provider v5.33.0 (Issue #35401)
Hey @joshlanghttps://github.com/joshlang 👋 Thank you for taking the time to raise this. I took a quick look and noted that this resource hasn't changed (at least directly) in a while. You mentioned that this didn't happen with previous versions. If you test with 5.32.0, do you see the same behavior now?
I noticed in the logs that you provided that the recreation is happening due to a change in username_configuration.case_sensitive, but that you're not defining that block in the same configuration you provided. Is there a possibility that the case_sensitive setting is being changed outside of Terraform?
If you're able to supply them, debug logging may help whoever ultimately picks up this issue to investigate it further.
— Reply to this email directly, view it on GitHubhttps://github.com/hashicorp/terraform-provider-aws/issues/35401#issuecomment-1900844021, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AJPOJSDM3IGRY3BAVWC2DDLYPKXHHAVCNFSM6AAAAABCCIPSYKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBQHA2DIMBSGE. You are receiving this because you were mentioned.Message ID: @.***>
We are using ca central 1 as well
From: Adrien Kühn @.> Sent: Friday, January 19, 2024 9:57:20 AM To: hashicorp/terraform-provider-aws @.> Cc: Josh Lang @.>; Mention @.> Subject: Re: [hashicorp/terraform-provider-aws] [Bug]: Cognito user pools recreated (ie: nuked) after using aws provider v5.33.0 (Issue #35401)
Hello,
We are noticing the exact same behaviour on the 4.25.0 version. We didn't do any change on our side. In our case, it's only happening in the ca-central-1 region, us-east-1 and ap-southeast-2 are not affected, for the exact same configuration.
— Reply to this email directly, view it on GitHubhttps://github.com/hashicorp/terraform-provider-aws/issues/35401#issuecomment-1900849545, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AJPOJSDEVB27XVRXQWHYZ6LYPKXYBAVCNFSM6AAAAABCCIPSYKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBQHA2DSNJUGU. You are receiving this because you were mentioned.Message ID: @.***>
Also, this problem also occurs on a repo with a cognito user pool block that’s completely empty other than providing a name.
From: Justin Retzolk @.> Sent: Friday, January 19, 2024 9:52:51 AM To: hashicorp/terraform-provider-aws @.> Cc: Josh Lang @.>; Mention @.> Subject: Re: [hashicorp/terraform-provider-aws] [Bug]: Cognito user pools recreated (ie: nuked) after using aws provider v5.33.0 (Issue #35401)
Hey @joshlanghttps://github.com/joshlang 👋 Thank you for taking the time to raise this. I took a quick look and noted that this resource hasn't changed (at least directly) in a while. You mentioned that this didn't happen with previous versions. If you test with 5.32.0, do you see the same behavior now?
I noticed in the logs that you provided that the recreation is happening due to a change in username_configuration.case_sensitive, but that you're not defining that block in the same configuration you provided. Is there a possibility that the case_sensitive setting is being changed outside of Terraform?
If you're able to supply them, debug logging may help whoever ultimately picks up this issue to investigate it further.
— Reply to this email directly, view it on GitHubhttps://github.com/hashicorp/terraform-provider-aws/issues/35401#issuecomment-1900844021, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AJPOJSDM3IGRY3BAVWC2DDLYPKXHHAVCNFSM6AAAAABCCIPSYKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMBQHA2DIMBSGE. You are receiving this because you were mentioned.Message ID: @.***>
Had this problem yesterday,
Terraform version was 1.4.6, but we had deletion protection enabled, but the logs showed nothing under planned except for cognito user pool had to be deleted.
We updated our Terraform version to 1.7.0 suddenly the output of the plan was more detailed and contained the reasoning of why the deletion was planned. And showed a discrepancy of needing the user_name_configuration. And this missing configuration was what was prompting TF to plan a recreation event.
Updating our original resource to include username_configuration{ case_sensitive = true }
Resolved the issue.
The logs were impossible to understand until we upgraded our terraform version
We also tried to add
username_configuration {
case_sensitive = true
}
to the user pool. While it fixes the issue in ca-central-1, it will cause user pools in other regions to be recreated with
+ username_configuration {
+ case_sensitive = true # forces replacement
}
resource "aws_cognito_user_pool" "pool_ca" {
provider = aws.ca
name = "mypool"
}
resource "aws_cognito_user_pool" "pool_us" {
provider = aws.us
name = "mypool"
}
provider "aws" {
alias = "ca"
region = "ca-central-1"
}
provider "aws" {
alias = "us"
region = "us-east-1"
}
terraform apply
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_cognito_user_pool.pool_ca will be created
+ resource "aws_cognito_user_pool" "pool_ca" {
+ arn = (known after apply)
+ creation_date = (known after apply)
+ custom_domain = (known after apply)
+ deletion_protection = "INACTIVE"
+ domain = (known after apply)
+ email_verification_message = (known after apply)
+ email_verification_subject = (known after apply)
+ endpoint = (known after apply)
+ estimated_number_of_users = (known after apply)
+ id = (known after apply)
+ last_modified_date = (known after apply)
+ mfa_configuration = "OFF"
+ name = "mypool"
+ sms_verification_message = (known after apply)
+ tags_all = (known after apply)
}
# aws_cognito_user_pool.pool_us will be created
+ resource "aws_cognito_user_pool" "pool_us" {
+ arn = (known after apply)
+ creation_date = (known after apply)
+ custom_domain = (known after apply)
+ deletion_protection = "INACTIVE"
+ domain = (known after apply)
+ email_verification_message = (known after apply)
+ email_verification_subject = (known after apply)
+ endpoint = (known after apply)
+ estimated_number_of_users = (known after apply)
+ id = (known after apply)
+ last_modified_date = (known after apply)
+ mfa_configuration = "OFF"
+ name = "mypool"
+ sms_verification_message = (known after apply)
+ tags_all = (known after apply)
}
Plan: 2 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
aws_cognito_user_pool.pool_ca: Creating...
aws_cognito_user_pool.pool_us: Creating...
aws_cognito_user_pool.pool_ca: Creation complete after 1s [id=ca-central-1_xxxxxxxxx]
aws_cognito_user_pool.pool_us: Creation complete after 1s [id=us-east-1_xxxxxxxxx]
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
terraform plan
aws_cognito_user_pool.pool_ca: Refreshing state... [id=ca-central-1_xxxxxxxxx]
aws_cognito_user_pool.pool_us: Refreshing state... [id=us-east-1_xxxxxxxxx]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_cognito_user_pool.pool_ca must be replaced
-/+ resource "aws_cognito_user_pool" "pool_ca" {
~ arn = "arn:aws:cognito-idp:ca-central-1:123456789012:userpool/ca-central-1_xxxxxxxxx" -> (known after apply)
# [...]
- username_configuration {
- case_sensitive = true -> null # forces replacement
}
}
Plan: 1 to add, 0 to change, 1 to destroy.
Adding
username_configuration {
case_sensitive = true
}
to both pools
terraform plan
aws_cognito_user_pool.pool_ca: Refreshing state... [id=ca-central-1_xxxxxxxxx]
aws_cognito_user_pool.pool_us: Refreshing state... [id=us-east-1_xxxxxxxxx]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_cognito_user_pool.pool_us must be replaced
-/+ resource "aws_cognito_user_pool" "pool_us" {
~ arn = "arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_xxxxxxxxx" -> (known after apply)
# [...]
+ username_configuration {
+ case_sensitive = true # forces replacement
}
}
Plan: 1 to add, 0 to change, 1 to destroy.
I also noticed the AWS API is returning different info in ca-central-1 and us-east-1
aws cognito-idp describe-user-pool \
--user-pool-id ca-central-1_xxxxxxxxx \
--region ca-central-1 | jq .UserPool.UsernameConfiguration
{
"CaseSensitive": true
}
aws cognito-idp describe-user-pool \
--user-pool-id us-east-1_xxxxxxxxx \
--region us-east-1 | jq .UserPool.UsernameConfiguration
null
Is a fix incoming?
Or do you require us to update all our terraforms to specify username_configuration etc?
If a fix is incoming, any ETA?
It seems to be that if username_configuration { case_sensitive = ... }
is not specified in terraform, a solution might be to just "leave it alone"
I just executed a terraform plan, and I believe whatever they did for CA-CENTRAL-1 was reversed, because my plan is now showing me it requires replacement because of the additional username_configuration
A problem still exists whereby if you didn't define a username_configuration { } definition in the past, if you add any definition now - (regardless of whether it matches the existing settings in AWS) - terraform will force the cognito pool to be recreated anew.
Ben from Cognito here. The behavior in ca-central-1
that has been described was from a bug fix we were attempting to apply to provide the username_configuration
field in more API responses. We have since rolled the change back so behaviors across regions are now back to their previous state as has been noted. We are looking into resolving this issue with Terraform integration.
As for @devintuinstra's comment, yes this is currently the issue. Terraform does not recognize the "existing settings in AWS" when the default value is set.
Terraform Core Version
1.6.6
AWS Provider Version
5.33.0
Affected Resource(s)
aws_cognito_user_pool
Expected Behavior
Behavior matched previous terraform versions... User pool is NOT deleted & recreated
Actual Behavior
We lost our cognito user pool when 5.33.0 came out and the next pipeline executed.
Every pipeline execution, the user pool is recreated (even with zero changes)
Relevant Error/Panic Output Snippet
Terraform Configuration Files
Steps to Reproduce
terraform apply
Debug Output
No response
Panic Output
No response
Important Factoids
No response
References
No response
Would you like to implement a fix?
None