[Bug]: Can not destroy the cluster if SNS topic is not confirmed yet

[EugenKon]

Terraform Core Version

v1.7.4

AWS Provider Version

v5.41.0

Affected Resource(s)

• aws_sns_topic
• aws_sns_topic_policy
• aws_sns_topic_subscription
• aws_iam_policy_document

Expected Behavior

If SNS topic does not exists, then terraform should just remove resource from the state instead of failing.

Actual Behavior

I can not destroy cluster.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

data "aws_iam_policy_document" "notify-devops" {
  version   = "2012-10-17"
  policy_id = "__default_policy_ID"
  statement {
    sid = "__default_statement_ID"
    actions = [
      "SNS:GetTopicAttributes",
      "SNS:SetTopicAttributes",
      "SNS:AddPermission",
      "SNS:RemovePermission",
      "SNS:DeleteTopic",
      "SNS:Subscribe",
      "SNS:ListSubscriptionsByTopic",
      "SNS:Publish",
      "SNS:Receive"
    ]
    effect    = "Allow"
    resources = [aws_sns_topic.notify-devops.arn]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceOwner"

      values = [
        "${data.aws_caller_identity.current.account_id}"
      ]
    }

    principals {
      identifiers = ["*"]
      type        = "AWS"
    }
  }
}

...
resource "aws_sns_topic" "notify-devops" {
  name = "${var.project_name}-notify-devops"
}

resource "aws_sns_topic_policy" "notify-devops" {
  arn    = aws_sns_topic.notify-devops.arn
  policy = data.aws_iam_policy_document.notify-devops.json
}

resource "aws_sns_topic_subscription" "notify-devops" {
  topic_arn                       = aws_sns_topic.notify-devops.arn
  protocol                        = "email"
  endpoint                        = "xxxx@xxxx"
  confirmation_timeout_in_minutes = 1
  endpoint_auto_confirms          = false
}

Steps to Reproduce

In my case some error happened on other step. I suppose SNS topic already was deleted. And when I rerun destroy again the terraform failed when tried to remove SNS topic second time.

So steps to reproduce

1. Create SNS topic
2. Create other resource
3. Try to destroy cluster, but change it in a way the terraform fail after deleted SNS topic, eg. SNS topic is deleted but fail on other resource.
4. Fix the problem, try to destroy cluster again to remove resources
5. At this point terraform will try to delete SNS topic second time and fail. And will not try to delete resource which was created on step (2), because of earlier error.

Debug Output

╷
│ Error: reading SNS Topic (arn:aws:sns:us-east-2:315400321086:stg-enterprise-notify-devops): operation error SNS: GetTopicAttributes, https response error StatusCode: 400, RequestID: b8d7e0c7-8c1b-567f-8944-beb37666cb92, InvalidParameter: Invalid parameter: TopicArn
│
│ with module.private-cloud.aws_sns_topic.notify-devops,
│ on modules/private-cloud/sns.tf line 176, in resource "aws_sns_topic" "notify-devops":
│ 176: resource "aws_sns_topic" "notify-devops" {
│
╵

Panic Output

No response

Important Factoids

No response

References

https://github.com/hashicorp/terraform/issues/34868

Would you like to implement a fix?

None

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.