[Bug]: multiple aws_servicecatalog_provisioning_artifacts can't be created in parallel

[DaniDipp]

Terraform Core Version

1.8.3

AWS Provider Version

5.53.0

Affected Resource(s)

• aws_servicecatalog_provisioning_artifact

Expected Behavior

All provisioning artifacts get created.

Actual Behavior

Terraform performs CreateProvisioningArtifacts and receives an artifact id and info that it's status is still CREATING, but trying to lookup the status of all but the first artifact later results in ResourceNotFoundException. Only the first artifact gets created.

Relevant Error/Panic Output Snippet

~/tftest$ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_servicecatalog_portfolio.portfolio will be created
  + resource "aws_servicecatalog_portfolio" "portfolio" {
      + arn           = (known after apply)
      + created_time  = (known after apply)
      + description   = (known after apply)
      + id            = (known after apply)
      + name          = "Test Portfolio"
      + provider_name = "Provider"
      + tags_all      = (known after apply)
    }

  # aws_servicecatalog_product.product will be created
  + resource "aws_servicecatalog_product" "product" {
      + accept_language     = "en"
      + arn                 = (known after apply)
      + created_time        = (known after apply)
      + description         = (known after apply)
      + distributor         = (known after apply)
      + has_default_path    = (known after apply)
      + id                  = (known after apply)
      + name                = "Test Product"
      + owner               = "Owner"
      + status              = (known after apply)
      + support_description = (known after apply)
      + support_email       = (known after apply)
      + support_url         = (known after apply)
      + tags_all            = (known after apply)
      + type                = "CLOUD_FORMATION_TEMPLATE"

      + provisioning_artifact_parameters {
          + description                 = "DO NOT DEPLOY - dummy version"
          + disable_template_validation = true
          + name                        = "-"
          + template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
          + type                        = "CLOUD_FORMATION_TEMPLATE"
        }
    }

  # aws_servicecatalog_product_portfolio_association.association will be created
  + resource "aws_servicecatalog_product_portfolio_association" "association" {
      + accept_language = "en"
      + id              = (known after apply)
      + portfolio_id    = (known after apply)
      + product_id      = (known after apply)
    }

  # aws_servicecatalog_provisioning_artifact.artifact1 will be created
  + resource "aws_servicecatalog_provisioning_artifact" "artifact1" {
      + accept_language             = "en"
      + active                      = true
      + created_time                = (known after apply)
      + description                 = (known after apply)
      + disable_template_validation = true
      + guidance                    = "DEFAULT"
      + id                          = (known after apply)
      + name                        = "v1.0"
      + product_id                  = (known after apply)
      + provisioning_artifact_id    = (known after apply)
      + template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
      + type                        = "CLOUD_FORMATION_TEMPLATE"
    }

  # aws_servicecatalog_provisioning_artifact.artifact2 will be created
  + resource "aws_servicecatalog_provisioning_artifact" "artifact2" {
      + accept_language             = "en"
      + active                      = true
      + created_time                = (known after apply)
      + description                 = (known after apply)
      + disable_template_validation = true
      + guidance                    = "DEFAULT"
      + id                          = (known after apply)
      + name                        = "v2.0"
      + product_id                  = (known after apply)
      + provisioning_artifact_id    = (known after apply)
      + template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
      + type                        = "CLOUD_FORMATION_TEMPLATE"
    }

  # aws_servicecatalog_provisioning_artifact.artifact3 will be created
  + resource "aws_servicecatalog_provisioning_artifact" "artifact3" {
      + accept_language             = "en"
      + active                      = true
      + created_time                = (known after apply)
      + description                 = (known after apply)
      + disable_template_validation = true
      + guidance                    = "DEFAULT"
      + id                          = (known after apply)
      + name                        = "v3.0"
      + product_id                  = (known after apply)
      + provisioning_artifact_id    = (known after apply)
      + template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
      + type                        = "CLOUD_FORMATION_TEMPLATE"
    }

Plan: 6 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_servicecatalog_portfolio.portfolio: Creating...
aws_servicecatalog_product.product: Creating...
aws_servicecatalog_portfolio.portfolio: Creation complete after 1s [id=port-wmp45cm6o6ycm]
aws_servicecatalog_product.product: Creation complete after 5s [id=prod-5e7lmniwwc7gu]
aws_servicecatalog_product_portfolio_association.association: Creating...
aws_servicecatalog_provisioning_artifact.artifact3: Creating...
aws_servicecatalog_provisioning_artifact.artifact2: Creating...
aws_servicecatalog_provisioning_artifact.artifact1: Creating...
aws_servicecatalog_product_portfolio_association.association: Creation complete after 3s [id=en:port-wmp45cm6o6ycm:prod-5e7lmniwwc7gu]
aws_servicecatalog_provisioning_artifact.artifact3: Creation complete after 5s [id=pa-pcq4qsadzcues:prod-5e7lmniwwc7gu]
╷
│ Error: updating Service Catalog Provisioning Artifact (pa-kjaawyuhsvm6m:prod-5e7lmniwwc7gu): ResourceNotFoundException: ProvisioningArtifact pa-kjaawyuhsvm6m not found.
│ 
│   with aws_servicecatalog_provisioning_artifact.artifact1,
│   on main.tf line 31, in resource "aws_servicecatalog_provisioning_artifact" "artifact1":
│   31: resource "aws_servicecatalog_provisioning_artifact" "artifact1" {
│ 
╵
╷
│ Error: updating Service Catalog Provisioning Artifact (pa-n7rnwxrb2crf6:prod-5e7lmniwwc7gu): ResourceNotFoundException: ProvisioningArtifact pa-n7rnwxrb2crf6 not found.
│ 
│   with aws_servicecatalog_provisioning_artifact.artifact2,
│   on main.tf line 38, in resource "aws_servicecatalog_provisioning_artifact" "artifact2":
│   38: resource "aws_servicecatalog_provisioning_artifact" "artifact2" {
│ 
╵

Terraform Configuration Files

# main.tf
terraform {
  required_version = ">= 1.8.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.53.0"
    }
  }
}

resource "aws_servicecatalog_portfolio" "portfolio" {
  name          = "Test Portfolio"
  provider_name = "Provider"
}

resource "aws_servicecatalog_product" "product" {
  name  = "Test Product"
  owner = "Owner"
  type  = "CLOUD_FORMATION_TEMPLATE"

  provisioning_artifact_parameters {
    name                        = "-"
    type                        = "CLOUD_FORMATION_TEMPLATE"
    description                 = "DO NOT DEPLOY - dummy version can't be deactivated"
    template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
    disable_template_validation = true
  }
}

resource "aws_servicecatalog_provisioning_artifact" "artifact1" {
  product_id                  = aws_servicecatalog_product.product.id
  name                        = "v1.0"
  type                        = "CLOUD_FORMATION_TEMPLATE"
  template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
  disable_template_validation = true
}
resource "aws_servicecatalog_provisioning_artifact" "artifact2" {
  product_id                  = aws_servicecatalog_product.product.id
  name                        = "v2.0"
  type                        = "CLOUD_FORMATION_TEMPLATE"
  template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
  disable_template_validation = true
}
resource "aws_servicecatalog_provisioning_artifact" "artifact3" {
  product_id                  = aws_servicecatalog_product.product.id
  name                        = "v3.0"
  type                        = "CLOUD_FORMATION_TEMPLATE"
  template_url                = "https://awsdocs.s3.amazonaws.com/servicecatalog/development-environment.template"
  disable_template_validation = true
}

resource "aws_servicecatalog_product_portfolio_association" "association" {
  portfolio_id = aws_servicecatalog_portfolio.portfolio.id
  product_id   = aws_servicecatalog_product.product.id
}

Steps to Reproduce

1. paste above code into main.tf
2. terraform init
3. terraform apply, yes
4. observe at least one provisioning_artifact creation to fail

Debug Output

tf.log

Panic Output

No response

Important Factoids

• After terraform apply fails for two of the three artifacts, running it again twice is required for full deployment.
• The same bug happens for terraform destroy. Terraform is only able to delete one artifact at a time, running into a timeout for the deletion of all but one artifact.
• using parallelism=1 is a valid workaround for both apply and destroy

References

No response

Would you like to implement a fix?

No

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.