[Enhancement]: aws_dynamodb_table import_table FAILED log improvements

Description

When an aws_dynamodb_table resource is created with the import_table option, but insufficient IAM permissions are set, the error that's displayed doesn't indicate the real reason for the failure (missing IAM permission).

Current output:

Error: creating AWS DynamoDB Table (<table_name>): unexpected state 'FAILED', wanted target 'COMPLETED'. last error: %!s(<nil>)

However, if the TF_LOG_PROVIDER environment variable is set to DEBUG, the missing permission is acknowledged:

<date>   http.response.body=
<date>   | {"ImportTableDescription":{...,"FailureMessage":"User: arn:aws:sts::123456789012:assumed-role/<role> is not authorized to perform: logs:CreateLogStream on resource: arn:aws:logs:eu-west-2:123456789012:log-group:/aws-dynamodb/imports:log-stream:<id>/info because no identity-based policy allows the logs:CreateLogStream action",...}}

Suggested output:

Error: creating AWS DynamoDB Table (<table_name>): FailureMessage is "<content from response.body>"

e.g.

Error: creating AWS DynamoDB Table (<table_name>): FailureMessage is "User: arn:aws:sts::123456789012:assumed-role/<role> is not authorized to perform: logs:CreateLogStream on resource: arn:aws:logs:eu-west-2:123456789012:log-group:/aws-dynamodb/imports:log-stream:<id>/info because no identity-based policy allows the logs:CreateLogStream action"

[!TIP] If you log into the AWS Console and view the import DynamoDB → Imports from S3 → \<select import> it does show the IAM permission failure reason.

Affected Resource(s) and/or Data Source(s)

aws_dynamodb_table

Potential Terraform Configuration

No change

hashicorp / terraform-provider-aws

[Enhancement]: aws_dynamodb_table import_table FAILED log improvements #38946

Description

Affected Resource(s) and/or Data Source(s)

Potential Terraform Configuration

References

Would you like to implement a fix?

Community Note