Open hszalwinski opened 1 month ago
Thank you for opening the issue @hszalwinski .I can reproduce it and it does look like the ordering on the log_exports leading to a drift. Adding some additional details for further debugging.
2024-07-30T18:04:18.156-0400 [DEBUG] provider.terraform-provider-awscc_v1.7.0_x5:
Detected value change between proposed new state and prior state:
@module=sdk.framework tf_req_id=0804e250-80f3-4008-8c50-77c82671d84e
@caller=github.com/hashicorp/terraform-plugin-framework@v1.10.0/internal/fwserver/server_planresourcechange.go:208
tf_attribute_path=log_exports
tf_provider_addr=registry.terraform.io/hashicorp/awscc
tf_resource_type=awscc_redshiftserverless_namespace
tf_rpc=PlanResourceChange timestamp=2024-07-30T18:04:18.156-0400
{
"admin_password_secret_kms_key_id": null,
"admin_user_password": null,
"admin_username": "admin",
"db_name": null,
"default_iam_role_arn": null,
"final_snapshot_name": null,
"final_snapshot_retention_period": null,
"iam_roles": null,
"id": "hs-testing-123",
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
"manage_admin_password": null,
"namespace": {
"admin_password_secret_arn": null,
"admin_password_secret_kms_key_id": null,
"admin_username": "admin",
"creation_date": "2024-07-30T22:03:41.759Z",
"db_name": null,
"default_iam_role_arn": null,
"iam_roles": null,
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
"namespace_arn": "arn:aws:redshift-serverless:us-east-1:############:namespace/74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_id": "74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_name": "hs-testing-123",
"status": "AVAILABLE"
},
"namespace_name": "hs-testing-123",
"namespace_resource_policy": null,
"redshift_idc_application_arn": null,
"snapshot_copy_configurations": null,
"tags": [
{
"key": "environment",
"value": "test"
},
{
"key": "project",
"value": "hs-test"
},
{
"key": "terraform",
"value": "true"
},
{
"key": "workspace",
"value": "default"
}
]
}
{
"admin_password_secret_kms_key_id": null,
"admin_user_password": null,
"admin_username": "admin",
"db_name": null,
"default_iam_role_arn": null,
"final_snapshot_name": null,
"final_snapshot_retention_period": null,
"iam_roles": null,
"id": "hs-testing-123",
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"userlog",
"connectionlog",
"useractivitylog"
],
"manage_admin_password": null,
"namespace": {
"admin_password_secret_arn": null,
"admin_password_secret_kms_key_id": null,
"admin_username": "admin",
"creation_date": "2024-07-30T22:03:41.759Z",
"db_name": null,
"default_iam_role_arn": null,
"iam_roles": null,
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
"namespace_arn": "arn:aws:redshift-serverless:us-east-1:############:namespace/74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_id": "74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_name": "hs-testing-123",
"status": "AVAILABLE"
},
"namespace_name": "hs-testing-123",
"namespace_resource_policy": null,
"redshift_idc_application_arn": null,
"snapshot_copy_configurations": null,
"tags": [
{
"key": "environment",
"value": "test"
},
{
"key": "project",
"value": "hs-test"
},
{
"key": "terraform",
"value": "true"
},
{
"key": "workspace",
"value": "default"
}
]
}
{
"admin_password_secret_kms_key_id": "\u0000",
"admin_user_password": "\u0000",
"admin_username": "admin",
"db_name": "\u0000",
"default_iam_role_arn": "\u0000",
"final_snapshot_name": "\u0000",
"final_snapshot_retention_period": "\u0000",
"iam_roles": "\u0000",
"id": "hs-testing-123",
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
"manage_admin_password": "\u0000",
"namespace": {
"admin_password_secret_arn": null,
"admin_password_secret_kms_key_id": null,
"admin_username": "admin",
"creation_date": "2024-07-30T22:03:41.759Z",
"db_name": null,
"default_iam_role_arn": null,
"iam_roles": null,
"kms_key_id": "AWS_OWNED_KMS_KEY",
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
"namespace_arn": "arn:aws:redshift-serverless:us-east-1:############:namespace/74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_id": "74e6ded1-fd65-43c3-b79a-76e9a18cde38",
"namespace_name": "hs-testing-123",
"status": "AVAILABLE"
},
"namespace_name": "hs-testing-123",
"namespace_resource_policy": "\u0000",
"redshift_idc_application_arn": "\u0000",
"snapshot_copy_configurations": "\u0000",
"tags": [
{
"key": "environment",
"value": "test"
},
{
"key": "project",
"value": "hs-test"
},
{
"key": "terraform",
"value": "true"
},
{
"key": "workspace",
"value": "default"
}
]
}
From the schema, insertionorder shouldn't be a factor.
"LogExports": {
"type": "array",
"insertionOrder": false,
"items": {
"$ref": "#/definitions/LogExport"
},
"maxItems": 16,
"minItems": 0
},
Statefile has
"instances": [
{
"schema_version": 1,
"attributes": {
"admin_password_secret_kms_key_id": null,
....
"log_exports": [
"userlog",
"connectionlog",
"useractivitylog"
],
"manage_admin_password": null,
"namespace": {
....
"log_exports": [
"connectionlog",
"useractivitylog",
"userlog"
],
The get-resource response ( on refresh or subsequent plan/apply) shows the ordered list and hence provider is showing a drift.
aws cloudcontrol get-resource --type-name AWS::RedshiftServerless::Namespace --identifier "hs-testing-123" | jq .ResourceDescription.Properties
"{\"AdminUsername\":\"admin\",\"NamespaceName\":\"hs-testing-123\",\"IamRoles\":[],\"SnapshotCopyConfigurations\":[],\"KmsKeyId\":\"AWS_OWNED_KMS_KEY\",\"Namespace\":{\"Status\":\"AVAILABLE\",\"NamespaceName\":\"hs-testing-123\",\"AdminUsername\":\"admin\",\"CreationDate\":\"2024-07-30T22:20:59.326Z\",\"IamRoles\":[],\"NamespaceArn\":\"arn:aws:redshift-serverless:us-east-1:############:namespace/95549688-0f55-48ed-9a2b-744e0b33b4d4\",\"KmsKeyId\":\"AWS_OWNED_KMS_KEY\",\"NamespaceId\":\"95549688-0f55-48ed-9a2b-744e0b33b4d4\",\"LogExports\":[\"connectionlog\",\"useractivitylog\",\"userlog\"]},\"LogExports\":[\"connectionlog\",\"useractivitylog\",\"userlog\"]}"
translates to ..
"NamespaceId": "95549688-0f55-48ed-9a2b-744e0b33b4d4",
"LogExports": [
"connectionlog",
"useractivitylog",
"userlog"
]
},
"LogExports": [
"connectionlog",
"useractivitylog",
"userlog"
]
This needs some review as Tags on namespace is an replace operation for the resource from the schema and it would fail with a resource with a custom name.
Opened an internal service ticket to review the schema around log_exports
and tags being a replace op.
The secondary issue on the tags being added in the patch operation when anything changes needs to be reviewed.
Community Note
Terraform CLI and Terraform AWS Cloud Control Provider Version
Terraform v1.9.3 on linux_amd64
Affected Resource(s)
Terraform Configuration Files
Debug Output
Expected Behavior
Docs state, that
log_exports
should be aList of String
. I would expect either the documentation to be fixed or implementation to handle the bug case.Additionally and even more important, it is not only an issue with
log_exports
. When I try to update existing resource by e.g. changing theadmin_password_secret_kms_key_id
or adding another role toiam_roles
. I receive the same error from Cloud Control API. I expect the issue not to appear, so noin-place updates
should be blocked by this.Actual Behavior and Steps to Reproduce
awscc_redshiftserverless_namespace
providinglog_exports
as alist
theterraform apply
command succeeds (1st gist).No changes.
output like in 3rd gist. Instead of this, I receive an error (2nd gist):log_exports
fromlist
to aset
and runterraform apply
once again it produces desired output. I've also checked, that it works okay if I useset
from the beginning.