btgann
commented
1 month ago The issue is that the permissions are being indexed and a number in the index must be given to remove the permissions. The exact number of that particular permission in the index. So if I look at the configuration in amazon connect there is a list of permissions in alphabetical order.
$ aws connect list-security-profile-permissions --instance-id 78d16dcd-fc58-4d6e-9980-d3ae448bd1b4 --security-profile-id 97af7a26-526a-4da1-a616-2716ee4dcb54 {
"Permissions": [
"AccessMetrics",
"AccessMetrics.AgentActivityAudit.Access",
"AccessMetrics.Dashboards.Access",
"AccessMetrics.HistoricalMetrics.Access",
"AccessMetrics.RealTimeMetrics.Access",
"RedactedData.View",
"ReportsAdmin.Access",
"ReportsAdmin.Publish",
"ReportsAdmin.Schedule",
"ReportsAdmin.View",
"Users.Edit",
"Users.View"
],
"LastModifiedRegion": "us-east-1",
"LastModifiedTime": "2024-10-01T07:45:23.965000-04:00"
}
If I look at the list of permissions from the cloud control api. There is a list, but order is not alphabetized. Or in any order I can understand... seems random, but maybe not.
$ aws cloudcontrol get-resource --type-name AWS::Connect::SecurityProfile --identifier arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54
{
"TypeName": "AWS::Connect::SecurityProfile",
"ResourceDescription": {
"Identifier": "arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54",
"Properties": "{\"AllowedAccessControlTags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"Description\":\"Admin profile for Customer Support\",\"Applications\":[],\"SecurityProfileArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54\",\"InstanceArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4\",\"Permissions\":[\"ReportsAdmin.Publish\",\"Users.Edit\",\"ReportsAdmin.Access\",\"AccessMetrics.HistoricalMetrics.Access\",\"AccessMetrics\",\"ReportsAdmin.Schedule\",\"AccessMetrics.AgentActivityAudit.Access\",\"RedactedData.View\",\"AccessMetrics.Dashboards.Access\",\"ReportsAdmin.View\",\"AccessMetrics.RealTimeMetrics.Access\"],\"LastModifiedTime\":1.727784501E9,\"SecurityProfileName\":\"jb_cus_admin_profile\",\"TagRestrictedResources\":[\"OperatingHours\",\"RoutingProfile\",\"User\",\"SecurityProfile\",\"Queue\"],\"Tags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"LastModifiedRegion\":\"us-east-1\",\"HierarchyRestrictedResources\":[]}"
}
}
Now if I want to remove a particular permission I have to count the resources in this permissions list and pass in the permissions index value in the patch document.
aws cloudcontrol update-resource --identifier arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54 --type-name AWS::Connect::SecurityProfile --patch-document "[{\"op\":\"remove\",\"path\":\"/Permissions/0\"}]"
This should remove the ReportsAdmin.Publish permission as its the first permission in the index.
{
"ProgressEvent": {
"TypeName": "AWS::Connect::SecurityProfile",
"Identifier": "arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54",
"RequestToken": "b673d070-3c8e-4ad0-be1f-a2cea6c68526",
"Operation": "UPDATE",
"OperationStatus": "IN_PROGRESS",
"EventTime": "2024-10-01T09:27:25.970000-04:00",
"ResourceModel": "{\"AllowedAccessControlTags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"Description\":\"Admin profile for Customer Support\",\"Applications\":[],\"SecurityProfileArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54\",\"InstanceArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4\",\"Permissions\":[\"Users.Edit\",\"ReportsAdmin.Access\",\"AccessMetrics.HistoricalMetrics.Access\",\"AccessMetrics\",\"ReportsAdmin.Schedule\",\"AccessMetrics.AgentActivityAudit.Access\",\"RedactedData.View\",\"AccessMetrics.Dashboards.Access\",\"ReportsAdmin.View\",\"AccessMetrics.RealTimeMetrics.Access\"],\"SecurityProfileName\":\"jb_cus_admin_profile\",\"TagRestrictedResources\":[\"OperatingHours\",\"RoutingProfile\",\"User\",\"SecurityProfile\",\"Queue\"],\"Tags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"HierarchyRestrictedResources\":[]}"
}
}
And the resource after update completes.
$ aws cloudcontrol get-resource --type-name AWS::Connect::SecurityProfile --identifier arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54
{
"TypeName": "AWS::Connect::SecurityProfile",
"ResourceDescription": {
"Identifier": "arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54",
"Properties": "{\"AllowedAccessControlTags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"Description\":\"Admin profile for Customer Support\",\"Applications\":[],\"SecurityProfileArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4/security-profile/97af7a26-526a-4da1-a616-2716ee4dcb54\",\"InstanceArn\":\"arn:aws:connect:us-east-1:126597142151:instance/78d16dcd-fc58-4d6e-9980-d3ae448bd1b4\",\"Permissions\":[\"Users.Edit\",\"ReportsAdmin.Access\",\"AccessMetrics.HistoricalMetrics.Access\",\"AccessMetrics\",\"ReportsAdmin.Schedule\",\"AccessMetrics.AgentActivityAudit.Access\",\"RedactedData.View\",\"AccessMetrics.Dashboards.Access\",\"ReportsAdmin.View\",\"AccessMetrics.RealTimeMetrics.Access\"],\"LastModifiedTime\":1.727789246E9,\"SecurityProfileName\":\"jb_cus_admin_profile\",\"TagRestrictedResources\":[\"OperatingHours\",\"RoutingProfile\",\"User\",\"SecurityProfile\",\"Queue\"],\"Tags\":[{\"Value\":\"custsvc\",\"Key\":\"lob\"},{\"Value\":\"jb\",\"Key\":\"company\"}],\"LastModifiedRegion\":\"us-east-1\",\"HierarchyRestrictedResources\":[]}"
}
}
So the question is should the cloud control api allow updating the permission list by name? This makes sense, but not sure the cloud control api team would agree. It would be impossible for terraform to know the index value without getting the resource configuration from the cloudcontrol api before trying to make an update. Does that mean the terraform provider has to do some comparison between what the cloudcontrol resource configuration is, the terraform state file, and requested updates?
The one operation I have not tried is inserting a permission with the cloudcontrol api. When doing an add how would you know what index value to use for the insert. The index is not an alphabetized list so not sure what happens when you insert a value into the index.
{"op":"add","path":"/Permissions/7","value":"ContactSearchWithKeywords.Access"}For example what makes the permission ContactSearchWithKeywords.Access in any given routing profile number 7 in the index?
wellsiau-aws
Community Note
Terraform CLI and Terraform AWS Cloud Control Provider Version
terraform -version Terraform v1.2.8 on windows_amd64
Your version of Terraform is out of date! The latest version is 1.9.5. You can update by downloading from https://www.terraform.io/downloads.html
Affected Resource(s)
awscc_connect_security_profile
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
security-profiles.tf
provider.tf
Debug Output
https://gist.github.com/btgann/a9d7bc386f6fbe698a1020c50100351f
Expected Behavior
When deploying Amazon Connect Security Profiles with the awscc provider the resource successfully deploys. Removing or adding new permissions to the profile should update the existing profile.
Actual Behavior
The provider errors and the security profile is not updated.
ā Error: AWS SDK Go Service Operation Unsuccessful ā ā with awscc_connect_security_profile.jb_cus_admin_profile, ā on security_profiles.tf line 1, in resource "awscc_connect_security_profile" "jb_cus_admin_profile": ā 1: resource "awscc_connect_security_profile" "jb_cus_admin_profile" { ā ā Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: d29113aa-e54f-4555-bdef-f9ed3522363b, api error ValidationException:
ā index Out of bound, index is greater than 48
Steps to Reproduce
You will need an Amazon Connect Instance. The Connect Instance arn needs to be updated in the security-profiles.tf file. Use the security-profile.tf to deploy an Amazon Connect Security Profile with terraform. After successfully deploying the security profile remove permissions from the profile by commenting out 10 of the permissions in the list. Apply the change with terraform.
Important Factoids
Looking at the patch document that is sent to the cloud control api through terraform debug and sending the patch document to the api gets the same error message. I can shorten the number of permissions in the patch document and the api will succeed. The number of permissions that can be passed in the patch document is intermittent.
References
0000