awscc_connect_routing_profile not allowing queue_configs to be optional

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment
The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Terraform CLI and Terraform AWS Cloud Control Provider Version

Terraform v1.9.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.72.1
+ provider registry.terraform.io/hashicorp/awscc v1.17.0

Your version of Terraform is out of date! The latest version
is 1.9.8. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

awscc_connect_routing_profile

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

In the repository, there are YAML files used for providing inputs, which are then mapped by an intermediatory bit of terraform and provided to some sub-modules. This is part of a broader framework to manage a lot of the Connect configuration through code, in a way that is friendly enough for our non-engineering staff to maintain. The framework in general works fine, I have provided the inputs and the specific resource where the problem occurs. To reproduce, you could hard code in the values rather than backengineer anything - just update the ARN based inputs to be a proper ARN instead of dummy values.

resource "awscc_connect_routing_profile" "routing_profile" {
  provider     = awscc.amazon-connect
  instance_arn = var.connect_instance_arn

  name                       = var.name
  description                = var.description
  default_outbound_queue_arn = var.default_outbound_queue
  media_concurrencies        = var.media_concurrencies
  agent_availability_timer   = var.agent_availability_timer

  tags = [{
    key   = "managed_by"
    value = "terraform"
  }]
}

name: Some Profile Name
description: Some profile description
default_outbound_queue: ARealQueue
media_concurrencies:
  - channel: VOICE
    concurrency: 1
    cross_channel_behavior:
      behavior_type: ROUTE_CURRENT_CHANNEL_ONLY
agent_availability_timer: TIME_SINCE_LAST_ACTIVITY

Debug Output

https://gist.github.com/cemery93/a479bdb1777aa313e265e5c1e1b5a091

Expected Behavior

A routing profile is produced with no queues associated with it.

Actual Behavior

╷
│ Error: AWS SDK Go Service Operation Unsuccessful
│
│   with module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile,
│   on modules/routing-profiles/main.tf line 1, in resource "awscc_connect_routing_profile" "routing_profile":
│    1: resource "awscc_connect_routing_profile" "routing_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: bf1362a7-a37f-4e16-9fac-26687b1c7369, api
│ error ValidationException: Model validation failed (#/QueueConfigs: expected minimum item count: 1, found: 0)
╵

Steps to Reproduce

Set up the inputs for the resource shown above, don't put any queue_configs in, try to apply.

Important Factoids

N/A

References

Queue Configs listed as optional in provider documentation - https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/connect_routing_profile#optional
Queue Configs listed as optional in Cloud Formation documentation - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-connect-routingprofile.html

Update - I have also tried this with the latest version of the provider (hashicorp/awscc v1.18.0) and the same behaviour is present.

Thank you for opening the issue, @cemery93 . Will try to reproduce this on my end and respond.

I have tested this with the configuration below and I am unable to reproduce the optional args being required. Is there anything else on the outbound queue which necessitates the queue config on your side ?

resource "awscc_connect_routing_profile" "routing_profile" {
  instance_arn = awscc_connect_instance.example.arn

  name                       = "example"
  description                = "example"
  default_outbound_queue_arn = awscc_connect_queue.example.id
  media_concurrencies        = [{
    channel = "VOICE"
    concurrency = 1
    cross_channel_behavior = {
      behavior_type = "ROUTE_CURRENT_CHANNEL_ONLY"
    }
  }]
  agent_availability_timer = "TIME_SINCE_LAST_ACTIVITY"

  tags = [{
    key   = "managed_by"
    value = "quixoticmonk"
  }]
}

TF workflow output

  # awscc_connect_routing_profile.routing_profile will be created
  + resource "awscc_connect_routing_profile" "routing_profile" {
      + agent_availability_timer   = "TIME_SINCE_LAST_ACTIVITY"
      + default_outbound_queue_arn = "arn:aws:connect:us-east-1:############:instance/d9d0de37-d138-47d9-a4f9-1ce24fe02a02/queue/0d6cabed-d957-4a0f-b1c9-6c9d40d9f008"
      + description                = "example"
      + id                         = (known after apply)
      + instance_arn               = "arn:aws:connect:us-east-1:############:instance/d9d0de37-d138-47d9-a4f9-1ce24fe02a02"
      + media_concurrencies        = [
          + {
              + channel                = "VOICE"
              + concurrency            = 1
              + cross_channel_behavior = {
                  + behavior_type = "ROUTE_CURRENT_CHANNEL_ONLY"
                }
            },
        ]
      + name                       = "example"
      + queue_configs              = (known after apply)
      + routing_profile_arn        = (known after apply)
      + tags                       = [
          + {
              + key   = "managed_by"
              + value = "quixoticmonk"
            },
        ]
    }

Plan: 1 to add, 0 to change, 0 to destroy.
awscc_connect_routing_profile.routing_profile: Creating...
awscc_connect_routing_profile.routing_profile: Creation complete after 6s [id=arn:aws:connect:us-east-1:############:instance/d9d0de37-d138-47d9-a4f9-1ce24fe02a02/routing-profile/37c02b57-1191-4495-975d-b8c56ab752b7]

Thanks for testing @quixoticmonk. I've managed to reproduce the error, as well as your experience.

If you create a new routing profile without any queue_configs, it seems to work on first creation. The issue is then on any update to that profile, where it attempts to add an empty queue_configs block for some reason. I performed this test to come to these results:

Kept original config in place
Added an additional routing profile, with mostly the same config as the first (but a new name - Temp Testing Profile)
Applied the terraform

This resulted in the following plan and output:

Plan Output:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile will be updated in-place
  ~ resource "awscc_connect_routing_profile" "routing_profile" {
        id                         = "arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/3a83****-****-****-****-****ba41acd5"
        name                       = "Some Profile"
      + queue_configs              = (known after apply)
      + tags                       = [
          + {
              + key   = "managed_by"
              + value = "terraform"
            },
        ]
        # (6 unchanged attributes hidden)
    }

  # module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile will be created
  + resource "awscc_connect_routing_profile" "routing_profile" {
      + agent_availability_timer   = "TIME_SINCE_LAST_ACTIVITY"
      + default_outbound_queue_arn = "arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****3a2b0e54/queue/c26c****-****-****-****-****3e6ebe03"
      + description                = "For testing functionality of terraform awscc provider"
      + id                         = (known after apply)
      + instance_arn               = "arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****3a2b0e54"
      + media_concurrencies        = [
          + {
              + channel                = "VOICE"
              + concurrency            = 1
              + cross_channel_behavior = {
                  + behavior_type = "ROUTE_CURRENT_CHANNEL_ONLY"
                }
            },
        ]
      + name                       = "Temp Testing Profile"
      + queue_configs              = (known after apply)
      + routing_profile_arn        = (known after apply)
      + tags                       = [
          + {
              + key   = "managed_by"
              + value = "terraform"
            },
        ]
    }

Plan: 1 to add, 1 to change, 0 to destroy.

Apply output:

module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile: Creating...
module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile: Modifying... [id=arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/3a83****-****-****-****-****ba41acd5]
module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile: Creation complete after 5s [id=arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****3a2b0e54/routing-profile/91fd****-****-****-****-****411d4e65]
╷
│ Error: AWS SDK Go Service Operation Unsuccessful
│
│   with module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile,
│   on modules/routing-profiles/main.tf line 1, in resource "awscc_connect_routing_profile" "routing_profile":
│    1: resource "awscc_connect_routing_profile" "routing_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: c5fc76ae-0b5f-4fb5-a81a-bd3949f366b4, api error ValidationException: Model validation failed (#/QueueConfigs: expected minimum item count: 1, found: 0)
╵

As this shows, a freshly created routing profile will work fine, however the below update, where I've changed the name of the new profile to Temp Testing Profile 2, fails due to the original error.

Plan Output:

Terraform will perform the following actions:

  # module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile will be updated in-place
  ~ resource "awscc_connect_routing_profile" "routing_profile" {
        id                         = "arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/3a83****-****-****-****-****ba41acd5"
        name                       = "Some Profile"
      + queue_configs              = (known after apply)
      + tags                       = [
          + {
              + key   = "managed_by"
              + value = "terraform"
            },
        ]
        # (6 unchanged attributes hidden)
    }

  # module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile will be updated in-place
  ~ resource "awscc_connect_routing_profile" "routing_profile" {
        id                         = "arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/91fd****-****-****-****-****411d4e65"
      ~ name                       = "Temp Testing Profile" -> "Temp Testing Profile 2"
      + queue_configs              = (known after apply)
        tags                       = [
            {
                key   = "managed_by"
                value = "terraform"
            },
        ]
        # (6 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Apply Output:

module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile: Modifying... [id=arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/91fd****-****-****-****-****411d4e65]
module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile: Modifying... [id=arn:aws:connect:ap-southeast-2:123456789012:instance/6621****-****-****-****-****a2b0e54/routing-profile/3a83****-****-****-****-****ba41acd5]
╷
│ Error: AWS SDK Go Service Operation Unsuccessful
│
│   with module.routing_profiles["SomeProfile"].awscc_connect_routing_profile.routing_profile,
│   on modules/routing-profiles/main.tf line 1, in resource "awscc_connect_routing_profile" "routing_profile":
│    1: resource "awscc_connect_routing_profile" "routing_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: 1ebd760f-c5ce-495e-ad03-2de5135616ee, api error ValidationException: Model validation failed (#/QueueConfigs: expected minimum item count: 1, found: 0)
╵
╷
│ Error: AWS SDK Go Service Operation Unsuccessful
│
│   with module.routing_profiles["TempTestingProfile"].awscc_connect_routing_profile.routing_profile,
│   on modules/routing-profiles/main.tf line 1, in resource "awscc_connect_routing_profile" "routing_profile":
│    1: resource "awscc_connect_routing_profile" "routing_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: 23846918-74c5-4da9-806d-5141432897cf, api error ValidationException: Model validation failed (#/QueueConfigs: expected minimum item count: 1, found: 0)
╵

I believe the original issue occurred because the "SomeProfile" routing profile was imported to the state from an existing profile that had no queue_configs. I realise now that I forgot to mention that detail in the original post, my apologies. Either way, the import to state was successful, and the subsequent plans only want to update the resource.

I have also attempted to run an apply with

 lifecycle {
    ignore_changes = [ queue_configs ]
  }

Added to the resource definition, however it appears to have no effect. This may be because it sees the "change" to the queue_configs attribute as being an initial creation of it, rather than a change to its state, though that sounds quite odd in itself.

Thank you for the details on the scenario @cemery93 . I will try to reproduce this on my end and get back to you on this.

Hi @quixoticmonk, have you had a chance to look further into this?

I am able to reproduce the behavior with a change in the name of the routing profile. Let me dig into a logs a little bit to see what is causing this.

│ Error: AWS SDK Go Service Operation Unsuccessful
│
│   with awscc_connect_routing_profile.routing_profile,
│   on main.tf line 1, in resource "awscc_connect_routing_profile" "routing_profile":
│    1: resource "awscc_connect_routing_profile" "routing_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode:
│ 400, RequestID: e66a906c-cf13-484d-bdd3-c8547414ccbc, api error ValidationException: Model validation failed (#/QueueConfigs: expected minimum item
│ count: 1, found: 0)

Opening an internal service ticket to review this as this gets triggered even when any input from the existing routing profile gets modified ( description). Setting the queue_configs input to null doesn't suffice to override any behavior. It is essentially behaving as if I am providing an empty list.

│ Error: Invalid Attribute Value
│
│   with awscc_connect_routing_profile.routing_profile,
│   on main.tf line 15, in resource "awscc_connect_routing_profile" "routing_profile":
│   15:   queue_configs = []
│
│ Attribute queue_configs list must contain at least 1 elements, got: 0

hashicorp / terraform-provider-awscc