Closed martinpsz closed 1 month ago
This looks like it's likely an issue in the AWS provider, so moving to the AWS provider repo for further triage.
Hi @martinpsz. Thanks for reporting this issue.
I was able to reproduce with the following program:
import * as aws from "@pulumi/aws";
new aws.opensearch.ServerlessSecurityPolicy("encryption-policy", {
type: "encryption",
policy: JSON.stringify({
Rules: [{
Resource: ["collection/member-search*"],
ResourceType: "collection",
}],
AWSOwnedKey: true,
}),
});
This is making Pulumi failed on update with the following error message. We had to add the current date to the description in order to not fail our CI build for all unrelated changes.
aws:opensearch:ServerlessSecurityPolicy (***-encryption-policy):
error: updating Security Policy (***-encryption-policy): operation error OpenSearchServerless: UpdateSecurityPolicy, https response error StatusCode: 400, RequestID: *****, ValidationException: No changes detected in policy or policy description
It looks like the diff might be caused by the ordering of the keys in the policy JSON document. Can you try to order the keys alphabetically and see if the diff goes away?
We are still investigating what is causing this ordering issue, but it may be a workaround in the meantime.
It looks like this is technically an upstream issue.
I think we may be able to fix this on our side by using a PreCheckCallback
to order the keys before passing to create.
It is common to have JSON-valued attributes that need to ignore whitespace and reordering changes. The common way to handle it in the AWS provider for SDKv2 based resources is using something like this:
DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
StateFunc: func(v interface{}) string {
json, _ := structure.NormalizeJsonString(v)
return json
},
For example, consider: https://github.com/hashicorp/terraform-provider-aws/blob/master/internal/service/networkmanager/core_network_policy_attachment.go#L57
I've searched briefly but couldn't find authoritative guidance on how to accomplish the same result for Plugin Framework based resources. It appears there was an idea to use custom types that redefine the equality operation (https://github.com/hashicorp/terraform-plugin-framework/issues/803) that led to the creation of https://github.com/hashicorp/terraform-plugin-framework-jsontypes repository.
Looking further, there seems to be a precedent of using this:
Unlike access_policy, security_policy uses the String type and not jsontypes.Normalized:
Policy jsontypes.Normalized `tfsdk:"policy"
This makes me suspect that:
the upstream provider may not be handling changes to security_policy in the desired way (that is, it may not be ignoring whitespace and reordering changes as the users might expect)
a possible fix could be editing upstream to transition to jsontypes.Normalized
.
Created an issue upstream https://github.com/hashicorp/terraform-provider-aws/issues/38603
My fix was merged upstream so we should be able to pull it in next release.
v6.48.0
was just released and included the fix.
What happened?
I am experiencing an issue, when using OpenSearch Serverless Collection in AWS Classic, where I cannot run pulumi up without the preview showing updates to the resources I am using with the serverless collection. It shows updates even if none have been made.
Example
This code block below is my typical usage. when i run pulumi up, initially, the resources are created. Then, when I work on other resources and run pulumi up, updates shows up for the resources below. I include the pulumi preview --diff below the code block to lend insight.
Output of
pulumi about
Dependencies: NAME VERSION @pulumi/aws-native 0.94.0 @pulumi/aws 6.18.2 @pulumi/awsx 2.4.0 @pulumi/pulumi 3.102.0 @types/node 18.19.9
Additional context
No response
Contributing
Vote on this issue by adding a đź‘Ť reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).