Removing Account from "ram_principals" disrupts shared TGW with other accounts

[mabitt]

Is your request related to a problem? Please describe.

When you remove an account from the ram_principals, the module will replace the associations and disrupt the current shared TGW by destroying and creating a new resource share.

This problem is related to how the module stores the aws_ram_principal_association in the state. For example, you have:

module "tgw_use1" {
...
  ram_principals                = [
      "111111111111", #Acct1
      "222222222222", #Acct2
      "333333333333", #Acct3
      "444444444444", #Acct4
      "555555555555", #Acct4
  ]

and you remove the Acct3, the next plan/apply will return:

  # module.tgw_use1.aws_ram_principal_association.this[2] must be replaced
-/+ resource "aws_ram_principal_association" "this" {
      ~ id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,333333333333" -> (known after apply)
      ~ principal          = "333333333333" -> "444444444444" # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.tgw_use1.aws_ram_principal_association.this[3] must be replaced
-/+ resource "aws_ram_principal_association" "this" {
      ~ id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,444444444444" -> (known after apply)
      ~ principal          = "444444444444" -> "555555555555" # forces replacement
        # (1 unchanged attribute hidden)
    }

  # module.tgw_use1.aws_ram_principal_association.this[4] will be destroyed
  # (because index [8] is out of range for count)
  - resource "aws_ram_principal_association" "this" {
      - id                 = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>,555555555555" -> null
      - principal          = "555555555555" -> null
      - resource_share_arn = "arn:aws:ram:us-east-1:<TGW_ACCT>:resource-share/<tgw_ram_resource_share_id>" -> null
    }

Describe the solution you'd like.

Maybe the list index could be replaced to the account number, so when the list is reordered it will nor remove existing shares.

Describe alternatives you've considered.

Manually edit the remote state removing the account and reordering the list.

Additional context

This will happen also if adding an account in the middle of the list.

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

[github-actions[bot]]

This issue was automatically closed because of stale in 10 days

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.