Changing terraform name of policy attachment caused provider bug: "Error: Provider produced inconsistent result after apply"

[arigesher]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.20

• provider.aws v2.44.0

Affected Resource(s)

• aws_iam_role_policy_attachment

Terraform Configuration Files

Not provided

Debug Output

Panic Output

Expected Behavior

Simple apply

Actual Behavior

Terraform errored out with a message to file a bug on the provider:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create
  - destroy

Terraform will perform the following actions:

  # aws_iam_role_policy_attachment.foreign_s3_access will be destroyed
  - resource "aws_iam_role_policy_attachment" "foreign_s3_access" {
      - id         = "tileservice-customer-nm-20200219070556171800000001" -> null
      - policy_arn = "arn:aws:iam::490182873131:policy/customer-nm-processed-s3-access" -> null
      - role       = "tileservice-customer-nm" -> null
    }

  # aws_iam_role_policy_attachment.pat_foreign_s3_access will be created
  + resource "aws_iam_role_policy_attachment" "pat_foreign_s3_access" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::490182873131:policy/customer-nm-processed-s3-access"
      + role       = "pat-customer-nm"
    }

  # aws_iam_role_policy_attachment.tileservice_foreign_s3_access will be created
  + resource "aws_iam_role_policy_attachment" "tileservice_foreign_s3_access" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::490182873131:policy/customer-nm-processed-s3-access"
      + role       = "tileservice-customer-nm"
    }

Plan: 2 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_role_policy_attachment.foreign_s3_access: Destroying... [id=tileservice-customer-nm-20200219070556171800000001]
aws_iam_role_policy_attachment.tileservice_foreign_s3_access: Creating...
aws_iam_role_policy_attachment.pat_foreign_s3_access: Creating...
aws_iam_role_policy_attachment.foreign_s3_access: Destruction complete after 1s
aws_iam_role_policy_attachment.pat_foreign_s3_access: Creation complete after 1s [id=pat-customer-nm-20200221204549721200000002]

Error: Provider produced inconsistent result after apply

When applying changes to
aws_iam_role_policy_attachment.tileservice_foreign_s3_access, provider
"registry.terraform.io/-/aws" produced an unexpected new value for was
present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Steps to Reproduce

1. terraform apply

Important Factoids

The policy attachment aws_iam_role_policy_attachment.tileservice_foreign_s3_access already existed with the name aws_iam_role_policy_attachment.foreign_s3_access. There was no other change to this resource than changing the name of the block in terraform (should not have produced a change on the AWS side other than too the ID string).

[aberezin]

The workaround seems to be to rerun the apply.

[cvsmith]

Simply rerunning the apply from Terraform Cloud did not fix it for me. It still failed with the same error.

I tried to destroy and reapply (which is an option for me but not for many), and destroying from Terraform Cloud also failed on the job role in question:

Error: Error deleting IAM Role (...): DeleteConflict: Cannot delete entity, must detach all policies first.

After manually deleting the role in the AWS console, the destroy succeeded, but then applying failed with the original error message.

[cvsmith]

Despite the error message, the role and its policies were successfully created and function.

[ghost]

This has been released in version 3.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!