It seems like its impossible to import an aws_acm_certificate because subject_alternative_names see a change

[red8888]

I imported an aws_acm_certificate

It has these subject name: subject_alternative_names = ["*.zzzz.com", "zzzz.com"]

I run plan and saw this:

      ~ subject_alternative_names = [ # forces replacement
          + "*.zzzz.com",
            "zzzz.com",
        ]

I then reordered the param like this: subject_alternative_names = ["zzzz.com", "*.zzzz.com"]
And then I got this error:

      ~ subject_alternative_names = [ # forces replacement
            "zzzz.com",
          + "*.zzzz.com",
        ]

????

I need to ignore it now for it to work (ignore_changes = ["subject_alternative_names"])

Why is this happening? After I apply with subject_alternative_names ignored is there a way to manually add it to state for now until this bug (gotta be a bug) is fixed?

[bflad]

Hi @red8888 👋 Thank you for reporting this and sorry you ran into trouble here. I believe for imported certificates you can omit configuring subject_alternative_names since it would be determined by the certificate itself. Otherwise, please note that we have #8531 for tracking subject_alternative_names ordering issues with the aws_acm_certificate resource and #13053 to discuss remediation efforts since it will potentially require breaking changes in the next major version of the Terraform AWS Provider. Please follow those two issues for further updates on this. 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!