ON_DEMAND triggers cannot be started via enabled flag

[breathingdust]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• aws_glue_trigger

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.26"
    }
  }
}

provider "aws" {
  profile = "default"
  region  = "us-west-2"
}

resource "aws_glue_job" "test" {
  max_capacity = 10
  name         = "job_name"
  role_arn     = aws_iam_role.test.arn

  command {
    script_location = "testscriptlocation"
  }

  depends_on = [aws_iam_role_policy_attachment.test]
}

resource "aws_glue_trigger" "test" {
  enabled  = false
  name     = "trigger_name"
  type     = "ON_DEMAND"

  actions {
    job_name = aws_glue_job.test.name
  }
}

data "aws_partition" "current" {}

data "aws_iam_policy" "AWSGlueServiceRole" {
  arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSGlueServiceRole"
}

resource "aws_iam_role" "test" {
  name = "role_name"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "glue.${data.aws_partition.current.dns_suffix}"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "test" {
  policy_arn = data.aws_iam_policy.AWSGlueServiceRole.arn
  role       = aws_iam_role.test.name
}

Expected Behavior

Its likely ON_DEMAND triggers start/stop behavior should be covered by a separate resource in line with: https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/provider-design.md#task-execution-and-waiter-resources. But in its current state practitioners are likely to expect the start to be able to be controlled with the enable flag.

Actual Behavior

Glue triggers which are set to ON_DEMAND currently cannot be started via the provider. Starting an ON_DEMAND requires an explicit call to the Start Trigger, where other trigger types can be started on creation, or via the enabled flag which calls this endpoint.

The current logic calls this API on update when the enabled value is changed to true. However an ON_DEMAND trigger can never have its enabled flag set to false, as the StopTrigger API call will error with:

Error: error stopping Glue Trigger (trigger_name): InvalidInputException: The operation is not allowed when trigger is in state: CREATED

If you configure an ON_DEMAND trigger to be disabled on creation, it will not error, but attempting to enable it later, Terraform will detect no changes and thus the start API call will not occur.

Steps to Reproduce

1. terraform apply ON_DEMAND config with enabled = true
2. change enabled to false
3. terraform apply

References

[ghost]

This has been released in version 3.30.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!