data source aws_vpc_endpoint_service not working as expect in AWS China partition (cn-north-1)

[marcincuber]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.5
+ provider registry.terraform.io/hashicorp/aws v3.28.0
+ provider registry.terraform.io/hashicorp/random v3.0.1
+ provider registry.terraform.io/hashicorp/tls v3.0.0

Affected Resource(s) + Terraform Configuration Files

data "aws_vpc_endpoint_service" "ecr_dkr" {
  service_type = "Interface"
  service      = "ecr.dkr"
}

Panic Output

Error: error reading VPC Endpoint Service (com.amazonaws.cn-north-1.ecr.dkr): InvalidServiceName: The Vpc Endpoint Service 'com.amazonaws.cn-north-1.ecr.dkr' does not exist
	status code: 400, request id: cad8f3f9-c8bf-466a-97b2-6d9201ba2b43

Expected Behavior

Expected behaviour would be to correctly find service name which in "AWS China partition (cn-north-1)" should be cn.com.amazonaws.cn-north-1.ecr.dkr. Currently, this is not happening and in fact terraform fails at plan stage.

Steps to Reproduce

1. terraform plan

[marcincuber]

I have managed to solve the problem by using filters:

data "aws_vpc_endpoint_service" "s3" {
  service_type = "Interface"
  filter {
    name   = "service-name"
    values = ["*s3*"]
  }
}

output "aws_vpc_endpoint_service_s3" {
  value = data.aws_vpc_endpoint_service.s3.service_name
}

data "aws_vpc_endpoint_service" "ecr_dkr" {
  service_type = "Interface"
  filter {
    name   = "service-name"
    values = ["*ecr.dkr*"]
  }
}

output "aws_vpc_endpoint_service_ecr_dkr" {
  value = data.aws_vpc_endpoint_service.ecr_dkr.service_name
}

Results:

aws_vpc_endpoint_service_ecr_dkr = "cn.com.amazonaws.cn-north-1.ecr.dkr"
aws_vpc_endpoint_service_s3      = "cn.com.amazonaws.cn-north-1.s3"

[ewbankkit]

@marcincuber Thanks for raising this issue.

Instead of the filter with name = "service-name" you could use the service_name attribute along with the aws_partition and aws_region data source:

data "aws_partition" "current" {}
data "aws_region" "current" {}

data "aws_vpc_endpoint_service" "ecr_dkr" {
  service_type = "Interface"
  service      = "${data.aws_partition.current.reverse_dns_prefix}.${data.aws_region.current.name}.ecr.dkr"
}

although this will only succeed in the cn-north-1 region.

This is the code at fault:

terraform-provider-aws/aws/data_source_aws_vpc_endpoint_service.go

Lines 92 to 98 in c63960b

	if v, ok := d.GetOk("service_name"); ok {
	serviceName = v.(string)
	serviceNameOk = true
	} else if v, ok := d.GetOk("service"); ok {
	serviceName = fmt.Sprintf("com.amazonaws.%s.%s", meta.(*AWSClient).region, v.(string))
	serviceNameOk = true
	}

It should use the ReverseDns function added in #17142:

terraform-provider-aws/aws/provider.go

Lines 1528 to 1537 in c63960b

	// ReverseDns switches a DNS hostname to reverse DNS and vice-versa.
	func ReverseDns(hostname string) string {
	parts := strings.Split(hostname, ".")
	for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
	parts[i], parts[j] = parts[j], parts[i]
	}
	return strings.Join(parts, ".")
	}

[marcincuber]

@ewbankkit thanks for your response. I think that using filter until this is fixed is a better option (out of the two) that will work across different AWS partitions.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.