Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Circular Tag Clobbering with tags_all metadata resulting in tag overwrites #19744

Closed
bpr-git opened this issue Jun 10, 2021 · 3 comments
Closed
Labels
provider Pertains to the provider itself, rather than any interaction with AWS. service/acm Issues and PRs that pertain to the acm service.

Comments

@bpr-git
Copy link

bpr-git commented Jun 10, 2021

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

  • terraform version 0.14.11
  • aws provider version 3.38.0 and up
  • This does not happen with aws provider version 3.37.0

Affected Resource(s)

  • tags metadata
  • tags_all metadata

Terraform Configuration Files

# Tell ACM to use the above CNAME to validate the cert.
# Module ./local_modules/cert_and_validation
resource "aws_acm_certificate" "cert" {
  provider                  = aws.acm
  domain_name               = var.ssl_domain
  validation_method         = "DNS"
  subject_alternative_names = var.subject_alternative_names
  tags                      = var.cert_tags

  lifecycle {
    create_before_destroy = true
  }
}

# Configuration calling above module
module "api_cert" {
  source = "./local_modules/cert_and_validation"
  providers = {
    aws.acm     = aws
    aws.route53 = aws.nunahealth
  }
  ssl_domain                 = local.api_hostname
  subject_alternative_names  = var.subject_alternative_names
  cert_tags                  = merge(module.label.tags, module.nuna-label.tags)
  route53_validation_zone_id = local.verification_zone_id
}

Expected Behavior

When updating a tag in the configuration files:

  1. terraform plan should show this change
  2. terraform apply should apply this change
  3. terraform plan should no longer show this change

Actual Behavior

  1. terraform plan shows this change
  2. terraform apply applies this change
  3. terraform plan continues to show this change <-- This is the error!

Steps to Reproduce

  1. Update a tag in HCL
  2. terraform plan shows the change
Terraform will perform the following actions:

  # module.api_cert.aws_acm_certificate.cert will be updated in-place
  ~ resource "aws_acm_certificate" "cert" {
        id                        = <redacted>
      ~ tags                      = {
          ~ "storage"          = "rds" -> ""
            # (14 unchanged elements hidden)
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
  1. terraform state show shows the following:
# module.api_cert.aws_acm_certificate.cert:
resource "aws_acm_certificate" "cert" {
    <redacted>
    tags                      = {
        <other_tags>
        "storage"          = "rds"
    }
    tags_all                  = {
        <other_tags>
        "storage"          = "rds"
    }
  <redacted>
}
  1. terraform apply the plan
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
  1. [This is where behavior becomes erroneous] terraform state show does not reflect this change:
# module.api_cert.aws_acm_certificate.cert:
resource "aws_acm_certificate" "cert" {
        id                        = <redacted>
    tags                      = {
        <other_tags>
        "storage"          = "rds"
    }
    tags_all                  = {
        <other_tags>
        "storage"          = "rds"
    }
  <redacted>
}
  1. terraform plan again and we're back where we started
Terraform will perform the following actions:

  # module.api_cert.aws_acm_certificate.cert will be updated in-place
  ~ resource "aws_acm_certificate" "cert" {
        id                        = <redacted>
      ~ tags                      = {
          ~ "storage"          = "rds" -> ""
            # (14 unchanged elements hidden)
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Important Factoids

  • This does not happen with aws provider version 3.37.0
@github-actions github-actions bot added needs-triage Waiting for first response or review from a maintainer. service/acm Issues and PRs that pertain to the acm service. labels Jun 10, 2021
@anGie44 anGie44 added provider Pertains to the provider itself, rather than any interaction with AWS. thinking and removed needs-triage Waiting for first response or review from a maintainer. labels Jun 11, 2021
@ericksoen
Copy link
Contributor

ericksoen commented Jul 2, 2021

A colleague and I experienced a similar issue to the one you described. The detail about the unique behaviors depending on the AWS provider version was super helpful 🎉. My colleague experienced the issue with hashicorp/aws v3.3.37 and I did not experience the issue with hashicorp/aws v3.46.0.

We were able to confirm that by executing terraform init --upgrade to bump their hashicorp/aws version to 3.3.48 resolved the issue.

Seems like there's some interesting behavior with tags_all starting with version 3.37.0 and persistent until 3.46.0 (at least from our minimal attempts to reproduce).

@ewbankkit
Copy link
Contributor

Hey all 👋 Thank you very much for taking the time to raise this! This was addressed with #29747, which was included in version 5.0.0 of the provider. With that in mind, we'll close this issue. If you experience additional issues with the provider, please do open a new issue to let us know.

@github-actions
Copy link

github-actions bot commented Jul 2, 2023

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 2, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
provider Pertains to the provider itself, rather than any interaction with AWS. service/acm Issues and PRs that pertain to the acm service.
Projects
None yet
Development

No branches or pull requests

5 participants