Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aws_appmesh_mesh data source not working for shared meshes #21202

Closed
gavinclarkeuk opened this issue Oct 7, 2021 · 3 comments · Fixed by #26695
Closed

aws_appmesh_mesh data source not working for shared meshes #21202

gavinclarkeuk opened this issue Oct 7, 2021 · 3 comments · Fixed by #26695
Labels
bug Addresses a defect in current functionality. service/appmesh Issues and PRs that pertain to the appmesh service.

Comments

@gavinclarkeuk
Copy link

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Summary

You cannot use the aws_appmesh_mesh datasource with shared meshes. The data source attempts to load tags for the resource based on the ARN, this fails unless the call is coming from the account that owns the mesh. In this scenario it would be better to simply omit the tags, and just return the available data.

Terraform CLI and Terraform AWS Provider Version

terraform v1.0.8
provider registry.terraform.io/hashicorp/aws v3.61.0

Affected Resource(s)

  • aws_appmesh_mesh (data source)

Terraform Configuration Files / Steps to Reproduce

To reproduce you need two AWS accounts in the same org. The owner account and the target account.

First create an appmesh in the owner account and share with the target account via RAM. You can do this by running the following terraform in the owner account.

resource "aws_appmesh_mesh" "mesh" {
  name = "my-mesh"
}

resource "aws_ram_resource_share" "mesh-share" {
  name                      = "my-mesh"
  allow_external_principals = false
}

resource "aws_ram_resource_association" "share_assocation" {
  resource_arn       = aws_appmesh_mesh.mesh.arn
  resource_share_arn = aws_ram_resource_share.mesh-share.arn
}

resource "aws_ram_principal_association" "dns_share" {
  principal          = <TARGET_ACCOUNT_ID>
  resource_share_arn = aws_ram_resource_share.mesh-share.arn
}

Then in the target account try to use the app mesh data source to access the shared mesh.

data "aws_appmesh_mesh" "mesh" {
  name       = "my-mesh"
  mesh_owner = <OWNER_ACCOUNT_ID>
}

Expected Behavior

Data source should be able to load details of the mesh (possibly missing some attributes, like tags).

Actual Behavior

Get an error as per below

Error: error listing tags for App Mesh service mesh (arn:aws:appmesh:*********:************:mesh/my-mesh): AccessDeniedException: 
	status code: 403, request id: c0048e53-bc20-4b3d-83be-c1df7a0a5edf

Additional Notes

It looks like the aws provider is using the ListTagsForResource api call under the covers. When I run this using the AWS CLI I logged in to the Target Account I see the following error

An error occurred (AccessDeniedException) when calling the ListTagsForResource operation: arn:aws:appmesh:eu-west-1:<OWNER_ACCOUNT_ID>:mesh/my-mesh is an invalid ARN. Invalid account id in the ARN provided : <OWNER_ACCOUNT_ID>

This suggests that the api won't support getting the tags from a different account, even if the mesh is shared.

@github-actions github-actions bot added needs-triage Waiting for first response or review from a maintainer. service/appmesh Issues and PRs that pertain to the appmesh service. service/ram Issues and PRs that pertain to the ram service. labels Oct 7, 2021
@justinretzolk justinretzolk added bug Addresses a defect in current functionality. and removed needs-triage Waiting for first response or review from a maintainer. labels Oct 7, 2021
@terranisu
Copy link

terranisu commented Sep 19, 2022

We've got the same issue with the aws_appmesh_virtual_service data resource when using a shared appmesh.

data "aws_appmesh_virtual_service" "service_name" {
  name       = "service_name.${var.service_discovery_namespace}"
  mesh_name  = var.appmesh_name
  mesh_owner = var.appmesh_owner
}

The error occurs:

Error: error listing tags for App Mesh Virtual Service (arn:aws:appmesh:***:***:mesh/***@***/virtualService/service_name): AccessDeniedException: 
  status code: 403, request id: xxx

Terraform CLI and Terraform AWS Provider Version

  • Terraform v0.14.11
  • Provider registry.terraform.io/hashicorp/aws v3.75.2

It seems there is no way to use aws_appmesh_* data resources for the shared appmesh resources. According to the AppMesh documentation the tags cannot be fetched from another account:

The user defined tags that you attach to a shared mesh are available only to your AWS account. They're not available to the other accounts that the mesh is shared with. The aws appmesh list-tags-for-resource command for a mesh in another account is denied access.

@nandha-emis
Copy link

We are facing this in even in AWS provider version 4.49 and terraform version 1.3.7

seems like the issue is long running? as any one found a work around for this?

@ewbankkit ewbankkit removed the service/ram Issues and PRs that pertain to the ram service. label Mar 23, 2023
@github-actions
Copy link

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Apr 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Addresses a defect in current functionality. service/appmesh Issues and PRs that pertain to the appmesh service.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants