TF fails to create tags with empty value

[bevanbennett]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

$ terraform -v
Terraform v1.0.11
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v3.59.0
bevan@vyvyn:~/cr/sysconf/tf/emburse-security$ 

Affected Resource(s)

• effects all resources that support tags_all

Terraform Configuration Files

We create a KMS key here because that's the most recent resource this has come up on but I also see it on buckets regularly now.

example/a_key.tf

variable "tag_a" {}
variable "tag_b" {}

resource "aws_kms_key" "example" {
    tags = {
        tag_a = var.tag_a
        tag_b = var.tag_b
    }

module "example" {
  source = "./example"
  tag_a = "a value"
  tag_b = ""
}

Expected Behavior

All tags, even those whose value is "", are created. This used to work before support for tags_all was added.

Actual Behavior

Empty valued tags are not created and repeatedly appear in future plans.

  # module.example.aws_kms_key.example will be updated in-place
  ~ resource "aws_kms_key" "example" {
        id                                 = "UUID"
      ~ tags                               = {
          + "tag_b" = ""
            # (1 unchanged elements hidden)
        }
      ~ tags_all                           = {
          + "tag_b" = (known after apply)
            # (1 unchanged elements hidden)
        }
        # (9 unchanged attributes hidden)
    }

Steps to Reproduce

1. terraform apply; terraform plan

Important Factoids

If the empty valued tags are added by hand via console or CLI, terraform plan stops marking them as needing to be created, but it will not create them itself. empty-valued tags are completely legal and expected by AWS.

References

• #0000

[ewbankkit]

We have a failing CI test that shows this issue:

=== RUN   TestAccCloudWatchLogsGroup_tagging
=== PAUSE TestAccCloudWatchLogsGroup_tagging
=== CONT  TestAccCloudWatchLogsGroup_tagging
group_test.go:233: Step 5/5 error: Check failed: Check 5/5 error: aws_cloudwatch_log_group.test: Attribute 'tags.Empty' expected "", got "NotEmpty"
--- FAIL: TestAccCloudWatchLogsGroup_tagging (202.70s)

[jahantech]

We are seeing the same issue in aws_subnet resource.

[alibowl]

We are seeing the same issue in aws_s3_bucket resource

[kinglet-heb]

Unable to add tags with empty values to aws_s3_bucket with terraform. We will be continuing to add these empty tags for AWS MAP as required for aws. Do we know if this will be fixed or being fixed?

[rabihaggle]

When a new ec2 instance is generated and labels with empty values ​​are placed, it is generated correctly.
When you want to add a new tag in that instance and its value is empty, it is not generated.
Although the plan and the apply do show in terraform

[maunzCache]

I can add something to the list as well

[WARN]  Provider "registry.terraform.io/hashicorp/aws" produced an invalid plan for aws_ssoadmin_permission_set.instance["Developer"], but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .relay_state: planned value cty.StringVal("") for a non-computed attribute
      - .tags: planned value cty.MapValEmpty(cty.String) for a non-computed attribute

While providing an empty value for a tag.

Please note, that this tag was provided via the default_tags section.

Seen in 4.66.0 for Terraform 1.4.6

[johnsonaj]

This issue has been fixed in #30793 and merged to main in #31392. Feature will be released in v5.0.0

[github-actions]

This functionality has been released in v5.0.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.