bug: aws_s3_bucket_website_configuration strips replace_key_prefix_with with empty string

[ThisIsFroggie]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.1.2
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v4.8.0

Affected Resource(s)

• aws_s3_bucket_website_configuration

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_s3_bucket" "b" {
  bucket = "sample-bucket-name-ignore"

  lifecycle {
    ignore_changes = [
      website,
    ]
  }
}

resource "aws_s3_bucket_website_configuration" "b" {
  bucket = aws_s3_bucket.b.id

  routing_rule {
    condition {
      key_prefix_equals = "test/"
    }
    redirect {
      replace_key_prefix_with = ""
    }
  }
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.8"
    }
  }
}

Debug Output

https://gist.github.com/PedroArvela/1fece7fa18a9314e419cb513258ab12f

(debug is truncated in web view, but there's a link to see the full raw file at the start)

Expected Behavior

The website configuration resource should have an empty string replace_key_prefix_with

  # This is imaginary output of what I expect the plan to have

  # aws_s3_bucket_website_configuration.b will be created
  + resource "aws_s3_bucket_website_configuration" "b" {
      + bucket           = (known after apply)
      + id               = (known after apply)
      + website_domain   = (known after apply)
      + website_endpoint = (known after apply)

      + routing_rule {
          + condition {
              + key_prefix_equals = "test/"
            }

          + redirect {
             + replace_key_prefix_with = ""
          }
        }
    }

Actual Behavior

The website configuration resource is missing the replace_key_prefix_with condition altogether:

  # aws_s3_bucket_website_configuration.b will be created
  + resource "aws_s3_bucket_website_configuration" "b" {
      + bucket           = (known after apply)
      + id               = (known after apply)
      + website_domain   = (known after apply)
      + website_endpoint = (known after apply)

      + routing_rule {
          + condition {
              + key_prefix_equals = "test/"
            }

          + redirect {}
        }
    }

Steps to Reproduce

1. Copy the above sample
2. Run a terraform plan

Important Factoids

This is serious as it breaks existing redirects in the migration process from the aws_s3_bucket blocks to the individual resources. We actually found the issue in provider version 3.75.1.

It is currently impossible with the new resource to create a rule that strips a certain prefix altogether. Trying to apply will either fail or, if there is a domain_name, apply but break the redirect altogether.

From version 4.15.0 onward this is no longer an issue as a routing_rules parameter that behaves as the previous one was made available.

References

[anGie44]

Noting here that the behavior is similar to hashicorp/terraform-plugin-sdk#216 in that the empty string value for replace_key_prefix_with (or any other nested parameter) in the TypeSet is not interpreted in the terraform CLI nor by the time the redirect configuration block is made available with the tf plugin SDK . it may be worth considering setting the routing_rules parameter to a String similar to how it's configured in the aws_s3_bucket resource.

[evilhamsterman]

Similar thing happens with a condition. If you set a redirect rule without a condition, everytime you run apply it tries to add an empty condition block to the the routing_rule

# module.qf2_co.module.redirect_buckets["google"].aws_s3_bucket_website_configuration.this[0] will be updated in-place
  ~ resource "aws_s3_bucket_website_configuration" "this" {
        id               = "google.qf2.co"
        # (3 unchanged attributes hidden)


      ~ routing_rule {
          + condition {}

            # (1 unchanged block hidden)
        }
        # (1 unchanged block hidden)
    }

[anGie44]

HI @PedroArvela et al 👋 You may have seen this already but just wanted to drop a note that while a fix to the routing_rule parameter is not available, the routing_rules parameter added in v4.15.0 should function as an alternative for supporting empty strings. It can be used just like the aws_s3_bucket resource's routing_rules parameter.

[ThisIsFroggie]

Thanks @anGie44 , I actually hadn't seen it! Good to know there is a workaround for it! :D

I'll still leave this issue open for reference and tracking, but I'll update the description with the workaround

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.