AWS MWAA Validation Error Retry - Support Upcoming Service Changes

[dhegberg]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

AWS MWAA is planning on removing an internal retry in the CreateEnvironment API that will require retry on ValidationException as part of the Terraform MWAA Environment create handling.

New or Affected Resource(s)

• aws_mwaa_environment

Background

• On the creation of a new execution role there can be a noticeable permission propagation delay in some AWS regions.
• MWAA CreateEnvironment needs the permissions from that role to complete the CreateEnvironment operation. In the past, MWAA has used internal retries to wait for permissions to propagate.
• Since the service cannot determine when the missing permissions are the result of propagation delay or a misconfigured execution role, a large number of our customers are subject to the latency from retries even when there is no chance of success. To improve the general customer experience we're planning on removing the retries and immediately returning a ValidationException.
• Terraform templates that call CreateEnvironment quickly after the execution role is generated may receive a 400 response from the service.
• Existing environments or accounts with existing execution roles will not be impacted.

Proposal

The Terraform MWAA Environment resource will need to build in a retry on the ValidationException for a period of ~30 seconds to handle the change.

We're looking to minimize potential customer impact by proactively making the change in Terraform before making the service change.

We'd like to make sure the change is in line with Terraform community expectations before we submit a pull request.

[DrFaust92]

Closed via #27031

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.