State being written incorrectly for IAM group membership?

[villasenor]

Terraform Version

Terraform v0.11.1

• provider.aws v1.6.0
• provider.template v1.0.0

Affected Resource(s)

aws_iam_group_membership

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

module "dev-user1" {
  "source" = "setup-users"
  "local_dev_group" = "${var.iam_dev_group}"
  "local_dev_username" = "user1"
}
module "dev-user2" {
  "source" = "setup-users"
  "local_dev_group" = "${var.iam_dev_group}"
  "local_dev_username" = "user2"
}

# In module setup-users

variable "dev_username" {}
variable "dev_group" {}

resource "aws_iam_user" "user" {
  name = "${var.dev_username}"
}

resource "aws_iam_group_membership" "group_membership" {
  name = "dev"
  users = ["${aws_iam_user.user.name}"]
  group = "${var.dev_group}"
}

Debug Output

Unless this is absolutely necessary, can we skip this for now? Providing this would be difficult since the terraform config provided is sanitized, and I can't really run it without creating a bunch of bogus config in our AWS account.

Panic Output

n/a

Expected Behavior

Users get added to group once, and stay in group.

Actual Behavior

If you run terraform apply several times in a row, the first time, it adds everyone to the group. Then (without changing any config), it removes everyone the second time you run terraform apply. Then, when you run it again, it adds everyone back.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply
2. terraform apply

Important Factoids

• Nothing special.

References

None that I could find.

[loivis]

The problem is that you were trying to create aws_iam_group_membership multiple times for the same group ${var.iam_dev_group}. This is not how aws_iam_group_membership should be used. aws_iam_group_membership is used to manage all members for that group, but not to just associate some users to that group.
In short, aws_iam_group_membership should be used only once for a single group. Try to create it once and put all users in users list.

[villasenor]

Gotcha. Although passing a list of all users to aws_iam_group_membership would require some extensive refactoring. I'll have to think about this. Thanks for the help @loivis!

[bflad]

We have added a new aws_iam_user_group_membership resource that allows non-exclusive user to group management. It will be released in v1.17.0 of the AWS provider, likely tomorrow.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!