[Bug]: Changes to aws_securityhub_account resource breaks contract

[ctrawick]

Terraform Core Version

v1.3.9

AWS Provider Version

4.64.0

Affected Resource(s)

aws_securityhub_account

Expected Behavior

Missing optional fields should not impact existing resources.

Actual Behavior

~ resource "aws_securityhub_account" "main" {
(https://gitlab.com/XXXXXX)      ~ control_finding_generator = "STANDARD_CONTROL" -> "SECURITY_CONTROL"

Relevant Error/Panic Output Snippet

│ Error: updating Security Hub Account (XXXXX): InvalidAccessException: Request contains configurations that cannot be updated by a member account XXXXX

Terraform Configuration Files

Requires multiple runs across multiple versions

Steps to Reproduce

1. Implement AWS Security Hub in v4.63
2. Re-apply in v4.64
3. Fail

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

Yes

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @ctrawick 👋 Thank you for taking the time to raise this! Are you able to supply a sample Terraform configuration and debug logs (redacted as necessary) so that we have the necessary information in order to look into this?

[lorengordon]

@justinretzolk The issue comes from upgrading an already applied aws_securityhub_account from an earlier version of the provider to >= v4.64.0. Here is the plan:

Terraform will perform the following actions:

  # aws_securityhub_account.this will be updated in-place
  ~ resource "aws_securityhub_account" "this" {
      ~ auto_enable_controls      = false -> true
      ~ control_finding_generator = "STANDARD_CONTROL" -> "SECURITY_CONTROL"
        id                        = "REDACTED"
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

And here is the error:

aws_securityhub_account.this: Modifying... [id=REDACTED]
╷
│ Error: updating Security Hub Account (REDACTED): InvalidAccessException: Request contains configurations that cannot be updated by a member account REDACTED
│ {
│   RespMetadata: {
│     StatusCode: 401,
│     RequestID: "21556c54-f1f7-44bd-93f1-0aa7bec22c5d"
│   },
│   Code_: "InvalidAccessException",
│   Message_: "Request contains configurations that cannot be updated by a member account REDACTED"
│ }
│
│   with aws_securityhub_account.this,
│   on main.tf line 1, in resource "aws_securityhub_account" "this":
│    1: resource "aws_securityhub_account" "this" {}

[lorengordon]

This feature added in this pr is the source of the issue... #30692

[lorengordon]

@justinretzolk Anything else you need on this one?

[justinretzolk]

Hey @lorengordon 👋 Thank you for checking in on this! Providing a sample Terraform configuration that can reproduce this issue, as well as debug logs (redacted as needed) would be helpful if you're able to provide them. Unfortunately I can't provide an ETA on when this will be looked into due to the potential of shifting priorities. We prioritize by count of 👍 reactions and a few other things (more information on our prioritization guide if you're interested).

[lorengordon]

The plan I posted above basically has the config that is the problem. There isn't much more to it. It seems any version of the aws provider >= 4.64.0 is broken for the aws_securityhub_account resource, when securityhub is managed by the org, and the org has enabled the aggregated securityhub findings.

[lorengordon]

Oh, also finding that the aws_securityhub_account resource is broken in the aws-us-gov partition since 4.64.0, since that partition does not yet support control_finding_generator. Also somehow the default value the provider is sending through is SECURITY_CONTROL, which just seems wrong in general since AWS defaults to STANDARD_CONTROL and requires explicitly enabling SECURITY_CONTROL in Security Hub.

Minimal reproducing config is just:

resource "aws_securityhub_account" "this" {}

results in:

  # aws_securityhub_account.this will be updated in-place
  ~ resource "aws_securityhub_account" "this" {
      + control_finding_generator = "SECURITY_CONTROL"

which can actually apply successfully, somehow, but then results in a perpetual diff

[mdolian]

We are also running into this:

resource "aws_securityhub_account" "main" {}

Results in:

module.security.module.nyl-securityhub.aws_securityhub_account.main
update
control_finding_generator :
"STANDARD_CONTROL"
change to
"SECURITY_CONTROL"
no-op
id :
"709321817338"


Error: updating Security Hub Account (709321817338): InvalidAccessException: Request contains configurations that cannot be updated by a member account 709321817338 { RespMetadata: { StatusCode: 401, RequestID: "f32fd578-1617-4bca-af5e-19fc5e97d4dc" }, Code_: "InvalidAccessException", Message_: "Request contains configurations that cannot be updated by a member account 709321817338" }
with module.security.module.nyl-securityhub.aws_securityhub_account.main
on .terraform/modules/security/modules/terraform-aws-nyl-securityhub/main.tf line 1, in resource "aws_securityhub_account" "main":
resource "aws_securityhub_account" "main" {}

[calvin-ntier]

setting it explicitly at member account is a workaround:

resource "aws_securityhub_account" "_" {
control_finding_generator = "STANDARD_CONTROL"
}

[github-actions]

This functionality has been released in v5.14.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.