[Bug]: sagemaker.expandCanvasAppSettings exception in AWS 5.25 provider

[damianslee]

Terraform Core Version

1.6.3

AWS Provider Version

5.25.0

Affected Resource(s)

resource "aws_sagemaker_domain" "domain" {
default_user_settings {

 }

snippet from aws sagemaker describe-domain

"DefaultUserSettings": {
        "CanvasAppSettings": {
            "WorkspaceSettings": {
                "S3ArtifactPath": "s3://somebucket",
                "S3KmsKeyId": "arn:aws:kms:ap-southeast-2:12345678:key/8c819a52-3167-4d73-86ce-xxxxxxxxxx"
            },
            "IdentityProviderOAuthSettings": [
            ]
        }
   }

Expected Behavior

can make any canvas changes.
reverted to 5.24 and error went away

Actual Behavior

exception in
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.expandCanvasAppSettings({0xc002ac0ad0?, 0xc00463b0b0?, 0xe27c8ce?})
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/domain.go:1211 +0x533

Relevant Error/Panic Output Snippet

Stack trace from the terraform-provider-aws_v5.25.0_x5 plugin:

panic: interface conversion: interface {} is *schema.Set, not []interface {}

goroutine 378 [running]:
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.expandCanvasAppSettings({0xc002ac0ad0?, 0xc00463b0b0?, 0xe27c8ce?})
	github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/domain.go:1211 +0x533
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.expandDomainDefaultUserSettings({0xc002ac0a40?, 0xe239a6d?, 0xc0044dfe30?})
	github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/domain.go:1009 +0xbf
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.resourceUserProfileUpdate({0xf5fc220, 0xc0044dfe30}, 0xc002cb8000, {0xe1a8680?, 0xc0002c8b40})
	github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/user_profile.go:577 +0x1fc
github.com/hashicorp/terraform-provider-aws/internal/provider.interceptedHandler[...].func1(0x0?, {0xe1a8680?, 0xc0002c8b40?})
	github.com/hashicorp/terraform-provider-aws/internal/provider/intercept.go:111 +0x32d
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).update(0xf5fc220?, {0xf5fc220?, 0xc004362c90?}, 0xd?, {0xe1a8680?, 0xc0002c8b40?})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:807 +0x87
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc001b4d340, {0xf5fc220, 0xc004362c90}, 0xc00436c410, 0xc0042e3400, {0xe1a8680, 0xc0002c8b40})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:919 +0x845
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc001c0dc20, {0xf5fc220?, 0xc004362b70?}, 0xc0042cd590)
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/grpc_provider.go:1060 +0xe8d
github.com/hashicorp/terraform-plugin-mux/tf5muxserver.(*muxServer).ApplyResourceChange(0xf5fc178?, {0xf5fc220?, 0xc004362840?}, 0xc0042cd590)
	github.com/hashicorp/terraform-plugin-mux@v0.12.0/tf5muxserver/mux_server_ApplyResourceChange.go:36 +0x1b5
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ApplyResourceChange(0xc00095b9a0, {0xf5fc220?, 0xc004362030?}, 0xc004356a80)
	github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/tf5server/server.go:859 +0x574
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler({0xdf2bb60?, 0xc00095b9a0}, {0xf5fc220, 0xc004362030}, 0xc004356a10, 0x0)
	github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:467 +0x170
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000114d20, {0xf60a9a0, 0xc0034464e0}, 0xc004346d80, 0xc004030870, 0x15c32db8, 0x0)
	google.golang.org/grpc@v1.58.2/server.go:1376 +0xdd2
google.golang.org/grpc.(*Server).handleStream(0xc000114d20, {0xf60a9a0, 0xc0034464e0}, 0xc004346d80, 0x0)
	google.golang.org/grpc@v1.58.2/server.go:1753 +0xa36
google.golang.org/grpc.(*Server).serveStreams.func1.1()
	google.golang.org/grpc@v1.58.2/server.go:998 +0x98
created by google.golang.org/grpc.(*Server).serveStreams.func1
	google.golang.org/grpc@v1.58.2/server.go:996 +0x18c

Error: The terraform-provider-aws_v5.25.0_x5 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Operation failed: failed running terraform apply (exit 1)�

Terraform Configuration Files

sagemaker_user_profile {
user_settings {
canvas_app_settings {
}
}
}

Steps to Reproduce

1. Apply canvas configuration state using older TF aws version. eg 5.20
2. We do have identity_provider_oauth_settings settings applied using AWS CLI
3. Change tf aws version to 5.25.0. apply throws exception

Debug Output

No response

Panic Output

Stack trace from the terraform-provider-aws_v5.25.0_x5 plugin:

panic: interface conversion: interface {} is *schema.Set, not []interface {}

goroutine 378 [running]:
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.expandCanvasAppSettings({0xc002ac0ad0?, 0xc00463b0b0?, 0xe27c8ce?})
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/domain.go:1211 +0x533
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.expandDomainDefaultUserSettings({0xc002ac0a40?, 0xe239a6d?, 0xc0044dfe30?})
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/domain.go:1009 +0xbf
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker.resourceUserProfileUpdate({0xf5fc220, 0xc0044dfe30}, 0xc002cb8000, {0xe1a8680?, 0xc0002c8b40})
github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker/user_profile.go:577 +0x1fc
github.com/hashicorp/terraform-provider-aws/internal/provider.interceptedHandler[...].func1(0x0?, {0xe1a8680?, 0xc0002c8b40?})
github.com/hashicorp/terraform-provider-aws/internal/provider/intercept.go:111 +0x32d
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).update(0xf5fc220?, {0xf5fc220?, 0xc004362c90?}, 0xd?, {0xe1a8680?, 0xc0002c8b40?})
github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:807 +0x87
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc001b4d340, {0xf5fc220, 0xc004362c90}, 0xc00436c410, 0xc0042e3400, {0xe1a8680, 0xc0002c8b40})
github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:919 +0x845
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc001c0dc20, {0xf5fc220?, 0xc004362b70?}, 0xc0042cd590)
github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/grpc_provider.go:1060 +0xe8d
github.com/hashicorp/terraform-plugin-mux/tf5muxserver.(*muxServer).ApplyResourceChange(0xf5fc178?, {0xf5fc220?, 0xc004362840?}, 0xc0042cd590)
github.com/hashicorp/terraform-plugin-mux@v0.12.0/tf5muxserver/mux_server_ApplyResourceChange.go:36 +0x1b5
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ApplyResourceChange(0xc00095b9a0, {0xf5fc220?, 0xc004362030?}, 0xc004356a80)
github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/tf5server/server.go:859 +0x574
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler({0xdf2bb60?, 0xc00095b9a0}, {0xf5fc220, 0xc004362030}, 0xc004356a10, 0x0)
github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:467 +0x170
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000114d20, {0xf60a9a0, 0xc0034464e0}, 0xc004346d80, 0xc004030870, 0x15c32db8, 0x0)
google.golang.org/grpc@v1.58.2/server.go:1376 +0xdd2
google.golang.org/grpc.(*Server).handleStream(0xc000114d20, {0xf60a9a0, 0xc0034464e0}, 0xc004346d80, 0x0)
google.golang.org/grpc@v1.58.2/server.go:1753 +0xa36
google.golang.org/grpc.(*Server).serveStreams.func1.1()
google.golang.org/grpc@v1.58.2/server.go:998 +0x98
created by google.golang.org/grpc.(*Server).serveStreams.func1
google.golang.org/grpc@v1.58.2/server.go:996 +0x18c

Error: The terraform-provider-aws_v5.25.0_x5 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Operation failed: failed running terraform apply (exit 1)�

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[damianslee]

I think the bug is these lines in which are expecting these optional Canvas configuration

terraform-provider-aws/internal/service/sagemaker/domain.go

Lines 1210 to 1217 in 1afa91e

	config := &sagemaker.CanvasAppSettings{
	IdentityProviderOAuthSettings: expandIdentityProviderOAuthSettings(m["identity_provider_oauth_settings"].([]interface{})),
	DirectDeploySettings: expandDirectDeploySettings(m["direct_deploy_settings"].([]interface{})),
	KendraSettings: expandKendraSettings(m["kendra_settings"].([]interface{})),
	ModelRegisterSettings: expandModelRegisterSettings(m["model_register_settings"].([]interface{})),
	TimeSeriesForecastingSettings: expandTimeSeriesForecastingSettings(m["time_series_forecasting_settings"].([]interface{})),
	WorkspaceSettings: expandWorkspaceSettings(m["workspace_settings"].([]interface{})),
	}

[damianslee]

testing this further, it is "aws_sagemaker_user_profile" causing the exception as soon as anything in canvas_app_settings is set

here is an example

resource "aws_sagemaker_domain" "domain" {
  domain_name             = "test-domain"
  auth_mode               = "IAM"
  vpc_id                  = "vpc-xx"
  subnet_ids              = ["subnet-xx"]
  app_network_access_type = "VpcOnly"
  
  default_user_settings {
     execution_role = "arn:aws:iam::12345678:role/exec-myrole"
  } 
}


resource "aws_sagemaker_user_profile" "sagemaker_user_profile" {

  user_profile_name = "damian-slee"
  domain_id         = aws_sagemaker_domain.domain.id

  user_settings {
    execution_role = "arn:aws:iam::12345678:role/exec-myrole"

	canvas_app_settings {
		time_series_forecasting_settings {
		  status = "ENABLED"
		}
	}
  }
}

[bala-auvaria]

Have the same issue,

[damianslee]

Have the same issue,

click the thumbs up reaction at the bottom of the original post to prioritise.

is a priority for me, i'd like to include in deployment in a few weeks, rather than having to use aws cli for lots of sagemaker user profiles.
i have tried building the aws provider to develop a fix, but having troubles building under WSL

[github-actions]

This functionality has been released in v5.26.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.