[Bug]: State drift always appears on aws_costoptimizationhub_enrollment_status

[braunsonm]

Terraform Core Version

v1.9.5

AWS Provider Version

5.69.0

Affected Resource(s)

• aws_costoptimizationhub_enrollment_status

Expected Behavior

The resource should not have state drift on every apply

Actual Behavior

The resource reports include_member_accounts being set to false on every apply

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_costoptimizationhub_enrollment_status" "cost_optimization_enrollment" {
include_member_accounts = false
}

Steps to Reproduce

Apply the resource twice. Notice the output:

  # aws_costoptimizationhub_enrollment_status.cost_optimization_enrollment will be updated in-place
  ~ resource "aws_costoptimizationhub_enrollment_status" "cost_optimization_enrollment" {
      + include_member_accounts = false
      ~ status                  = "Active" -> (known after apply)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Have been unable to get this property to be ignored even with ignore_changes

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[acwwat]

Looks like there is already some discussions on this matter in #36440.

In this case, we have a tri-state type of situation where include_member_accounts is null for non-management accounts, but it's is true or false for management accounts. So I don't think it makes sense to set a default value. If I remove it and not include it in the TF config for non-management account, it no longer creates a drift. But it probably also means that there could be a drift for the management account use case, in which case one must set include_member_accounts explicitly.

@YakDriver @madhavvishnubhatta What are your thoughts on this issue?