aws_codepipeline_webhook doesn't support update

[zentavr]

Terraform Version

$ terraform -v
Terraform v0.11.11
+ provider.aws v2.2.0
+ provider.github v1.3.0
+ provider.local v1.1.0
+ provider.null v2.1.0
+ provider.random v2.0.0
+ provider.template v1.0.0

Your version of Terraform is out of date! The latest version
is 0.11.13. You can update by downloading from www.terraform.io/downloads.html

Affected Resource(s)

• aws_codepipeline_webhook

Terraform Configuration Files

# Create a Hook URL in Codepipeline
resource "aws_codepipeline_webhook" "github" {
  name  = "${var.app_environment}-${var.service_name}-webhook"
  count = "${var.enable_hooks}"

  # We are fetching the stage name dynamically
  #   The name of the action in a pipeline you want to connect to the webhook.
  #   The action must be from the source (first) stage of the pipeline.
  target_action = "${aws_codepipeline.pipeline.stage.0.action.0.name}"

  target_pipeline = "${aws_codepipeline.pipeline.name}"

  authentication = "GITHUB_HMAC"

  authentication_configuration {
    secret_token = "${sha1("${lookup(var.github, "branch")}+${lookup(var.github, "token")}")}"
  }

  filter {
    json_path    = "$.ref"
    match_equals = "refs/heads/{Branch}"
  }
}

# Wire the CodePipeline webhook into a GitHub repository.
resource "github_repository_webhook" "dashboard" {
  count      = "${var.enable_hooks}"
  repository = "${var.github["repo"]}"
  name       = "web"

  configuration {
    url          = "${aws_codepipeline_webhook.github.0.url}"
    content_type = "json"
    insecure_ssl = false
    secret       = "${sha1("${lookup(var.github, "branch")}+${lookup(var.github, "token")}")}"
  }

  events = [
    "push",
  ]
}

Debug Output

...
...
Do you want to perform these actions in workspace "nirvana"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes
...
...
module.codepipeline_dashboard.aws_codepipeline_webhook.github: Modifying... (ID: arn:aws:codepipeline:us-west-2:203867187697:webhook:nirvana-dashboard-webhook)
  authentication_configuration.0.secret_token: "<sensitive>" => "<sensitive>"
2019/03/20 01:18:43 [ERROR] root.codepipeline_dashboard: eval: *terraform.EvalApplyPost, err: 1 error(s) occurred:

* aws_codepipeline_webhook.github: doesn't support update
2019/03/20 01:18:43 [ERROR] root.codepipeline_dashboard: eval: *terraform.EvalSequence, err: 1 error(s) occurred:

* aws_codepipeline_webhook.github: doesn't support update

Panic Output

Error: Error applying plan:

1 error(s) occurred:
* module.codepipeline_dashboard.aws_codepipeline_webhook.github: 1 error(s) occurred:
* aws_codepipeline_webhook.github: doesn't support update

Expected Behavior

A webhook should be updated or re-created (deleted/created again). If this is not possible - update the doc and tell the audience that the secret is not changable.

Actual Behavior

Webhook cannot be updated

Steps to Reproduce

1. Set up the secret
2. terraform apply
3. Change the secret
4. ...have an error ...

[zentavr]

The workaround is the next:

1. List the webhooks:
   aws codepipeline list-webhooks --region "us-west-2"
2. Find yours and delete that. Be very careful!!!
   aws codepipeline delete-webhook --region "us-west-2" --name "nirvana-dashboard-webhook"
3. Refresh the state file with terraform refresh. More verbose command you can find here
4. Try to re-apply.

[russmac]

Also exists in in 0.12.5

[mwarkentin]

You can use taint to simplify the update process (forcing delete + recreate) - but yeah this seems like it should be handled by TF itself.

[ewbankkit]

PR #11387 submitted to fix this problem.

[bflad]

The fix for this has been merged and will release with version 2.45.0 of the Terraform AWS Provider, Thursday next week. Thanks to @ewbankkit for the implementation. 👍

[ghost]

This has been released in version 2.45.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!