aws_acm_certificate with subject_alternative_names not maintaining order

[ghost]

This issue was originally opened by @giridharmp as hashicorp/terraform#21229. It was migrated here as a result of the provider split. The original body of the issue is below.

---

I am creating an AWS ACM certificate with the below terraform code:

resource "aws_acm_certificate" "alb_certificate" {
domain_name = "${var.subdomain}"
validation_method = "DNS"

subject_alternative_names = ["api.example.com","kib.example.com","gra.example.com","pro.example.com","proapp.example.com","prom.example.com","promfro.example.com","dash.example.com","pgad.example.com"]
}

When we used to look into the issued certificate, in the additional names section, the above order in subject_alternative_names used to be maintained. But suddenly when we tried recently, the order is not being maintained and the names are getting used randomly. Because of this, when we refresh or want to update any other resource, a new certificate is always getting issued.

But the terraform plan is showing as below:
aws_acm_certificate.alb_certificate: Creating...
arn: "" => ""
domain_name: "" => "np"
domain_validation_options.#: "" => ""
subject_alternative_names.#: "" => "9"
subject_alternative_names.0: "" => "api.example.com"
subject_alternative_names.1: "" => "kib.example.com"
subject_alternative_names.2: "" => "gra.example.com"
subject_alternative_names.3: "" => "pro.example.com"
subject_alternative_names.4: "" => "proapp.example.com"
subject_alternative_names.5: "" => "prom.example.com"
subject_alternative_names.6: "" => "promfro.example.com"
subject_alternative_names.7: "" => "dash.example.com"
subject_alternative_names.8: "" => "pgad.example.com"
validation_emails.#: "" => ""
validation_method: "" => "DNS"

[avestalea]

I am noticing, for me so far only in AWS ap-southeast-2 - that SAN ordering for ACM certificates appears to be being requested correctly by terraform, but the actual SAN ordering as determined by terraform after creation is basically random after each creation. This causes terraform to destroy and re-create every time. I will try to get a test example

[tdmalone]

Duplicates #8531 & #8543

[sgran]

we are seeing this as well. Let me know if I can provide any additional information.

[robbwagoner]

I am also seeing this behavior.

[tdmalone]

@sgran & @robbwagoner - add a thumbs up reaction to the first post in #8531; it’ll help raise the priority of the problem

[axw-pivorra]

Bypass proposed in #8531

[nanohest]

if this is region specific, eu-west-1 and eu-central-1 are affected too

[nywilken]

This is issue is being tracked on #8531

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!