resource/aws_kms_key: Prevent eventual consistency related errors on creation #12738
Conversation
…creation Reference: #9953 Reference: #11781 Reference: #12427 (comment) This refactors the resource logic to prevent `Update` after `Create` type logic errors with duplicate API calls (potential error points for eventual consistency): - Setting `description` on creation previously was done once during the `CreateKey` call and again via a separate `UpdateKeyDescription` call - Setting `policy` on creation previously was done once during the `CreateKey` call and again via a separate `PutKeyPolicy` call - Setting `tags` on creation previously was done once during the `CreateKey` call and again via a separate `TagResource` call This also adds eventual consistency retries for reading tags on resource creation and removes the resource `Exists` function, which can be another source of issues and required for the upcoming Terraform Plugin SDK v2. Previously from operator error reports: ``` Error: error listing tags for KMS Key (***): NotFoundException: Key 'arn:aws:kms:***:key/***' does not exist Error: error updating KMS Key (key-123) tags: error tagging resource (key-123): NotFoundException: Key 'arn:aws:kms:us-east-1:1234567890:key/key-123' does not exist ``` Output from acceptance testing: ``` --- PASS: TestAccAWSKmsKey_disappears (14.50s) --- PASS: TestAccAWSKmsKey_asymmetricKey (40.34s) --- PASS: TestAccAWSKmsKey_basic (43.60s) --- PASS: TestAccAWSKmsKey_policy (58.38s) --- PASS: TestAccAWSKmsKey_tags (59.07s) --- PASS: TestAccAWSKmsKey_isEnabled (324.81s) ```
ghost
added
needs-triage
bflad
removed
the
needs-triage
There was a problem hiding this comment.
LGTM 🚀
--- PASS: TestAccAWSKmsKey_disappears (6.66s)
--- PASS: TestAccAWSKmsKey_asymmetricKey (25.91s)
--- PASS: TestAccAWSKmsKey_basic (26.05s)
--- PASS: TestAccAWSKmsKey_policy (31.29s)
--- PASS: TestAccAWSKmsKey_tags (31.52s)
--- PASS: TestAccAWSKmsKey_isEnabled (299.63s)
|
This has been released in version 2.57.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks! |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks! |
ghost
locked and limited conversation to collaborators
Community Note
Reference: #9953
Closes #11781
Reference: #12427 (comment)
Release note for CHANGELOG:
This refactors the resource logic to prevent
UpdateafterCreatetype logic errors with duplicate API calls (potential error points for eventual consistency):descriptionon creation previously was done once during theCreateKeycall and again via a separateUpdateKeyDescriptioncallpolicyon creation previously was done once during theCreateKeycall and again via a separatePutKeyPolicycalltagson creation previously was done once during theCreateKeycall and again via a separateTagResourcecallThis also adds eventual consistency retries for reading tags on resource creation and removes the resource
Existsfunction, which can be another source of issues and required for the upcoming Terraform Plugin SDK v2.Previously from operator error reports:
Output from acceptance testing: