aws_cloudwatch_log_group w/ retention_in_days set results in no arn

[mdxp]

When using retention_in_days set on a cloudwatch log group, the arn is not added to the state. If no retention is set this works as expected. This causes problems (failures like above) if trying to use the resulting log group:

* Resource 'aws_cloudwatch_log_group.test' does not have attribute 'arn' for variable 'aws_cloudwatch_log_group.test.arn'

Terraform Version

Terraform v0.6.14

Affected Resource(s)

• aws_cloudwatch_log_group

Terraform Configuration Files

resource "aws_cloudwatch_log_group" "test" {
  name = "test"
  retention_in_days = 7
}

tfstate

"resources": {
                "aws_cloudwatch_log_group.cloudtrail": {
                    "type": "aws_cloudwatch_log_group",
                    "primary": {
                        "id": "test",
                        "attributes": {
                            "id": "test",
                            "name": "test",
                            "retention_in_days": "7"
                        }
                    }
                }
            }

The state is missing the arn and assuming that is referenced by any other resource it will obviously fail. On the second run (refresh) it will update it and add the arn to the state and work successfully. Verified and without the retention_in_days defined this woks fine.

The arn looks like: "arn": "arn:aws:logs:us-east-1:XXX:log-group:test:*",

[stack72]

@mdxp

Well this is a great find. I was able to recreate this perfectly with the following config:

resource "aws_cloudwatch_log_group" "test" {
  name = "test"
  retention_in_days = 7
}

output "arn" {
    value = "${aws_cloudwatch_log_group.test.arn}"
}

Terraform apply gave the following:

terraform apply
aws_cloudwatch_log_group.test: Creating...
  arn:               "" => "<computed>"
  name:              "" => "test"
  retention_in_days: "" => "7"
aws_cloudwatch_log_group.test: Creation complete

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: terraform.tfstate

As you can see, no output:

terraform output
The state file has no outputs defined. Define an output
in your configuration with the `output` directive and re-run
`terraform apply` for it to become available.

on refreshing the state, I was able to get the output:

terraform plan
Refreshing Terraform state prior to plan...

aws_cloudwatch_log_group.test: Refreshing state... (ID: test)

No changes. Infrastructure is up-to-date. This means that Terraform
could not detect any differences between your configuration and
the real physical resources that exist. As a result, Terraform
doesn't need to do anything.
a % terraform output
arn = arn:aws:logs:us-west-2:xxxxx:log-group:test:*

[stack72]

This means there is a missing state check on this somewhere... I will raise this with AWS now

aws/aws-sdk-go#650

[stack72]

Hi @mdxp

I finally found the issue here :) PR has been submitted to fix it!

P.

[mdxp]

Awesome; many thanks! looking forward to test it out.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.