aws_route53_resolver_rule data lookup tag error

[justicel]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

v0.11.14

Affected Resource(s)

• data.aws_route53_resolver_rule
• data.aws_route53_resolver_rules

Terraform Configuration Files

data "aws_route53_resolver_rule" "dns_ram" {
  count       = "${length(var.forward_zones)}"
  domain_name = "${var.forward_zones[count.index]}"
  depends_on = ["aws_ram_resource_share_accepter.dns_ram"]
}

Expected Behavior

Should have done a data lookup and located route53 resolver rule(s).

Actual Behavior

Terraform returns an error that you are not authorized to look at tags on shared resource:

* module.share.data.aws_route53_resolver_rule.dns_ram[2]: data.aws_route53_resolver_rule.dns_ram.2: error reading Route 53 Resolver rule (rslvr-rr-190b4db83f3b4b148) tags: InvalidParameterException: [RSLVR-00900] Invalid arn: "[RSLVR-00907] You are not authorized to do this operation on shared resource"
status code: 400, request id: 26e84b24-6b23-48a3-b51f-807ef47ee0cf
* module.share.data.aws_route53_resolver_rule.dns_ram[4]: data.aws_route53_resolver_rule.dns_ram.4: error reading Route 53 Resolver rule (rslvr-rr-9426511912e444d59) tags: InvalidParameterException: [RSLVR-00900] Invalid arn: "[RSLVR-00907] You are not authorized to do this operation on shared resource"

Steps to Reproduce

1. terraform apply

Important Factoids

This is a shared resolver rule set from another AWS account. The share was accepted and the rules show up in our account. This appears to be a bug in that you cannot lookup tags of a shared rule via the AWS API.

[ewbankkit]

Related:

• New data sources: aws_route53_resolver_rule and aws_route53_resolver_rules #9085

[ewbankkit]

OK, I can reproduce with an acceptance test case:

$ AWS_ALTERNATE_ACCESS_KEY_ID=AAAAAAAAAAAAAAAAAAAA AWS_ALTERNATE_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -count 1 -parallel 20 -run=TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe -timeout 120m
=== RUN   TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
=== PAUSE TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
=== CONT  TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
--- FAIL: TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe (215.89s)
    testing.go:569: Step 0 error: errors during apply:
        
        Error: error reading Route 53 Resolver rule (rslvr-rr-5587d23bbd0b4427b) tags: InvalidParameterException: [RSLVR-00907] You are not authorized to do this operation on shared resource
        	status code: 400, request id: e29548bf-4df3-49e5-8539-ce527aea6562
        
          on /var/folders/4j/lf5jdq5j4y91g80ytf6qzjwmk6drp5/T/tf-test261069804/main.tf line 147:
          (source code not available)
        
        
FAIL
FAIL	github.com/terraform-providers/terraform-provider-aws/aws	215.980s
FAIL
make: *** [testacc] Error 1

[ewbankkit]

I wonder if the same applies to other RAM shareable resources with tags (and data sources)?

• aws_ec2_transit_gateway - No separate API call to retrieve tags as they are returned in DescribeTransitGateways. OK
• aws_subnet - No separate API call to retrieve tags as they are returned in DescribeSubnets. OK
• aws_rds_cluster for Aurora clusters - Tags are retrieved in separate API call. Not supported currently - See below.

[dbaggerman]

Just checked our TGW shares. DescribeTransitGateways in the account being shared to doesn't error, but it returns an empty Tags array despite the shared TGW having tags in the source account.

I don't have any shares of the other resource types to check.

[ewbankkit]

@dbaggerman Thanks for checking that. It looks like it may just be Aurora RDS clusters that could cause a similar problem; I'll investigate that.
I have finished the PR to fix the Route 53 Resolver rules problem: #10348.

[ewbankkit]

Aurora cross-account cloning uses the RDS point-in-time restore mechanism.
There is an PR to support this, I'll add a note to consider investigating this case to that PR.

[bflad]

The fix for this has been merged and will release with version 2.35.0 of the Terraform AWS Provider, Thursday. Thanks to @ewbankkit for the fix. 👍

[ghost]

This has been released in version 2.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!