aws_config_configuration_aggregator: Provider produced inconsistent result after apply

[jdeluyck]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.20

• provider.aws v2.46.0

Affected Resource(s)

• aws_config_configuration_aggregator

Terraform Configuration Files

org_account_ids is passed on commandline via

-var org_account_ids=XXX,YYY,ZZZ

resource "aws_config_configuration_aggregator" "lz_aggregator" {
  name = "AGGREGATOR"

  account_aggregation_source {
    account_ids = split(",", var.org_account_ids)
    regions     = ["eu-west-1", "eu-central-1"]
  }
}

Debug Output

2020-01-27T13:14:01.449+0100 [DEBUG] plugin.terraform-provider-aws_v2.46.0_x4: 2020/01/27 13:14:01 [WARN] No such configuration aggregator (aggregator), removing from state
2020/01/27 13:14:01 [DEBUG] aws_config_configuration_aggregator.lz_aggregator: apply errored, but we're indicating that via the Error pointer rather than returning it: Provider produced inconsistent result after apply: When applying changes to aws_config_configuration_aggregator.lz_aggregator, provider "registry.terraform.io/-/aws" produced an unexpected new value for was present, but now absent.

Panic Output

Error: Provider produced inconsistent result after apply

When applying changes to aws_config_configuration_aggregator.lz_aggregator,
provider "registry.terraform.io/-/aws" produced an unexpected new value for
was present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Expected Behavior

  # aws_config_configuration_aggregator.lz_aggregator will be created
  + resource "aws_config_configuration_aggregator" "lz_aggregator" {
      + arn  = (known after apply)
      + id   = (known after apply)
      + name = "AGGREGATOR"

      + account_aggregation_source {
          + account_ids = [
              + "XXX",
              + "YYY",
              + "ZZZ",
            ]
          + all_regions = false
          + regions     = [
              + "eu-west-1",
              + "eu-central-1",
            ]
        }
    }

Actual Behavior

Bombed out with error

Steps to Reproduce

HCL listed above

1. terraform apply

Important Factoids

Important fact: the aggregator is specified in full caps in the tf code, but the debug output returns it in lowercase.

I've manually imported the aggregator in the state file using

terraform import aws_config_configuration_aggregator.lz_aggregator AGGREGATOR

and now it deploys without issues (and doesn't try to redeploy it).

This came to light in the terraform 0.11 to 0.12 upgrade.

References

• #0000

[DrFaust92]

i think this has got to do with the fact that when setting the id for the resource for some reason a tolower func was used:
d.SetId(strings.ToLower(name))
and when reading it uses the lower case name (in you case it was only upper case):
req := &configservice.DescribeConfigurationAggregatorsInput{ ConfigurationAggregatorNames: []*string{aws.String(d.Id())}, }

this is my hunch.

[DrFaust92]

update:

i am able to recreate the problem the TestAccAWSConfigConfigurationAggregator_account acceptance test when using an upper case name.

it seems that this will be a breaking change to fix this, it's a small change but i will wait for maintaners to respond for a second opinion.

[jdeluyck]

Any idea what would happen with this?

[jrgwv]

Is there a workaround available? I have encountered this issue too. When I build locally on Mac works find when I build in a container on Jenkins produces "registry.terraform.io/-/aws" produced an unexpected new value for was present, but now absent."

[DrFaust92]

If it's possible use a lower case name for the resource, that should workaround this for now

[jrgwv]

Thanks will give that a try

[jdeluyck]

Unfortunately this keeps popping up from time to time for me.

[idnorton]

Had the issue with Terraform v0.12.28 and provider.aws v3.13.0.
Can confirm that changing the name to lower case fixed the issue.

[denisse-dev]

Any updates on this? This issue has been open for almost a year and it's still giving problems.

[rtoma]

Same with:

Terraform v0.14.7
+ provider registry.terraform.io/hashicorp/aws v3.31.0

... using:

resource "aws_config_configuration_aggregator" "default" {
  name = "OrganizationAllAccountsAllRegions"
  organization_aggregation_source {
    all_regions = true
    role_arn    = aws_iam_role.organization.arn
  }
  depends_on = [aws_iam_role_policy_attachment.organization]
}

This fails. Fixed by changing aws_config_configuration_aggregator.name to not contain upper case characters (eg org-all-accounts-all-regions).

And as mentioned before. Even though terraform fails, the aggregator with capitals is created:

[ghost]

This has been released in version 3.34.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!