provider/aws: colon character rejected when used with tags

[StL-Jim]

This has apparently been a long term issues, and I believe it was closed last time because a reproducible example was not provided. This is my attempt to meet that requirement. Some of the data is obviously obfuscated.

These are the tags I would like to add, my example is only for the first tag
"aws:cloudformation:logical-id"
"aws:cloudformation:stack-id"
"aws:cloudformation:stack-name"

Terraform Version

Terraform v0.12.18
provider.aws v2.43.0

Affected Resource(s)

• aws_vpc

Terraform Configuration Files

provider "aws" {
    version                 = "~> 2.43.0"
    region                  = "us-east-1"
    profile                 = "MyProfile"
    shared_credentials_file = "PathToMyCreds"
}

resource "aws_vpc" "Workspaces-VPC2" {
    cidr_block           = "172.48.0.0/16"
    enable_dns_hostnames = true
    enable_dns_support   = true
    instance_tenancy     = "default"

    tags = {
        Name = "Workspaces-VPC2"
        "aws:cloudformation:logical-id" = "VPC"
    }
}

Debug Output

For security reasons, I am not comfortable posting the ~4600 lines of DEBUG output to a public Gist. I have saved it and would be willing to work with a developer directly if it's absolutely necessary to address this issue.

Expected Behavior

Expected behavior is to add/update the VPC tags

Actual Behavior

$ terraform apply --target=aws_vpc.Workspaces-VPC2
aws_vpc.Workspaces-VPC2: Refreshing state... [id=vpc-xxxxxxxxxxxxxxxxx]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
~ update in-place

Terraform will perform the following actions:

aws_vpc.Workspaces-VPC2 will be updated in-place

  ~ resource "aws_vpc" "Workspaces-VPC2" {
        arn                              = "arn:aws:ec2:us-east-1:000000000000:vpc/vpc-xxxxxxxxxxxxxxx"
        assign_generated_ipv6_cidr_block = false
        cidr_block                       = "172.16.0.0/16"
        default_network_acl_id           = "acl-000000000000"
        default_route_table_id           = "rtb-000000000000"
        default_security_group_id        = "sg-000000000000"
        dhcp_options_id                  = "dopt-00000000"
        enable_classiclink               = false
        enable_classiclink_dns_support   = false
        enable_dns_hostnames             = true
        enable_dns_support               = true
        id                               = "vpc-xxxxxxxxxxxxxx"
        instance_tenancy                 = "default"
        main_route_table_id              = "rtb-000000000000"
        owner_id                         = "000000000000"
      ~ tags                             = {
            "Name"                          = "Workspaces-VPC2"
          + "aws:cloudformation:logical-id" = "VPC"
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Resource targeting is in effect

You are creating a plan with the -target option, which means that the result
of this plan may not represent all of the changes requested by the current
configuration.

The -target option is not for routine use, and is provided only for
exceptional situations such as recovering from errors or mistakes, or when
Terraform specifically suggests to use it as part of an error message.

Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

aws_vpc.Workspaces-VPC2: Modifying... [id=vpc-xxxxxxxxxxxxxxx]

Warning: Applied changes may be incomplete

The plan was created with the -target option in effect, so some changes
requested in the configuration may have been ignored and the output values may
not be fully updated. Run the following command to verify that no other
changes are pending:
terraform plan

Note that the -target option is not suitable for routine use, and is provided
only for exceptional situations such as recovering from errors or mistakes, or
when Terraform specifically suggests to use it as part of an error message.

Error: error updating tags: error tagging resource (vpc-xxxxxxxxxxxxxxxx): InvalidParameterValue: Value ( '' ) for parameter Tag key is invalid. Tag key cannot be null or empty.
status code: 400, request id: xxxx111x-1111-4a73-b576-7d4a578d6ddb

on vpc.tf line 51, in resource "aws_vpc" "Workspaces-VPC2":
51: resource "aws_vpc" "Workspaces-VPC2" {

Steps to Reproduce

1. terraform apply

Important Factoids

In this particular situation, I have already imported the VPC and the terraform state file has been updated and I am limiting the apply to a specific target

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request

• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request

• If you are interested in working on this issue or have submitted a pull request, please leave a comment

• #0000

[ewbankkit]

@StL-Jim Thanks for raising this issue and apologies for the delay in responding.
The Resource Tagging Guide mentions that tags whose keys start with aws: can't be managed by Terraform (the underlying AWS APIs forbid this) as they are managed independently by AWS services.
That said, I can reproduce this and agree that we shouldn't error out.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.