redacted_fields arguments for resource aws_wafv2_web_acl_logging_configuration are not making changes on AWS

[jiwuh]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

• Terraform version: 0.13.0

• AWS Provider Version: 2.70.0

Affected Resource(s)

• aws_wafv2_web_acl_logging_configuration

Terraform Configuration Files

resource "aws_wafv2_web_acl_logging_configuration" "example" {
  log_destination_configs = ["${aws_kinesis_firehose_delivery_stream.example.arn}"]
  resource_arn            = "${aws_wafv2_web_acl.example.arn}"
  redacted_fields {
    all_query_arguments { }
    uri_path { }
    method { }
    body { }
    query_string { }
  }
}

Expected Behavior

The data fields passed are selected on the AWS console as shown below:

Actual Behavior

Some fields are not present on the AWS Console and even the ones present do not seem to take effect - there's no error message - but also there's no effect.
Also, the configurations are are identified as new changes each time "terraform plan" is run

Steps to Reproduce

1. terraform apply

[anGie44]

Hi @jiwuh, thank you for reporting this issue! I can confirm this is definitely a bug in the provider when the redacted_fields block is configured with one of method , uri_path, or query_string as they are empty blocks {}. Please note that while our documentation indicates there are several fields supported within the redacted_fields configuration block and the WAFv2 API defines the block as https://docs.aws.amazon.com/waf/latest/APIReference/API_LoggingConfiguration.html and https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html , only the 4 fields you see in the console are indeed valid attributes.In the linked PR, our documentation and the resource schema will reflect this.

In addition, in cases where you want to redact several fields like in the example you've provided, while the Provider will not error at plan-time, the redacted_fields block should only support one nested field at a time as the WAF API returns an error when more than 1 field is specified (not something I believe is documented well in the WAFv2 API docs). Thus do this, your example could be updated with:

resource "aws_wafv2_web_acl_logging_configuration" "example" {
  log_destination_configs = ["${aws_kinesis_firehose_delivery_stream.example.arn}"]
  resource_arn            = "${aws_wafv2_web_acl.example.arn}"
  
  redacted_fields {
    uri_path {}
  }

  redacted_fields {
    method {}
  }

  redacted_fields {
    query_string {}
  }
}

^^ This example, however, will only be doable with the proposed fixed in #14319 as we still have the issue where fields represented by the empty block {} are not picked up correctly w/in the provider.

Hope this helps clarify the discrepancy you are seeing between the Console and the Provider configuration! If you have any further questions, please let me know 😃

[ghost]

This has been released in version 3.33.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!