Policy not Applied for Private API Gateway Resource Policy

[ghost]

This issue was originally opened by @jkdll as hashicorp/terraform#25850. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Hi,
Given an aws_api_gateway_rest_api resource for an API Gateway set to private:

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
data "aws_vpc" "vpc_sample" {
  filter {
      name = "tag:Name" 
      values = ["sample-vpc-name"]
  }
}

data "aws_vpc_endpoint" "api_vpc_endpoint" {
  vpc_id       = data.aws_vpc.vpc_sample.id
  service_name = "com.amazonaws.${data.aws_region.current.name}.execute-api"
}

resource "aws_api_gateway_rest_api" "res_rest_api" {
  name           = "sample-rest-api"
  api_key_source = "HEADER"
  endpoint_configuration {
    types = ["PRIVATE"]
    vpc_endpoint_ids = ["${data.aws_vpc_endpoint.api_vpc_endpoint.id}"]
  }
  body = var.service_spec
  policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*",
            "Condition": {
                "NotIpAddress": {
                    "aws:VpcSourceIp": "10.0.0.0/8"
                }
            }
        }
    ]
}
  EOF

}

Upon Apply I get the following error:

Error: Error creating API Gateway Deployment: BadRequestException: Private REST API doesn't have a resource policy attached to it

The code requires a second Apply command to successfully apply the resource policy.

This looks like a bug, can someone please confirm that it is a bug? If not how can it be remedied to ensure that the policy is applied at the first apply?

Terraform Version: 0.12.6
AWS Provider Plugin Version: 3.2.0
Template Provider Plugin Version: 2.1.2

[bflad]

Fixes for the aws_api_gateway_rest_api resource handling of api_key_source, binary_media_types, description, minimum_compression_size, name, and policy configuration values will now be correctly applied as an override after OpenAPI specification import (body argument) on resource creation and update. This will release with version 3.25.0 of the Terraform AWS Provider, likely tomorrow.

For further feature requests, documentation updates, or bug reports with this functionality after it is released and upgrading the provider, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

This has been released in version 3.25.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!