tfstate file is showing wrong state when disabling ttl in DynamoDB

[jbigtani]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.12.29

• provider.aws v3.4.0

Affected Resource(s)

• aws_dynamodb_table

Terraform Configuration Files

Step 1: Create dynamodb table with ttl enabled
resource "aws_dynamodb_table" "jb-example" {
  name             = "jb-example"
  hash_key         = "TestTableHashKey"
  billing_mode     = "PAY_PER_REQUEST"
  attribute {
    name = "TestTableHashKey"
    type = "S"
  }
  ttl {
    attribute_name = "TimeToExist"
    enabled        = true
  }
}

Step 2: Remove ttl block to disable it.
resource "aws_dynamodb_table" "jb-example" {
  name             = "jb-example"
  hash_key         = "TestTableHashKey"
  billing_mode     = "PAY_PER_REQUEST"
  attribute {
    name = "TestTableHashKey"
    type = "S"
  }  
}

Expected Behavior

DynamdoDB ttl should have been disabled.

Actual Behavior

TTL is not disabled on the table.
local tfstate gets updated showing ttl disabled.
When you run config with ttl enabled=true, it says no change is required but tfstate still shows ttl disabled .

Steps to Reproduce

1. terraform apply with ttl enabled.
   ttl {
   attribute_name = "TimeToExist"
   enabled = true
   }
2. terraform plan without ttl block.
   ~ ttl {
   - attribute_name = "TimeToExist" -> null
   ~ enabled = true -> false
   }
3. terraform apply without ttl block.
   Error: error updating DynamoDB Table (jb-example) time to live: error updating DynamoDB Table (jb-example) Time To Live: InvalidParameter: 1 validation error(s) found.

• minimum field size of 1, UpdateTimeToLiveInput.TimeToLiveSpecification.AttributeName.

4. terraform show. ttl is still enabled on the table because of error in last command.
   ttl {
   enabled = false
   }

5. terraform plan with original ttl block with enabled=true.
   No changes. Infrastructure is up-to-date.

6. terraform show still shows enabled=false
   ttl {
   enabled = false
   }

[jbigtani]

I found another scenario.

Steps:

1. Create table with ttl enabled.
2. Disable ttl by changing enabled flag to false.

ttl {
  attribute_name = "TimeToExist"
  enabled        = false
}

3. terraform show

Expected:

On second step when it fails with ValidationException we expect tfstate to have original ttl value that is enabled

Actual:

it fails but tfstate is changed and ttl enabled = false.

Error: error updating DynamoDB Table (jb-example) time to live: error updating DynamoDB Table (jb-example) Time To Live: ValidationException: Time to live has been modified multiple times within a fixed interval
status code: 400, request id: K468G31014N4UN8U7A1QDL1AARVV4KQNSO5AEMVJF66Q9ASUAAJG

terraform show output on step 3.

ttl {
        attribute_name = "TimeToExist"
        enabled        = false
    }

Note: Validation exception is expected behaviour from AWS since it takes 1 hour for ttl to reflect. Since table was created with ttl=enabled, it is still under process and turning it to false within an hour throws validation exception.

[DrFaust92]

see #13923, it may address the issue here

[jbigtani]

@DeFaust92 I looked at that issue. As per suggestion, I tried this without attribute name and I still have the issue.
ttl {
attribute_name = ""
enabled = false
}

when I run terraform apply to disable ttl, it fails with ValidationException but local state file shows ttl is disabled but actually it is not.

[anGie44]

@jbigtani I would try running a terraform refresh to remedy the state file with the actual external state of the dynamodb_table resource but I believe the next run of terraform plan should show the diff of

~ enabled        = true -> false

Were you able to update the resource if the ttl block was configured as:

ttl {
          attribute_name = "TimeToExist"
          enabled        = false
    }

after waiting for an hour or so after the previous modification as it seems using the empty string "" results in the AWS Validaiton error?

[anGie44]

Related to incorrect Update behavior/state on error: hashicorp/terraform-plugin-sdk#476

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.