aws_efs_file_system_policy Document Always Changes With Single Conditions v3.31.0

[philof]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.7
AWS v3.28.0+

Affected Resource(s)

• aws_efs_file_system_policy

Terraform Configuration Files

resource "aws_efs_file_system" "this" {
  creation_token = "test"
}

data "aws_iam_policy_document" "enforce_in_transit_encryption" {
  statement {
    sid = "efs-enforce-in-transit-encryption"

    effect = "Deny"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = ["*"]

    resources = [aws_efs_file_system.this.arn]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"

      values = ["false",]
    }
  }
}

resource "aws_efs_file_system_policy" "this" {
  file_system_id = aws_efs_file_system.this.id
  policy         = data.aws_iam_policy_document.enforce_in_transit_encryption.json
}

Expected Behavior

After apply I expect the efs policy document not to try to change the condition on subsequent apply's. The condition block requires an array of strings and the policy document includes the brackets on this condition. After apply AWS removes the brackets however the policy document adds them resulting in parity thus terraform always wants to change the policy.

$ terraform apply
aws_efs_file_system.this: Refreshing state... [id=fs-9a515ee2]
aws_efs_file_system_policy.this: Refreshing state... [id=fs-9a515ee2]

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Actual Behavior

$ terraform apply
aws_efs_file_system.this: Refreshing state... [id=fs-9a515ee2]
aws_efs_file_system_policy.this: Refreshing state... [id=fs-9a515ee2]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_efs_file_system_policy.this will be updated in-place
  ~ resource "aws_efs_file_system_policy" "this" {
        id             = "fs-9a515ee2"
      ~ policy         = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Condition = {
                          ~ Bool = {
                              ~ aws:SecureTransport = "false" -> [
                                  + "false",
                                ]
                            }
                        }
                        # (5 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Steps to Reproduce

1. terraform apply
2. terraform apply

Important Factoids

This was introduced in v3.28.0. v3.27.0 works as expected.

References

This was brought up in the referenced ticked, but was not linked to EFS Policy documents. IAM policy documents work as expected.

• IAM Policy Document Always Changes With Single Conditions v3.28.0 #17623

[tms]

Taking a quick (uninformed) peek, my guess is that this regressed in #17556 where the lists are no longer passed through iamPolicyDecodeConfigStringList to avoid the sorting that method does, and we no longer get the special behaviour when the list has len() == 1, causing a mismatch against the JSON the endpoint returns.

[giulianisanches]

I have a issue that is similar to this one.

In my case, i don't add a Resource section within my policy document as it's not required, but when my terraform is applied a Resource is automatically added and every time i apply it again, it try to change and remove the Resource line.

[crabby345]

+1

Same issue here using policy document for iam policy using a single condition value.

Using 3.35

[KIgnas]

I am seeing this issue too with aws_sns_topic_policy resource. A temporary workaround until the PR is merged was to add another condition value, like this:

condition {
      test     = "StringEquals"
      variable = "AWS:SourceOwner"

      values = [
        data.aws_caller_identity.current.account_id,
        "fix for https://github.com/hashicorp/terraform-provider-aws/issues/18005",
      ]
    }

[github-actions]

This functionality has been released in v3.67.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.