resource_aws_cloudtrail errors out when validating data_resource type AWS::DynamoDB::Table

[ryanbreed-clearme]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.13.6
+ provider registry.terraform.io/-/aws v3.36.0

Affected Resource(s)

• aws_cloudtrail

Terraform Configuration Files

data "aws_partition" "main_current" {}

resource "aws_cloudtrail" "very_chatty_cloudtrail" {
  name                          = "unhappy-trail"
  s3_bucket_name                = "any-cloudtrail-bucket"
  enable_logging                = true
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true

  event_selector {
    read_write_type           = "All"
    include_management_events = true
    data_resource {
      type   = "AWS::Lambda::Function"
      values = ["arn:${data.aws_partition.main_current.partition}:lambda"]
    }
  }

  event_selector {
    read_write_type           = "All"
    include_management_events = true
    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:${data.aws_partition.main_current.partition}:s3:::"]
    }
  }

  event_selector {
    read_write_type           = "All"
    include_management_events = true
    data_resource {
      type   = "AWS::DynamoDB::Table"
      values = ["arn:${data.aws_partition.main_current.partition}:dynamodb"]
    }
  }
}

Debug Output

error log here

Expected Behavior

This configuration is required to implement data plane event logging of DynamoDB tables in cloudtrail and is a permitted configuration of the resource per the current api spec

Actual Behavior

errors out when validating data_resource in https://github.com/hashicorp/terraform-provider-aws/blob/v3.36.0/aws/resource_aws_cloudtrail.go#L113

ValidateFunc only checks membership in {"AWS::S3::Object", "AWS::Lambda::Function"}

Error: expected event_selector.2.data_resource.0.type to be one of [AWS::S3::Object AWS::Lambda::Function], got AWS::DynamoDB::Table

Steps to Reproduce

1. terraform plan

Important Factoids

• Tried in ue1 and govcloud

References

• Current reference for data type DataResource in CloudTrail API

[anGie44]

Hi @ryanbreed-clearme, thank you for raising this issue. Support for that type is being addressed in a PR tied to a similar issue (#18394) , so I'd refer there to follow-up on the needed change. I'm going to close this as a duplicate, but thank you again 😃 !

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!