hashicorp/aws v4.2.0, v3.74.0, v3.56.0 - Issue with a tag filter in aws_s3_bucket_replication_configuration

[maxkuzmins]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.0.11
on darwin_amd64

• provider registry.terraform.io/hashicorp/aws v4.2.0 (reproduced with v3.56.0 too)
• provider registry.terraform.io/hashicorp/cloudinit v2.2.0
• provider registry.terraform.io/hashicorp/kubernetes v1.13.3
• provider registry.terraform.io/hashicorp/local v2.1.0
• provider registry.terraform.io/hashicorp/null v2.1.2
• provider registry.terraform.io/hashicorp/random v3.1.0
• provider registry.terraform.io/hashicorp/template v2.2.0

Affected Resource(s)

• aws_s3_bucket_replication_configuration

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_s3_bucket_replication_configuration" "replication_config" {
  role   = aws_iam_role.s3_replication_role.arn
  bucket = "${var.source_bucket_id}"

  rule {
    status = "Enabled"

    id = "replication_destination_region-ap-south-1"
    delete_marker_replication {
      status = "Disabled"
    }
    filter {
      tag {
        key   = "replication_destination_region"
        value = "ap-south-1"
      }
    }

    destination {
      bucket = "${var.destination_bucket_arn}"
      encryption_configuration {
        replica_kms_key_id = "${var.kms_key_id}"
      }
    }

    source_selection_criteria {
      sse_kms_encrypted_objects {
        status = "Enabled"
      }
    }
  }
}

Debug Output

Panic Output

Expected Behavior

Terraform to create a new S3 replication rule with a filter by object tag key: replication_destination_region, value: ap-south-1.

Actual Behavior

1. terraform apply produces the correct and expected plan:

  # module.s3_replication.aws_s3_bucket_replication_configuration.replication_config["source_bucket_id_here"] will be created
  + resource "aws_s3_bucket_replication_configuration" "replication_config" {
      + bucket = "source_bucket_id_here"
      + id     = (known after apply)
      + role   = "role_arn_here"

      + rule {
          + id     = "replication_destination_region-ap-south-1"
          + status = "Enabled"

          + delete_marker_replication {
              + status = "Disabled"
            }

          + destination {
              + bucket = "destination_bucket_arn_here"

              + encryption_configuration {
                  + replica_kms_key_id = "key_id_here"
                }
            }

          + filter {

              + tag {
                  + key   = "replication_destination_region"
                  + value = "ap-south-1"
                }
            }

          + source_selection_criteria {

              + sse_kms_encrypted_objects {
                  + status = "Enabled"
                }
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

2. After apply completion, the created replication rule has a different tag filter from what was defined in the Terraform configuration and shown in the plan: key is key instead of replication_destination_region, value is replication_destination_region instead of ap-south-1
   

Steps to Reproduce

1. terraform apply

Important Factoids

I first encountered this problem with aws provider v3.56.0, upgraded to v3.74.0, then to v4.2.0, and it's still present.

Manual modification of the tag filter with AWS Console to the desired values leads to an error in terraform plan/apply:

│ Error: error setting rule: Invalid address to set: []string{"rule", "2764525732", "filter", "0", "tag", "0", "replication_destination_region"}
│ 
│   with module.s3_replication.aws_s3_bucket_replication_configuration.replication_config["source_bucket_id_here"],
│   on s3_replication/main.tf line 166, in resource "aws_s3_bucket_replication_configuration" "replication_config":
│  166: resource "aws_s3_bucket_replication_configuration" "replication_config" {

Creation of a replication rule with a filter that has 2 tags wrapped in an and block works as expected:

filter {
      and {
        tags = {
          "replication_destination_region" = "${var.india_region}",
          "nonexistent_tag" = "tf_workaround_please_ignore"
        }
      }
}

...but doesn't address my use case.

References

• #0000

[anGie44]

Hi @maxkuzmins , thank you for raising this issue. This should of been fixed in v4.2.0 (😞 ) of the AWS provider (with #23252) , but I'll reinvestigate 👍 ### Ahh i misread! this is for the replication_configuration. Will have a look nonetheless

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.