Unable to updates tags with empty list with aws provider version 3.74.3

[anskrish]

Terraform CLI and Terraform AWS Provider Version

Terraform v1.0.8
on darwin_amd64
+ provider registry.terraform.io/datadog/datadog v2.21.0
+ provider registry.terraform.io/hashicorp/aws v3.74.3

Affected Resource(s)

• aws_iam_role

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

terraform {
  required_version = "= 1.0.8"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "3.74.3"
    }
  }

}

provider "aws" {
  region = "us-west-2"
}

resource "aws_iam_role" "test_role1" {
  name = "test_role-sand"

  # Terraform's "jsonencode" function converts a
  # Terraform expression result to valid JSON syntax.
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })

  tags = {
    tag-key = "tag-value"
    Name = ""
  }
}

Debug Output

Panic Output

Expected Behavior

➜  dev_ec2 terraform apply
aws_iam_role.test_role1: Refreshing state... [id=test_role-sand]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with
the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_role.test_role1 will be updated in-place
  ~ resource "aws_iam_role" "test_role1" {
        id                    = "test_role-sand"
        name                  = "test_role-sand"
      ~ tags                  = {
          + "Name"   = ""
            # (4 unchanged elements hidden)
        }
      ~ tags_all              = {
          + "Name"   = (known after apply)
            # (4 unchanged elements hidden)
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_role.test_role1: Modifying... [id=test_role-sand]
aws_iam_role.test_role1: Modifications complete after 5s [id=test_role-sand]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

It should say "infra is up-to-date" but still show 1 to change

Actual Behavior

➜  dev_ec2 terraform apply
aws_iam_role.test_role1: Refreshing state... [id=test_role-sand]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with
the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_role.test_role1 will be updated in-place
  ~ resource "aws_iam_role" "test_role1" {
        id                    = "test_role-sand"
        name                  = "test_role-sand"
      ~ tags                  = {
          + "Name"   = ""
            # (4 unchanged elements hidden)
        }
      ~ tags_all              = {
          + "Name"   = (known after apply)
            # (4 unchanged elements hidden)
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_role.test_role1: Modifying... [id=test_role-sand]
aws_iam_role.test_role1: Modifications complete after 5s [id=test_role-sand]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
➜  dev_ec2 terraform plan          
aws_iam_role.test_role1: Refreshing state... [id=test_role-sand]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with
the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_role.test_role1 will be updated in-place
  ~ resource "aws_iam_role" "test_role1" {
        id                    = "test_role-sand"
        name                  = "test_role-sand"
      ~ tags                  = {
          + "Name4"   = ""
            # (4 unchanged elements hidden)
        }
      ~ tags_all              = {
          + "Name4"   = (known after apply)
            # (4 unchanged elements hidden)
        }
        # (8 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Steps to Reproduce

1. terraform apply
2. terraform plan

If we switch to terraform aws provider version 3.15.0, we don't see this behavior. Only finding issue with 3.74 + provider versions.

Important Factoids

References

• #0000

[justinretzolk]

Hey @anskrish 👋 Thank you for taking the time to raise this! So that we have all of the necessary information in order to look into this, can you supply (redacted as necessary) debug logs as well?

[anskrish]

Thanks for responding to the issue @justinretzolk
Here are the debug logs
terraform.log

[hudolejev]

This is also reproducible in v3.48.0:

Terraform v1.0.11
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v3.48.0

[anGie44]

Looks related to #21896

[johnsonaj]

This was resolved in #30973 and merged to main in #31392. Feature will be release in provider v5.0.0

[github-actions]

This functionality has been released in v5.0.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.