-
Notifications
You must be signed in to change notification settings - Fork 9.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Resource aws_ssm_patch_group cannot handle multiple baselines of differing OS in a single patch group #9603
Comments
FWIW - Just reproduced this issue on version 0.12.18, on provider:
|
Hope to take a look at this over the next coming weeks. |
Your comments don't follow with AWS own documentation: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-patchgroups.html Note Therefore the Terraform behaviour is correct, no? |
Correct, however a patch baseline can have multiple patch groups. This is what Terraform fails to pick up. On the Modify Patch Groups page in AWS Console:
My original example should ideally have separate patch group names to highlight this. |
This is actually not correct as the docs are somewhat misleading. You can have a single patch group registered with multiple patch baselines if they are for different operating systems. That line should really read "A patch group can only be registered with one patch baseline per operating system" See below as an example where I've created an Internal Systems patch baseline for each OS (Windows, Amzn1 and Amzn2) and associated them with a single patch group: |
We are having the same problem. Even though it is written as above in the documentation, even aws-cli allows to register multiple patch baseline to one group. IMHO, the problem looks like, the id that is used as a resource reference within the terraform state is set to |
Terraform has |
👍 |
This has been released in version 3.33.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks! |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks! |
Community Note
Terraform Version
Affected Resource(s)
Terraform Configuration Files
Debug Output
Apply output: https://gist.github.com/jdheyburn/e8298fa7b182f39948c98b34909fe2eb
Panic Output
N/A
Expected Behavior
Actual Behavior
Output of the apply
Note the following baseline IDs for referencing the above plan outpuit:
amazon_linux_2 = pb-00fb43e57d24e1b2c
centos = pb-01ad30a5a012192ed
amazon_linux = pb-0a38d8d0f7b2d56ce
Steps to Reproduce
With the above HCL:
terraform apply
terraform apply
Important Factoids
N/A
References
Patch groups can be assigned many baselines, but only one baseline per OS - this is the how it functions in AWS console. Terraform here is assuming that a patch group can only have one baseline - or that it is only reading the first patch group entry retrieved from describe-patch-groups and then making changes from there.
The text was updated successfully, but these errors were encountered: