SNS topic subscription is not recreated after SNS topic delete/recreate

[Tirke]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.14
provider.aws v2.22.0

Affected Resource(s)

• aws_sns_topic_subscription
• aws_sns_topic

Terraform Configuration Files

One directory with an SNS declaration :

provider "aws" {
  region = "eu-west-1"
}

resource "aws_sns_topic" "hello" {
  name = "sns-topic"
}

Another directory with the SQS declaration

provider "aws" {
  region = "eu-west-1"
}

data "aws_sns_topic" "sns-topic" {
  name = "sns-topic"
}

resource "aws_sqs_queue" "stream_out_queue" {
  name                       = "sqs-queue"
  visibility_timeout_seconds = "360"
}

resource "aws_sqs_queue_policy" "sns_to_sqs_policy" {
  queue_url = "${aws_sqs_queue.stream_out_queue.id}"
  policy    = "${data.aws_iam_policy_document.sns_to_sqs_policy_document.json}"
}


resource "aws_sns_topic_subscription" "stream-out_sqs_target" {
  topic_arn              = "${data.aws_sns_topic.sns-topic.arn}"
  protocol               = "sqs"
  endpoint               = "${aws_sqs_queue.stream_out_queue.arn}"
  endpoint_auto_confirms = true
}


data "aws_iam_policy_document" "sns_to_sqs_policy_document" {
  statement {
    actions = ["sqs:SendMessage"]

    resources = ["${aws_sqs_queue.stream_out_queue.arn}"]

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"

      values = ["${data.aws_sns_topic.sns-topic.arn}"]
    }
  }
}

Debug Output

Debug Output

Expected Behavior

When applying the code containing the aws_sns_topic_subscription declaration it should always recreate it if it is NOT present.

Actual Behavior

aws_sns_topic_subscription is NOT recreated and attached when it isn't present in the topic subscription BUT present in the overall list of existing subscriptions.

Steps to Reproduce

1. terraform init and terraform apply the SNS topic code
2. terraform init and terraform apply the SQS code
3. terraform destroy the SNS topic code
4. terraform apply the SNS topic code
5. terraform apply the SQS code

Result after step 5:
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

But there is no subscription under the SNS topic, the terraform apply of the SQS code is not recreating the correct subscription.

[max-rocket-internet]

Hit this bug today. A little unnerving as now we can't be sure of the state of subscriptions.

[infrat]

Any updates on that? Seems that one of the crucial TF feature is not working. We're also experiencing this issue.

[FarhadF]

easier way to reproduce: apply the example completely. remove the subscription manually.

The subscription will be in the state but it wont be recreated on the next run.

Partial workaround: you need to remove the subscription from the state and rerun to recreate the subscription. (this doesnt help the fact that we never know if subscriptions are in place)

[ewbankkit]

It looks like there is an eventual consistency issue here, if you manually delete the subscription (unsubscribe) then for a short period get-subscription-attributes returns the old subscription's attributes even though list-subscriptions returns no subscriptions:

$ aws --region eu-west-1 sns list-subscriptions
{
    "Subscriptions": [
        {
            "SubscriptionArn": "arn:aws:sns:eu-west-1:123456789012:sns-topic:06f49a2d-b5c9-4565-a870-e3e9d68396d7",
            "Owner": "123456789012",
            "Protocol": "sqs",
            "Endpoint": "arn:aws:sqs:eu-west-1:123456789012:sqs-queue",
            "TopicArn": "arn:aws:sns:eu-west-1:123456789012:sns-topic"
        }
    ]
}
$ aws --region eu-west-1 sns unsubscribe --subscription-arn arn:aws:sns:eu-west-1:123456789012:sns-topic:06f49a2d-b5c9-4565-a870-e3e9d68396d7
$ aws --region eu-west-1 sns list-subscriptions-by-topic --topic-arn arn:aws:sns:eu-west-1:123456789012:sns-topic
{
    "Subscriptions": []
}
$ aws --region eu-west-1 sns get-subscription-attributes --subscription-arn arn:aws:sns:eu-west-1:123456789012:sns-topic:06f49a2d-b5c9-4565-a870-e3e9d68396d7
{
    "Attributes": {
        "Owner": "123456789012",
        "RawMessageDelivery": "false",
        "TopicArn": "arn:aws:sns:eu-west-1:123456789012:sns-topic",
        "Endpoint": "arn:aws:sqs:eu-west-1:123456789012:sqs-queue",
        "Protocol": "sqs",
        "PendingConfirmation": "false",
        "ConfirmationWasAuthenticated": "true",
        "SubscriptionArn": "arn:aws:sns:eu-west-1:123456789012:sns-topic:06f49a2d-b5c9-4565-a870-e3e9d68396d7"
    }
}

The aws_sns_topic_subscription resource uses the GetSubscriptionAttributes SNS API when refreshing state and so does not detect that the underlying AWS resource has disappeared.

We should first use the ListSubscriptionsByTopic SNS API and then GetSubscriptionAttributes if there is a listed topic.

[grahamhar]

Just been hit by this issue and I see Pr 14101 has been open a while as a fix for this. Is there anything I can do to progress the PR as this is quite an impactful bug

[ghost]

This has been released in version 3.34.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!