Tags repeatedly marked as not being set correctly for aws_db_instance

[davedash]

In Terraform 0.7.8 (and prior):

terraform plan gives me:

~ module.dev.aws_db_instance.db
    tags.%:      "0" => "3"
    tags.Name:   "" => "dbdev"
    tags.dbrole: "" => "master"
    tags.env:    "" => "dev"

My tf file looks like:

resource "aws_db_instance" "db" {
    ...
    engine               = "postgres"
    engine_version       = "9.5.2"
    instance_class       = "db.m3.medium"
    db_subnet_group_name = "${aws_db_subnet_group.db.name}"
    storage_encrypted    = true
    parameter_group_name = "${var.parameter_group}"  # summit custom
    allow_major_version_upgrade = true

    tags {
      Name = "${var.env}"
      dbrole = "master"
      env = "${var.env}"
    }
...

After an apply, the tags are set. Re-running plan gives me the same output, so I'm always in a dirty state.

This is the case for all of my rds instances.

[catsby]

Hey @davedash can you try running a refresh or plan with debugging enabled?

$ TF_LOG=1 terraform refresh

I'm looking for logs involving the tags, something like either:

Error building ARN for DB Instance, not setting Tags for DB

or

[DEBUG] Error retrieving tags for ARN: <arn>

[davedash]

Thanks. This uncovered what I think the culprit is.

User: * is not authorized to perform: rds:ListTagsForResource on resource: *

This error is worth surfacing, IMO.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.