[Bug]: resource/aws_iot_provisioning_template: type JITP not works from version 5.57.0

[josegalarceh]

Terraform Core Version

Terraform version: 1.5.7

AWS Provider Version

5.22.0, 5.56.1, 5.57.0, 5.60.0

Affected Resource(s)

aws_iot_provisioning_template

Expected Behavior

With the latest version of the aws provider, you should be able to create the iot provisioning template resource of type jitp.

Actual Behavior

when one wants to create an iot provisioning template of type JITP, one creates one of type FLEET_PROVISIONING, regardless of whether one explicitly states that one of JITP is desired.

Relevant Error/Panic Output Snippet

[WARN]  Provider "provider[\"registry.terraform.io/hashicorp/aws\"]" produced an unexpected new value for aws_iot_provisioning_template.ts_iot_default_provisioning_template, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .type: was cty.StringVal("JITP"), but now cty.StringVal("FLEET_PROVISIONING")

Terraform Configuration Files

provider.tf:

terraform {
  required_version = ">= 0.14"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      # v5.57.0 and higger no works
      # v5.22.0 to v5.56.1 works
      version = "~> 5.57.0" 
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

main.tf

variable "TS_iot_policy_name" {
  type        = string
  default     = "policy-iotlab"
  description = <<EOF
  **DEPENDS**
  Required if jitp_enabled = true and custom_provisioning_template_body is not set.
  Name of the previously created iot-policy to add devices to for JITP.
  EOF
}

variable "TS_iot_thing_group_name" {
  type        = string
  default     = "default-thing-group"
  description = <<EOF
  **DEPENDS**
  Required if jitp_enabled = true and custom_provisioning_template_body is not set.
  Name of the previously created thing-group to add devices to for JITP.
  EOF
}

variable "TS_iot_thing_type" {
  type        = string
  default     = "default-thing-type"
  description = <<EOF
  **DEPENDS**
  Required if jitp_enabled = true and custom_provisioning_template_body is not set.
  Name of the previously created thing-type used for JITP.
  EOF
}

variable "TS_app" {
  type        = string
  default     = "troubleshooting_5"
  description = <<EOF
  **OPTIONAL**
  prefix for the provisioning template if jitp_enabled is set to true. It will reflect the same value as monitoring_app_name.
  EOF
}

variable "TS_iot_provisioning_role_arn" {
  type        = string
  default     = "arn:aws:iam::xxxxxxxxxxx:role/au-iot-provisioning-role"
  description = <<EOF
  **DEPENDS**
  Required if jitp_enabled = true.
  ARN of the au-iot-provisoning role to use for JITP.
  EOF
}

variable "TS_custom_provisioning_template_body" {
  type        = string
  default     = ""
  description = <<EOF
  **OPTIONAL**
  Allows the specification of a non-standard IoT Provisioning Template for JITP
  EOF
}

locals {
  # Default provisioning template for IoT Device onboarding
  TS_default_tb = <<EOF
{
  "Parameters": {
    "AWS::IoT::Certificate::CommonName": {
      "Type": "String"
    },
    "AWS::IoT::Certificate::Id": {
      "Type": "String"
    }
  },
  "Resources": {
    "${var.TS_iot_policy_name}": {
      "Type": "AWS::IoT::Policy",
      "Properties": {
        "PolicyName": "${var.TS_iot_policy_name}"
      }
    },
    "certificate": {
      "Type": "AWS::IoT::Certificate",
      "Properties": {
        "CertificateId": {
          "Ref": "AWS::IoT::Certificate::Id"
        },
        "Status": "Active"
      }
    },
    "thing": {
      "Type": "AWS::IoT::Thing",
      "OverrideSettings": {
        "AttributePayload": "MERGE",
        "ThingGroups": "MERGE",
        "ThingTypeName": "REPLACE"
      },
      "Properties": {
        "AttributePayload": {},
        "ThingGroups": ["${var.TS_iot_thing_group_name}"],
        "ThingName": {
          "Ref": "AWS::IoT::Certificate::CommonName"
        },
        "ThingTypeName": "${var.TS_iot_thing_type}"
      }
    }
  }
}
EOF
}

resource "aws_iot_provisioning_template" "ts_iot_default_provisioning_template" {
#   count                 = var.jitp_enabled ? 1 : 0
  name                  = "${var.TS_app}-default-pb"
  description           = "troubleshooting Default provisioning template"
  provisioning_role_arn = var.TS_iot_provisioning_role_arn
  enabled               = true
  type                  = "JITP"
  template_body         = var.TS_custom_provisioning_template_body == "" ? local.TS_default_tb : var.TS_custom_provisioning_template_body
  tags = {
    "function" = "app"
    "app"      = "iot"
  }
}

Steps to Reproduce

1. Put the above files together.
2. Export the variable “export TF_LOG=DEBUG”.
3. run a terraform init and then terraform plan, and the output should be a iot provisioning template resource of type JITP.
4. execute the terraform apply, in the logs you will see the warning and the resource will be created as FLEET_PROVISIONING.

To be able to deploy the resource correctly:

1. change the provider version to 5.56.1 (or some minor until 5.22.0, where this functionality was launched).
2. run the plan, the resource should appear as a JITP type.
3. run the apply, the resource should be created as JITP type.

Debug Output

2024-07-31T13:46:00.864-0400 [WARN] Provider "provider["registry.terraform.io/hashicorp/aws"]" produced an unexpected new value for aws_iot_provisioning_template.ts_iot_default_provisioning_template, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:
- .type: was cty.StringVal("JITP"), but now cty.StringVal("FLEET_PROVISIONING")
aws_iot_provisioning_template.ts_iot_default_provisioning_template: Creation complete after 1s [id=troubleshooting_4-default-pb]

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[ewbankkit]

Relates #37152.

I can reproduce this with a new acceptance test case:

% make testacc TESTARGS='-run=TestAccIoTProvisioningTemplate_jitp' PKG=iot
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.22.5 test ./internal/service/iot/... -v -count 1 -parallel 20  -run=TestAccIoTProvisioningTemplate_jitp -timeout 360m
=== RUN   TestAccIoTProvisioningTemplate_jitp
=== PAUSE TestAccIoTProvisioningTemplate_jitp
=== CONT  TestAccIoTProvisioningTemplate_jitp
    provisioning_template_test.go:186: Step 1/2 error: Check failed: Check 11/11 error: aws_iot_provisioning_template.test: Attribute 'type' expected "JITP", got "FLEET_PROVISIONING"
--- FAIL: TestAccIoTProvisioningTemplate_jitp (17.58s)
FAIL
FAIL	github.com/hashicorp/terraform-provider-aws/internal/service/iot	22.820s
FAIL
make: *** [testacc] Error 1

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.61.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.