Tags not being refreshed properly in resources.

[grahamjenson]

Terraform v0.6.16

Affected Resources

• aws_elasticache_cluster
• aws_db_parameter_group
• aws_db_instance
• aws_db_subnet_group

Tags are not being refreshed properly:

With a terraform.tf file:

resource "aws_db_parameter_group" "pg" {
  "name" = "pg"
  "family" = "postgres9.5"
  "description" = "RDS parameter group"

  tags {
    "Name" = "rdspg::pg"
  }
}

and terraform.tfstate file:

{
 "version": 1,
 "serial": 2,
 "modules": [
  {
   "path": [
    "root"
   ],
   "outputs": {},
   "resources": {
    "aws_db_parameter_group.pg": {
     "type": "aws_db_parameter_group",
     "primary": {
      "id": "pg"
     }
    }
   }
  }
 ]
}

Running terraform plan results in:

~ aws_db_parameter_group.pg
    tags.#:           "0" => "2"
    tags.Name:        "" => "rdspg::pg"


Plan: 0 to add, 1 to change, 0 to destroy.

Even thought the resource in the cloud has the correct Name tag.

[jen20]

Hi @grahamjenson! Thanks for reporting this - I have a feeling it has been fixed as part of the work done by @stack72 to support importing RDS instances and Elasticache, but cannot verify right now. I'll circle back to this later this week.

[stack72]

Hi @grahamjenson

So I have been looking at this today. I can't see the bug here. Currently, we have the following test:

resource.TestStep{
                Config: testAccAWSDBParameterGroupConfig(groupName),
                Check: resource.ComposeTestCheckFunc(
                    testAccCheckAWSDBParameterGroupExists("aws_db_parameter_group.bar", &v),
                    testAccCheckAWSDBParameterGroupAttributes(&v, groupName),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "name", groupName),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "family", "mysql5.6"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "description", "Managed by Terraform"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.1708034931.name", "character_set_results"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.1708034931.value", "utf8"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.2421266705.name", "character_set_server"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.2421266705.value", "utf8"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.2478663599.name", "character_set_client"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "parameter.2478663599.value", "utf8"),
                    resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "tags.%", "1"),
                ),
            },

As you can see, it has the following:

resource.TestCheckResourceAttr(
                        "aws_db_parameter_group.bar", "tags.%", "1"),

these are checks to make sure that tags are set as expected. The issue I think you may be falling foul of is this:

arn, err := buildRDSPGARN(d, meta)
    if err != nil {
        name := "<empty>"
        if paramGroup.DBParameterGroupName != nil && *paramGroup.DBParameterGroupName != "" {
            name = *paramGroup.DBParameterGroupName
        }
        log.Printf("[DEBUG] Error building ARN for DB Parameter Group, not setting Tags for Param Group %s", name)
    } 

There are cases where the ARN doesn't get built due to permissions (this has been fixed in the latest release!)

If you can, please can you run the logging for terraform in debug mode to help diagnose this being the case?

TF_LOG=debug terraform plan

And then drop the output here, then that would be fantastic

Paul

[stack72]

Ping @grahamjenson

Did you have a chance to try this?

Paul

[grahamjenson]

@stack72 Yes I just tried it and saw an Error caused by not having iam:GetUser privileges. I added those privileges and it solved the issue.

Is this fixed in the terraform 0.6.17? If it is I think you can close this issue and I will wait for the release.

Cheers
Graham

[stack72]

Hi @grahamjenson

This helps me a lot with this issue. I think we need to remove the silently failing from the code and error out at that point. I will discuss it with the team and then get a fix in place for 0.7 (the next release)

Thanks so much for helping debug it

Paul

[grahamjenson]

Cheers. Graham

[stack72]

FYI, this is solved by #7151

P.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.