Error creating SSM association: InvalidDocument: Invalid document provided

[hryamzik]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.14

Affected Resource(s)

• aws_ssm_association
• aws_ssm_document

Terraform Configuration Files

variable scripts {
    default = [
        "myscript.sh"
    ]
}

resource "aws_s3_bucket_object" "scripts" {
  key    = "${var.scripts[count.index]}"
  bucket = "${aws_s3_bucket.scripts.bucket}"
  source = "${path.module}/scripts/${var.scripts[count.index]}"
  etag   = "${md5(file("${path.module}/scripts/${var.scripts[count.index]}"))}"
  acl    = "private"
  count  = "${length(var.scripts)}"
}

resource "aws_ssm_document" "run-remote-script" {
  name          = "RunRemoteScript-${element(aws_s3_bucket_object.scripts.*.etag, count.index)}"
  document_type = "Command"
  content = "${file("${path.module}/documents/RunRemoteScript.yaml")}"
  count = "${length(var.scripts)}"
  document_format = "YAML"
}

resource "aws_ssm_association" "script" {
  name             = "AWS-RunRemoteScript-${element(aws_s3_bucket_object.scripts.*.etag, index(var.scripts, "myscript.sh"))}"
  association_name = "s3-script"
  parameters {
      sourceType = "S3"
      sourceInfo = <<EOJ
      {
          "path": "https://s3.amazonaws.com/${aws_s3_bucket.scripts.bucket}/myscript.sh"
      }
      EOJ
      commandLine = "myscript.sh"
  }
}

Expected results

Works without errors

Actual results

First run is fine. terraform plan on script file change looks fine as well but fails to apply:

Error: Error applying plan:

2 errors occurred:
	* aws_ssm_document.run-remote-script: 1 error occurred:
	* aws_ssm_document.run-remote-script: Error updating SSM document: InvalidDocument: 
	status code: 400, request id: xxxxx


	* aws_ssm_association.script: 1 error occurred:
	* aws_ssm_association.script: Error creating SSM association: InvalidDocument: Invalid document provided
	status code: 400, request id: xxxxx

Terraform manages to apply changes after 2-3 retries.

Old versions of documents are not deleted.

References

• Force new resource for aws_ssm_association on s3 file change #9996

[bflad]

The fix (requiring aws_ssm_document resource replacement when changing the name argument) has been merged and will release with version 3.29.0 of the Terraform AWS Provider, likely later today.

[ghost]

This has been released in version 3.29.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!